Leaderboard github.com

viebvo/llm-probe

Speed, accuracy and capabilities of LLM endpoints: benchmark and compare Ollama, vLLM and Open WebUI models

View repository ↗
Python
★ 0
commit 4e172bfd708b
scored 2026-11-14
scoring prov-5+qual-2+sec-2

unreviewed-ai-risk

AI provenance

100%

explicit

Confidence: 73%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

41/100

poor

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

58/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

100% explicit

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

How the score is built

Explicitly attributed share100%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share100%
AI tool configuration files0
Work sessions at AI pace1
Releases at AI pace0
Coding-style index (1.0+ means possible)0.00

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	12	14,438	2026-10-26	2026-11-13

Lines added per month all AI-attributed share

2026-1013,652 · 100% AI
2026-11786 · 100% AI

Findings in AI-attributed lines vs the rest

From git blame: 14,284 lines trace to AI-attributed commits, 0 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	4.76	—	—
Security	21.00	—	—

Evidence by analyzer

Explicit AI attributionok13 items

attributed_commit_share: 100.0%
attributed_commits: 12
attributed_loc: 14,438
attributed_loc_share: 100.0%
commits: 12
effective_loc: 14,438
tools_detected: 1

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok1 item

3,870 lines of first-party code in ~1.8h (2,151 lines/hour, 2 commit session)

excluded_import_loc: 9,362
flagged_loc: 3,870
flagged_loc_share: 76.2%
flagged_units: 1
max_loc_per_hour: 2,151.00
measured_loc: 5,076
median_loc_per_hour: 120.74
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 5

Release velocityok

flagged_releases: 0
max_loc_per_day: 3,905.80
releases: 3

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 14,284
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 14,284
blame_failures: 0
files_blamed: 39
other_lines: 0
quality:ai_findings: 68
quality:ai_per_kloc: 4.76
quality:other_findings: 0
security:ai_findings: 300
security:ai_per_kloc: 21.00
security:other_findings: 0

Code quality

41 poor

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 26% of function code in complex or long functions; 1% duplicated lines. Weakest area: testing.

How the score is built

Complexity46
Duplication93
Lint and smells34
Tests and CI0
Documentation65
Type safety40
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 67
function_nloc: 9,959
functions: 1,538
long_functions: 3
many_param_functions: 6
mean_ccn: 3.99
p90_ccn: 9
risky_nloc_share: 25.9%

Duplication (jscpd)ok3 items

compared_lines: 12,052
duplicated_lines: 140
duplicated_share: 1.2%
files: 39

Lintok

category:best-practice: 18
category:correctness: 48
category:maintainability: 2
findings: 68
scanned_lines: 14,284
weighted_findings: 61.50

Tests and CIok

check:ci_present: no
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: no
check:test_ratio: no
check:tests_cochange: no
ci_files: 0
cochange_commits: 9
cochange_share: 0.0%
source_lines: 14,284
test_lines: 0
test_ratio: 0

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 1,062

Type safetyok

check:low_escape_density: yes
check:strict_config: no
escapes: 1
escapes_per_kloc: 0.10

Security

58 weak

Security posture is weak: 52 known vulnerabilities in 2 dependencies; 79 high-severity SAST findings. Weakest area: sast.

How the score is built

Secrets100
Static analysis (SAST)3
Vulnerable dependencies68
CI workflowsnot measured
Security posture40
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 4
declared: 4
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 392
findings_high: 79
findings_low: 0
findings_medium: 313
parse_errors: 1
scanned_lines: 14,284
weighted_findings: 137.85

Dependencies (osv-scanner)ok

penalty: 23
vulnerabilities: 52
vulnerable_packages: 2
vulns_critical: 1
vulns_high: 22
vulns_low: 6
vulns_medium: 23
vulns_unknown: 0

CI workflows (zizmor)skipped

Security postureok1 item

Security policy: SECURITY.md SECURITY.md

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: yes
check:signed_commits: no
signed_commit_share: 0.0%
unpinned_manifests: 0

Release downloadsok5 items

release v0.20.0 ships llm-probe-0.20.0.zip (2 downloads)
release v0.19.0 ships llm-probe-0.19.0.zip (1 downloads)
release v0.18.0 ships llm-probe-0.18.0.zip (2 downloads)
release v0.17.2 ships llm-probe-0.17.2.zip (1 downloads)
gives an archive password README.md

binary_assets: 4
signals: 2
suspicious: 0

Findings

1 critical106 high285 medium28 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-63hf-3vf5-4wqf`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2102, GHSA-63hf-3vf5-4wqf	Dependencies (osv-scanner)
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	tools/gui_tests/run.py:769	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	tools/gui_tests/run.py:814	file object opened without corresponding close	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	tools/gui_tests/run.py:822	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.open-never-closed`	tools/make_screenshots.py:78	file object opened without corresponding close	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	tools/make_screenshots.py:86	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	llm_probe/sandbox.py:193	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/compare.js:102	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/compare.js:102	User controlled data in a `bar.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/compare.js:126	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/compare.js:126	User controlled data in a `$("cmp-out").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/compare.js:20	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/compare.js:20	User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/core.js:192	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/core.js:192	User controlled data in a `sel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/core.js:198	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/core.js:198	User controlled data in a `plainEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/endpoints.js:46	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/endpoints.js:46	User controlled data in a `tb.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/endpoints.js:6	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/endpoints.js:6	User controlled data in a `$("home-ep").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/endpoints.js:9	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/endpoints.js:9	User controlled data in a `$("home-runs").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/init.js:7	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/init.js:7	User controlled data in a `document.querySelector("main").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/prompts.js:14	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/prompts.js:14	User controlled data in a `$("pr-promptset").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/prompts.js:44	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/prompts.js:44	User controlled data in a `tb.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/prompts.js:69	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/prompts.js:69	User controlled data in a `$("dlg-body").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/prompts.js:71	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/prompts.js:71	User controlled data in a `$("dlg-buttons").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/responses.js:130	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/responses.js:130	User controlled data in a `grid.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/responses.js:19	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/responses.js:19	User controlled data in a `$("ans-runs").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/responses.js:48	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/responses.js:48	User controlled data in a `list.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/responses.js:89	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/responses.js:89	User controlled data in a `$("ans-question").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/responses.js:90	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/responses.js:90	User controlled data in a `$("ans-images").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/results.js:158	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/results.js:158	User controlled data in a `tb.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/results.js:292	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/results.js:292	User controlled data in a `$("run-detail").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/sessions.js:21	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/sessions.js:21	User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/sessions.js:265	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/sessions.js:265	User controlled data in a `$(key).innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/test-models.js:101	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/test-models.js:101	User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/test-models.js:20	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/test-models.js:20	User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/test-models.js:9	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/test-models.js:9	User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/test.js:166	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/test.js:166	User controlled data in a `$("t-think").querySelector(".tlist").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/test.js:177	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/test.js:177	User controlled data in a `$("pr-images").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/test.js:256	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/test.js:256	User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/test.js:298	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/test.js:298	User controlled data in a `$("t-selcount").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/test.js:333	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/test.js:333	User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	llm_probe/static/test.js:646	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	llm_probe/static/test.js:646	User controlled data in a `$("live").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	llm_probe/storage.py:1023	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	llm_probe/storage.py:1050	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	llm_probe/storage.py:1383	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	llm_probe/storage.py:1449	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	llm_probe/storage.py:321	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	llm_probe/storage.py:93	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`osv/GHSA-2fqr-mr3j-6wp8`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2112, GHSA-2fqr-mr3j-6wp8	Dependencies (osv-scanner)
high	`osv/GHSA-2g87-pp6c-29x5`	requirements.txt	[email protected] (PyPI) is affected by GHSA-2g87-pp6c-29x5	Dependencies (osv-scanner)
high	`osv/GHSA-2wxc-x7rj-hg8f`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3808, GHSA-2wxc-x7rj-hg8f	Dependencies (osv-scanner)
high	`osv/GHSA-4fvr-rgm6-gqmc`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2107, GHSA-4fvr-rgm6-gqmc	Dependencies (osv-scanner)
high	`osv/GHSA-4m7w-qmgq-4wj5`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-237, GHSA-4m7w-qmgq-4wj5	Dependencies (osv-scanner)
high	`osv/GHSA-5h86-8mv2-jq9f`	requirements.txt	[email protected] (PyPI) is affected by GHSA-5h86-8mv2-jq9f	Dependencies (osv-scanner)
high	`osv/GHSA-5m98-qgg9-wh84`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1098, GHSA-5m98-qgg9-wh84	Dependencies (osv-scanner)
high	`osv/GHSA-5wr8-gcqf-gqf3`	requirements.txt	[email protected] (PyPI) is affected by GHSA-5wr8-gcqf-gqf3	Dependencies (osv-scanner)
high	`osv/GHSA-63hw-fmq6-xxg2`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2110, GHSA-63hw-fmq6-xxg2	Dependencies (osv-scanner)
high	`osv/GHSA-6mq8-rvhq-8wgg`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1101, GHSA-6mq8-rvhq-8wgg	Dependencies (osv-scanner)
high	`osv/GHSA-9x8q-7h8h-wcw9`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2113, GHSA-9x8q-7h8h-wcw9	Dependencies (osv-scanner)
high	`osv/GHSA-9xw5-w5jj-pvcg`	requirements.txt	[email protected] (PyPI) is affected by GHSA-9xw5-w5jj-pvcg	Dependencies (osv-scanner)
high	`osv/GHSA-c35q-ffpf-5qpm`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2023-239, GHSA-c35q-ffpf-5qpm	Dependencies (osv-scanner)
high	`osv/GHSA-cq5v-8q36-5273`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3545, GHSA-cq5v-8q36-5273	Dependencies (osv-scanner)
high	`osv/GHSA-g3cq-j2xw-wf74`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2111, GHSA-g3cq-j2xw-wf74	Dependencies (osv-scanner)
high	`osv/GHSA-hcc4-c3v8-rx92`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2095, GHSA-hcc4-c3v8-rx92	Dependencies (osv-scanner)
high	`osv/GHSA-hg6j-4rv6-33pg`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2105, GHSA-hg6j-4rv6-33pg	Dependencies (osv-scanner)
high	`osv/GHSA-jg22-mg44-37j8`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2104, GHSA-jg22-mg44-37j8	Dependencies (osv-scanner)
high	`osv/GHSA-m5qp-6w8w-w647`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2098, GHSA-m5qp-6w8w-w647	Dependencies (osv-scanner)
high	`osv/GHSA-m6qw-4cw2-hm4m`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2106, GHSA-m6qw-4cw2-hm4m	Dependencies (osv-scanner)
high	`osv/GHSA-p998-jp59-783m`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2097, GHSA-p998-jp59-783m	Dependencies (osv-scanner)
high	`osv/GHSA-xcgm-r5h9-7989`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2108, GHSA-xcgm-r5h9-7989	Dependencies (osv-scanner)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/gui_tests/run.py:490	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/gui_tests/run.py:537	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/gui_tests/run.py:591	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/gui_tests/run.py:603	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/gui_tests/run.py:633	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/gui_tests/run.py:635	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/gui_tests/run.py:642	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/gui_tests/run.py:763	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/gui_tests/run.py:815	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	tools/make_screenshots.py:79	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
medium	`opengrep/python.lang.maintainability.return-not-in-function`	llm_probe/config.py:110	`return` only makes sense inside a function	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:244	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:250	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:256	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:264	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:272	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:274	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:286	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:302	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:310	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:489	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:498	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:519	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:523	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:532	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/deviation.py:541	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	llm_probe/overlap.py:48	Is "is_global" a function or an attribute? If it is a function, you may have meant ipaddress.ip_address(a.split("%")[0]).is_global() because ipaddress.ip_address(a.split("%")[0]).is_global is always true.	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:1198	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:1201	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:1205	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:1207	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:431	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:459	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:462	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:528	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:533	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/prompts.py:539	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	llm_probe/static/endpoints.js:107	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	llm_probe/static/prompts.js:191	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	llm_probe/static/results.js:586	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-alert`	llm_probe/static/results.js:601	found alert() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	llm_probe/static/test.js:356	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	llm_probe/static/test.js:370	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	llm_probe/static/test.js:377	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	llm_probe/static/test.js:437	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	llm_probe/static/test.js:468	found confirm() call; should this be in production code?	Lint
medium	`opengrep/python.lang.best-practice.manual-defaultdict-list-create`	llm_probe/storage.py:269	manually creating a defaultdict - use collections.defaultdict(list)	Lint
medium	`opengrep/python.lang.correctness.common-mistakes.string-concat-in-list`	llm_probe/storage.py:471	Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	tools/gui_tests/run.py:517	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	tools/gui_tests/run.py:814	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.best-practice.unspecified-open-encoding`	tools/make_screenshots.py:78	Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").	Lint
medium	`opengrep/python.lang.security.insecure-hash-algorithm-sha1`	llm_probe/bench.py:150	Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.dynamic-urllib-use-detected`	llm_probe/server.py:1282	Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:114	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:115	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:116	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:116	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:124	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:128	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:132	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:138	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:140	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:149	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:152	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:155	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:156	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:173	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:174	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:191	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:197	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:199	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:200	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:201	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:203	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:204	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:205	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:206	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:208	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:209	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:211	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:214	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:219	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:30	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:35	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:46	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:47	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:48	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:64	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/charts.js:65	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:102	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:103	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:171	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:176	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:177	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:178	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:181	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:183	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:186	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:19	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:209	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:21	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:210	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:22	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:23	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:237	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/compare.js:25	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:192	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:193	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:218	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:219	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:221	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:221	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:223	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:224	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:230	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:236	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:237	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:253	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:262	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:264	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:285	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:288	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:289	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:290	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:301	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:302	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:320	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:332	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/core.js:38	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/endpoints.js:47	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/endpoints.js:48	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/endpoints.js:49	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/endpoints.js:50	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/endpoints.js:51	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/endpoints.js:52	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/endpoints.js:7	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/init.js:11	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:106	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:107	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:119	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:120	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:14	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	llm_probe/static/prompts.js:146	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	llm_probe/static/prompts.js:146	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	llm_probe/static/prompts.js:149	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	llm_probe/static/prompts.js:149	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:45	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:46	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:47	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:48	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:49	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/prompts.js:71	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:112	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:113	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:119	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:122	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:125	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:126	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:127	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:140	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:173	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:176	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:177	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:178	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:179	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:180	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:187	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:19	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:190	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:191	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:194	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:20	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	llm_probe/static/responses.js:34	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:48	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:49	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:90	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/responses.js:91	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:107	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	llm_probe/static/results.js:11	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:114	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:115	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:116	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:122	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:123	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:143	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:144	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:161	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:162	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:163	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:164	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:165	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:166	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:168	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:169	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:170	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:171	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:172	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:173	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:174	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:175	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:176	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:177	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:178	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:179	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:180	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:181	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:182	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:183	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:184	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:185	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:186	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:187	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:224	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:316	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:318	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:327	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:332	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:332	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:333	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:334	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:351	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:353	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:354	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:355	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:362	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:368	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:371	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:371	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:374	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:376	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:377	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:378	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/results.js:391	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:112	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:128	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:129	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:130	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:131	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:132	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:133	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:138	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:140	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:141	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:142	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:148	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:150	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:151	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:154	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:154	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:17	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:218	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:222	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:35	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:37	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:39	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:40	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:43	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:44	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:52	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:53	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:56	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:64	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:72	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:79	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:80	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:81	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:88	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:89	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:90	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:91	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:92	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	llm_probe/static/sessions.js:93	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`osv/GHSA-2vrm-gr82-f7m5`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2096, GHSA-2vrm-gr82-f7m5	Dependencies (osv-scanner)
medium	`osv/GHSA-3wq7-rqq7-wx6j`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2099, GHSA-3wq7-rqq7-wx6j	Dependencies (osv-scanner)
medium	`osv/GHSA-494j-54xm-rwp3`	requirements.txt	[email protected] (PyPI) is affected by GHSA-494j-54xm-rwp3	Dependencies (osv-scanner)
medium	`osv/GHSA-6cjc-53gc-5rqm`	requirements.txt	[email protected] (PyPI) is affected by GHSA-6cjc-53gc-5rqm	Dependencies (osv-scanner)
medium	`osv/GHSA-6jhg-hg63-jvvf`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1100, GHSA-6jhg-hg63-jvvf	Dependencies (osv-scanner)
medium	`osv/GHSA-7gpw-8wmc-pm8g`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1102, GHSA-7gpw-8wmc-pm8g	Dependencies (osv-scanner)
medium	`osv/GHSA-8495-4g3g-x7pr`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1103, GHSA-8495-4g3g-x7pr	Dependencies (osv-scanner)
medium	`osv/GHSA-8qpw-xqxj-h4r2`	requirements.txt	[email protected] (PyPI) is affected by GHSA-8qpw-xqxj-h4r2	Dependencies (osv-scanner)
medium	`osv/GHSA-966j-vmvw-g2g9`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2100, GHSA-966j-vmvw-g2g9	Dependencies (osv-scanner)
medium	`osv/GHSA-c427-h43c-vf67`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2103, GHSA-c427-h43c-vf67	Dependencies (osv-scanner)
medium	`osv/GHSA-cfc2-wr2v-gxm5`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2023-237, GHSA-cfc2-wr2v-gxm5	Dependencies (osv-scanner)
medium	`osv/GHSA-f9xw-jh8m-3mwq`	requirements.txt	[email protected] (PyPI) is affected by GHSA-f9xw-jh8m-3mwq	Dependencies (osv-scanner)
medium	`osv/GHSA-g84x-mcqj-x9qq`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1106, GHSA-g84x-mcqj-x9qq	Dependencies (osv-scanner)
medium	`osv/GHSA-hfmc-7525-mj55`	requirements.txt	[email protected] (PyPI) is affected by GHSA-hfmc-7525-mj55	Dependencies (osv-scanner)
medium	`osv/GHSA-hpj7-wq8m-9hgp`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2109, GHSA-hpj7-wq8m-9hgp	Dependencies (osv-scanner)
medium	`osv/GHSA-jj3x-wxrx-4x23`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1107, GHSA-jj3x-wxrx-4x23	Dependencies (osv-scanner)
medium	`osv/GHSA-mfx4-hv73-q22v`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3546, GHSA-mfx4-hv73-q22v	Dependencies (osv-scanner)
medium	`osv/GHSA-mq44-7p77-q5h7`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3547, GHSA-mq44-7p77-q5h7	Dependencies (osv-scanner)
medium	`osv/GHSA-mwh4-6h8g-pg8w`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2101, GHSA-mwh4-6h8g-pg8w	Dependencies (osv-scanner)
medium	`osv/GHSA-pqxq-w44r-73xw`	requirements.txt	[email protected] (PyPI) is affected by GHSA-pqxq-w44r-73xw	Dependencies (osv-scanner)
medium	`osv/GHSA-qr67-gv47-xwwh`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-3809, GHSA-qr67-gv47-xwwh	Dependencies (osv-scanner)
medium	`osv/GHSA-rw4j-r22c-9gc3`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-4026, GHSA-rw4j-r22c-9gc3	Dependencies (osv-scanner)
medium	`osv/GHSA-w2fm-2cpv-w7v5`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-2094, GHSA-w2fm-2cpv-w7v5	Dependencies (osv-scanner)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:176	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:182	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:182	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:182	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:182	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:362	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:362	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/results.js:362	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/sessions.js:349	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/sessions.js:349	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/sessions.js:349	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	llm_probe/static/sessions.js:349	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`osv/GHSA-54jq-c3m8-4m76`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1097, GHSA-54jq-c3m8-4m76	Dependencies (osv-scanner)
low	`osv/GHSA-69f9-5gxw-wvc2`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1099, GHSA-69f9-5gxw-wvc2	Dependencies (osv-scanner)
low	`osv/GHSA-9548-qrrj-x5pj`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1104, GHSA-9548-qrrj-x5pj	Dependencies (osv-scanner)
low	`osv/GHSA-fh55-r93g-j68g`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1105, GHSA-fh55-r93g-j68g	Dependencies (osv-scanner)
low	`osv/GHSA-gx76-c99x-2c96`	requirements.txt	[email protected] (PyPI) is affected by GHSA-gx76-c99x-2c96	Dependencies (osv-scanner)
low	`osv/GHSA-mqqc-3gqh-h2x8`	requirements.txt	[email protected] (PyPI) is affected by PYSEC-2026-1109, GHSA-mqqc-3gqh-h2x8	Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-4`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	68
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	skipped	`—`	0
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	52
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	300
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`4e172bfd708b`	`prov-5+qual-2+sec-2`	100%	41	58
2026-11-14	`4e172bfd708b`	`prov-4+qual-2+sec-2`	100%	41	58

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/viebvo/llm-probe/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/viebvo/llm-probe/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/viebvo/llm-probe/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/viebvo/llm-probe/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/viebvo/llm-probe/security.svg)](https://repotrust.synapticcyber.com/r/github.com/viebvo/llm-probe/)

Full text report

Repository: https://github.com/viebvo/llm-probe
Commit: 4e172bfd708b1b4659b1f00da36b33f825678102
Generated: 2026-11-14T14:52:08+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Unreviewed AI code risk: a large share of this code is explicitly AI-attributed, and its tests or review process are weak while quality or security scores are low.

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	100	explicit	73%	100%
Code quality	41	poor	90%	100%
Security	58	weak	85%	100%

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

Explicitly attributed share (lower bound): 100.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 100.0%

AI tool	Attributed commits	Lines added
Claude Code	12	14,438

Current source lines last changed by AI-attributed commits: 14,284 of 14,284.

Too few lines in one group to compare finding densities.

Month	Lines added	Attributed to AI
2026-10	13,652	100%
2026-11	786	100%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (4e172bfd708b)
Claude Code: trailer 'Co-Authored-By: Claude' (8c8f47e8be96)
Claude Code: trailer 'Co-Authored-By: Claude' (9487904b1b97)
Claude Code: trailer 'Co-Authored-By: Claude' (7a096d2419b7)
Claude Code: trailer 'Co-Authored-By: Claude' (6aa8703edb7a)
Claude Code: trailer 'Co-Authored-By: Claude' (924b3c3a2e65)
Claude Code: trailer 'Co-Authored-By: Claude' (6e3c91cfdf95)
Claude Code: trailer 'Co-Authored-By: Claude' (7fe927ccac7a)
Claude Code: trailer 'Co-Authored-By: Claude' (17fe3fe396c0)
Claude Code: trailer 'Co-Authored-By: Claude' (72e9c2f18d35)
Claude Code: trailer 'Co-Authored-By: Claude' (20795fab2dcf)
Claude Code: trailer 'Co-Authored-By: Claude' (6328c968278b)
3,870 lines of first-party code in ~1.8h (2,151 lines/hour, 2 commit session) (924b3c3a2e65)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 26% of function code in complex or long functions; 1% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	46
Duplication	93
Code smells (Opengrep)	34
Tests and CI	0
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 1,538; mean complexity 4.0, 90th percentile 9; 67 complex and 3 long functions
Duplicated lines: 1.2% of 12,052 compared
Tests: 0 test lines for 14,284 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 52 known vulnerabilities in 2 dependencies; 79 high-severity SAST findings. Weakest area: sast.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	3
Vulnerable dependencies (OSV)	68
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	40
OpenSSF Scorecard	n/a

Known vulnerabilities: 52 in 2 packages (critical 1, high 22, medium 23, low 6)
Posture checks passed: security policy, lockfiles; missing: dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-63hf-3vf5-4wqf`: [email protected] (PyPI) is affected by PYSEC-2026-2102, GHSA-63hf-3vf5-4wqf	requirements.txt
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	llm_probe/sandbox.py:193
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/compare.js:20
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/compare.js:20
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/compare.js:102
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `bar.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/compare.js:102
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/compare.js:126
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `$("cmp-out").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/compare.js:126
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/core.js:192
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `sel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/core.js:192
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/core.js:198
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `plainEl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/core.js:198
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/endpoints.js:6
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `$("home-ep").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/endpoints.js:6
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/endpoints.js:9
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `$("home-runs").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/endpoints.js:9
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/endpoints.js:46
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tb.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/endpoints.js:46
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/init.js:7
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `document.querySelector("main").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/init.js:7
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/prompts.js:14
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `$("pr-promptset").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/prompts.js:14
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/prompts.js:44
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tb.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/prompts.js:44
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	llm_probe/static/prompts.js:69

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v0.20.0 ships llm-probe-0.20.0.zip (2 downloads)
binary-release-asset: release v0.19.0 ships llm-probe-0.19.0.zip (1 downloads)
binary-release-asset: release v0.18.0 ships llm-probe-0.18.0.zip (2 downloads)
binary-release-asset: release v0.17.2 ships llm-probe-0.17.2.zip (1 downloads)
readme-download-lure: gives an archive password

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 14,284; test lines: 0

Language	Lines
Python	10,491
JavaScript	3,755
Shell	38