{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:04:31.309862Z","repo":{"ref":{"host":"github.com","owner":"CoderLuii","name":"HolyClaude"},"default_branch":"master","clone_url":"https://github.com/CoderLuii/HolyClaude.git","html_url":"https://github.com/CoderLuii/HolyClaude","description":"AI coding workstation: Claude Code + web UI + 8 AI CLIs + headless browser + 50+ tools","stars":2659,"forks":276,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":54339,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-03-22T01:03:18Z","pushed_at":"2026-11-08T09:52:38Z","security_policy_url":"https://github.com/CoderLuii/HolyClaude/security/policy","distribution":{"owner_created_at":"2025-03-19T08:00:38Z","owner_type":"User","release_assets":[]}},"commit_sha":"c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908","profile":{"lines_by_language":{"JavaScript":22664,"Shell":6189,"Python":1805},"files_by_category":{"test":103,"config":35,"source":31,"docs":27,"other":17,"vendored":7,"binary":2,"oversized":1},"source_lines":9027,"test_lines":21631},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.56,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.37,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":6.0,"flagged_releases":0.0},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":69.0,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":32.8,"duplication":78.9,"lint":61.6,"testing":90.0,"docs":100.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 2.40, CI runs tests; 37% of function code in complex or long functions; 4% duplicated lines. Weakest area: complexity."},"security":{"score":82.7,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":96.7,"sast":63.0,"dependencies":null,"ci_actions":87.5,"posture":80.0,"scorecard":null},"summary":"Security posture is adequate: 1 high-severity SAST findings. Weakest area: sast."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":62.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":38387.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-03":{"loc":360,"attributed_loc":0},"2026-04":{"loc":0,"attributed_loc":0},"2026-05":{"loc":446,"attributed_loc":0},"2026-06":{"loc":2106,"attributed_loc":0},"2026-07":{"loc":10379,"attributed_loc":0},"2026-08":{"loc":1801,"attributed_loc":0},"2026-09":{"loc":15563,"attributed_loc":0},"2026-10":{"loc":6072,"attributed_loc":0},"2026-11":{"loc":1660,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":43.0,"flagged_units":6.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":29807.0,"flagged_loc":14203.0,"flagged_loc_share":0.47649880900459624,"max_loc_per_hour":746.5,"median_loc_per_hour":117.75,"pr_timed_units":0.0,"excluded_import_loc":8580.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,986 lines of first-party code in ~4.0h (746 lines/hour, 1 commit session)","ref":"60972094fa121136743f39f6997324fe4a85a156","url":"https://github.com/CoderLuii/HolyClaude/commit/60972094fa121136743f39f6997324fe4a85a156","weight":0.22395},{"kind":"velocity-burst","description":"2,425 lines of first-party code in ~4.0h (606 lines/hour, 1 commit session)","ref":"933682705791de71afb481bfbe161697197ed792","url":"https://github.com/CoderLuii/HolyClaude/commit/933682705791de71afb481bfbe161697197ed792","weight":0.18187499999999998},{"kind":"velocity-burst","description":"2,326 lines of first-party code in ~4.0h (582 lines/hour, 1 commit session)","ref":"e10b9ff220716f934f826bc2e58f12b08f65a4ad","url":"https://github.com/CoderLuii/HolyClaude/commit/e10b9ff220716f934f826bc2e58f12b08f65a4ad","weight":0.17445},{"kind":"velocity-burst","description":"2,218 lines of first-party code in ~4.0h (554 lines/hour, 1 commit session)","ref":"183f2a913c7618e652aa23f2ba40d1f9e3b04f92","url":"https://github.com/CoderLuii/HolyClaude/commit/183f2a913c7618e652aa23f2ba40d1f9e3b04f92","weight":0.16635},{"kind":"velocity-burst","description":"2,198 lines of first-party code in ~4.0h (550 lines/hour, 1 commit session)","ref":"4c1bd9a109e22a88d577bbcd13ca4ec7f0d38156","url":"https://github.com/CoderLuii/HolyClaude/commit/4c1bd9a109e22a88d577bbcd13ca4ec7f0d38156","weight":0.16485},{"kind":"velocity-burst","description":"2,050 lines of first-party code in ~4.0h (512 lines/hour, 1 commit session)","ref":"20e9e10681aec9b091bb54da8755f8a1c59f69bb","url":"https://github.com/CoderLuii/HolyClaude/commit/20e9e10681aec9b091bb54da8755f8a1c59f69bb","weight":0.15374999999999997}],"data":{"flagged_loc_by_commit":{"4c1bd9a109e22a88d577bbcd13ca4ec7f0d38156":2198,"60972094fa121136743f39f6997324fe4a85a156":2986,"933682705791de71afb481bfbe161697197ed792":2425,"183f2a913c7618e652aa23f2ba40d1f9e3b04f92":2218,"20e9e10681aec9b091bb54da8755f8a1c59f69bb":2050,"e10b9ff220716f934f826bc2e58f12b08f65a4ad":2326},"excluded_import_commits":["651c48fc01a963acd605aa565bb9da8f9db9b340"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":58.0,"flagged_releases":0.0,"max_loc_per_day":6380.8},"findings":[],"evidence":[],"data":{"releases":[{"from":"v1.0.0","to":"v1.1.0","loc":57,"days":4.1,"loc_per_day":13.9,"flagged":false},{"from":"v1.1.0","to":"v1.1.1","loc":14,"days":0.83,"loc_per_day":16.8,"flagged":false},{"from":"v1.1.1","to":"v1.1.2","loc":2,"days":0.16,"loc_per_day":12.3,"flagged":false},{"from":"v1.1.2","to":"v1.1.3","loc":0,"days":1.01,"loc_per_day":0.0,"flagged":false},{"from":"v1.1.3","to":"v1.1.4","loc":0,"days":0.54,"loc_per_day":0.0,"flagged":false},{"from":"v1.1.4","to":"v1.1.5","loc":0,"days":0.15,"loc_per_day":0.0,"flagged":false},{"from":"v1.1.5","to":"v1.1.6","loc":0,"days":0.1,"loc_per_day":0.0,"flagged":false},{"from":"v1.1.6","to":"v1.1.7","loc":124,"days":0.21,"loc_per_day":594.6,"flagged":false},{"from":"v1.1.7","to":"v1.1.8","loc":0,"days":6.19,"loc_per_day":0.0,"flagged":false},{"from":"v1.1.8","to":"v1.1.9","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.1.9","to":"v1.2.0","loc":0,"days":5.26,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.0","to":"v1.2.1","loc":0,"days":0.73,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.1","to":"v1.2.2","loc":0,"days":0.09,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.2","to":"v1.2.3","loc":0,"days":46.8,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.3","to":"v1.2.4","loc":19,"days":0.57,"loc_per_day":33.3,"flagged":false},{"from":"v1.2.4","to":"v1.2.5","loc":219,"days":0.08,"loc_per_day":2645.6,"flagged":false},{"from":"v1.2.5","to":"v1.2.6","loc":208,"days":0.31,"loc_per_day":667.9,"flagged":false},{"from":"v1.2.6","to":"v1.2.7","loc":167,"days":16.05,"loc_per_day":10.4,"flagged":false},{"from":"v1.2.7","to":"v1.2.8","loc":183,"days":1.7,"loc_per_day":107.9,"flagged":false},{"from":"v1.2.8","to":"v1.2.9","loc":0,"days":0.13,"loc_per_day":0.0,"flagged":false},{"from":"v1.2.9","to":"v1.3.0","loc":66,"days":0.11,"loc_per_day":618.8,"flagged":false},{"from":"v1.3.0","to":"v1.3.1","loc":66,"days":0.11,"loc_per_day":589.8,"flagged":false},{"from":"v1.3.1","to":"v1.3.2","loc":0,"days":0.4,"loc_per_day":0.0,"flagged":false},{"from":"v1.3.2","to":"v1.3.3","loc":195,"days":0.1,"loc_per_day":1945.3,"flagged":false},{"from":"v1.3.3","to":"v1.3.4","loc":285,"days":2.1,"loc_per_day":135.5,"flagged":false},{"from":"v1.3.4","to":"v1.3.5","loc":271,"days":0.14,"loc_per_day":2000.0,"flagged":false},{"from":"v1.3.5","to":"v1.3.6","loc":873,"days":0.14,"loc_per_day":6380.8,"flagged":false},{"from":"v1.3.6","to":"v1.3.7","loc":0,"days":0.32,"loc_per_day":0.0,"flagged":false},{"from":"v1.3.7","to":"v1.4.0","loc":0,"days":14.33,"loc_per_day":0.0,"flagged":false},{"from":"v1.4.0","to":"v1.4.1","loc":129,"days":0.2,"loc_per_day":648.3,"flagged":false},{"from":"v1.4.1","to":"v1.4.2","loc":431,"days":0.19,"loc_per_day":2252.1,"flagged":false},{"from":"v1.4.2","to":"v1.4.3","loc":343,"days":0.38,"loc_per_day":911.7,"flagged":false},{"from":"v1.4.3","to":"v1.4.4","loc":114,"days":3.34,"loc_per_day":34.1,"flagged":false},{"from":"v1.4.4","to":"v1.4.5","loc":0,"days":2.32,"loc_per_day":0.0,"flagged":false},{"from":"v1.4.5","to":"v1.4.6","loc":479,"days":0.08,"loc_per_day":5984.9,"flagged":false},{"from":"v1.4.6","to":"v1.4.7","loc":542,"days":0.09,"loc_per_day":6294.2,"flagged":false},{"from":"v1.4.7","to":"v1.4.8","loc":747,"days":1.85,"loc_per_day":404.0,"flagged":false},{"from":"v1.4.8","to":"v1.4.9","loc":17,"days":1.96,"loc_per_day":8.7,"flagged":false},{"from":"v1.4.9","to":"v1.5.0","loc":917,"days":2.61,"loc_per_day":350.8,"flagged":false},{"from":"v1.5.0","to":"v1.5.1","loc":2198,"days":6.02,"loc_per_day":365.2,"flagged":false},{"from":"v1.5.1","to":"v1.5.2","loc":685,"days":0.39,"loc_per_day":1739.5,"flagged":false},{"from":"v1.5.2","to":"v1.5.3","loc":320,"days":1.13,"loc_per_day":284.4,"flagged":false},{"from":"v1.5.3","to":"v1.5.4","loc":471,"days":6.89,"loc_per_day":68.3,"flagged":false},{"from":"v1.5.4","to":"v1.5.5","loc":2986,"days":3.13,"loc_per_day":952.7,"flagged":false},{"from":"v1.5.5","to":"v1.5.6","loc":27,"days":0.21,"loc_per_day":128.8,"flagged":false},{"from":"v1.5.6","to":"v1.5.7","loc":1774,"days":10.24,"loc_per_day":173.3,"flagged":false},{"from":"v1.5.7","to":"v1.5.8","loc":2425,"days":20.57,"loc_per_day":117.9,"flagged":false},{"from":"v1.5.8","to":"v1.5.9","loc":170,"days":0.32,"loc_per_day":523.9,"flagged":false},{"from":"v1.5.9","to":"v1.6.0","loc":0,"days":8.62,"loc_per_day":0.0,"flagged":false},{"from":"v1.6.0","to":"v1.6.1","loc":2218,"days":3.77,"loc_per_day":587.8,"flagged":false},{"from":"v1.6.1","to":"v1.6.2","loc":1749,"days":3.69,"loc_per_day":474.3,"flagged":false},{"from":"v1.6.2","to":"v1.6.3","loc":421,"days":6.08,"loc_per_day":69.3,"flagged":false},{"from":"v1.6.3","to":"v1.6.4","loc":2050,"days":7.34,"loc_per_day":279.3,"flagged":false},{"from":"v1.6.4","to":"v1.6.5","loc":2326,"days":4.07,"loc_per_day":571.4,"flagged":false},{"from":"v1.6.5","to":"v1.6.6","loc":416,"days":4.39,"loc_per_day":94.8,"flagged":false},{"from":"v1.6.6","to":"v1.6.7","loc":699,"days":4.5,"loc_per_day":155.4,"flagged":false},{"from":"v1.6.7","to":"v1.6.8","loc":581,"days":11.18,"loc_per_day":52.0,"flagged":false},{"from":"v1.6.8","to":"v1.6.9","loc":1660,"days":10.9,"loc_per_day":152.2,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":9027.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/curl-auth-user","severity":"low","message":"Possible curl-auth-user secret in the current tree (test/docs/example file)","path":"tests/docker_startup_symlink_smoke.sh","line":90,"fingerprint":"tests/docker_startup_symlink_smoke.sh:curl-auth-user:90"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":40.0,"findings_high":1.0,"findings_medium":39.0,"findings_low":0.0,"weighted_findings":11.9,"scanned_lines":9027.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/dockerfile.security.last-user-is-root","severity":"high","message":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'. [confidence medium]","path":"Dockerfile","line":531,"fingerprint":"dockerfile.security.last-user-is-root:Dockerfile:531"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"scripts/evaluate-security-report.mjs","line":392,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/evaluate-security-report.mjs:392"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"scripts/evaluate-security-report.mjs","line":401,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/evaluate-security-report.mjs:401"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `review` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"scripts/evaluate-security-report.mjs","line":496,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/evaluate-security-report.mjs:496"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `key` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"scripts/evaluate-upstream-dependency-report.mjs","line":259,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/evaluate-upstream-dependency-report.mjs:259"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-apprise-notifications.mjs","line":106,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-apprise-notifications.mjs:106"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-apprise-notifications.mjs","line":118,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-apprise-notifications.mjs:118"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-apprise-notifications.mjs","line":183,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-apprise-notifications.mjs:183"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":239,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-base-path.mjs:239"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":247,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-base-path.mjs:247"},{"rule_id":"opengrep/javascript.lang.security.audit.unknown-value-with-script-tag","severity":"medium","message":"Cannot determine what 'source' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'source' is not externally controlled, or sanitize this data. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":294,"fingerprint":"javascript.lang.security.audit.unknown-value-with-script-tag:scripts/patch-cloudcli-base-path.mjs:294"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":348,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/patch-cloudcli-base-path.mjs:348"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":349,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/patch-cloudcli-base-path.mjs:349"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":350,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/patch-cloudcli-base-path.mjs:350"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":351,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/patch-cloudcli-base-path.mjs:351"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `packageRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":353,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-base-path.mjs:353"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `packageRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":353,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-base-path.mjs:353"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `packageRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":353,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-base-path.mjs:353"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `packageRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":353,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-base-path.mjs:353"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `packageRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":360,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-base-path.mjs:360"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `packageRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":361,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-base-path.mjs:361"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":371,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/patch-cloudcli-base-path.mjs:371"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":371,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/patch-cloudcli-base-path.mjs:371"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":375,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/patch-cloudcli-base-path.mjs:375"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/patch-cloudcli-base-path.mjs","line":375,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/patch-cloudcli-base-path.mjs:375"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-codex-complete-exit-code.mjs","line":20,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-codex-complete-exit-code.mjs:20"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-codex-complete-exit-code.mjs","line":31,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-codex-complete-exit-code.mjs:31"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-codex-complete-exit-code.mjs","line":53,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-codex-complete-exit-code.mjs:53"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-codex-permissions.mjs","line":65,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-codex-permissions.mjs:65"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-codex-permissions.mjs","line":130,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-codex-permissions.mjs:130"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-codex-permissions.mjs","line":171,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-codex-permissions.mjs:171"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `target` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-disable-self-update.mjs","line":30,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-disable-self-update.mjs:30"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-disable-self-update.mjs","line":39,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-disable-self-update.mjs:39"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-disable-self-update.mjs","line":48,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-disable-self-update.mjs:48"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":68,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-web-terminal-rendering.mjs:68"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":76,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/patch-cloudcli-web-terminal-rendering.mjs:76"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"scripts/secure-cli-persistence.py","line":162,"fingerprint":"python.lang.security.audit.insecure-file-permissions:scripts/secure-cli-persistence.py:162"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `schema` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"scripts/verify-product-facts.mjs","line":84,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/verify-product-facts.mjs:84"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `facts` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"scripts/verify-product-facts.mjs","line":294,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/verify-product-facts.mjs:294"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `facts` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"scripts/verify-product-facts.mjs","line":296,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/verify-product-facts.mjs:296"}],"evidence":[],"data":{"rulesets":["javascript","bash","python","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":18.0,"findings_high":0.0,"findings_medium":2.0,"findings_low":16.0,"penalty":8.0},"findings":[{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":3,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:3"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":8,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:8"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":113,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:113"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":128,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:128"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":401,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:401"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":402,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:402"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":424,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:424"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":425,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:425"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":673,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:673"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":673,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:673"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":714,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:714"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":724,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:724"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":724,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:724"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":731,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:731"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":732,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:732"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":1183,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:1183"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":1775,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:1775"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/docker-publish.yml","line":1775,"fingerprint":"template-injection:.github/workflows/docker-publish.yml:1775"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":1.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: .github/SECURITY.md","ref":".github/SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"Dependency updates: .github/dependabot.yml","ref":".github/dependabot.yml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":502.0,"function_nloc":5740.0,"mean_ccn":4.94,"p90_ccn":11.0,"complex_functions":32.0,"long_functions":5.0,"many_param_functions":1.0,"risky_nloc_share":0.3714},"findings":[],"evidence":[{"kind":"complex-function","description":"validateLocalReleaseEvidence in scripts/verify-local-release-evidence.mjs: complexity 78, 71 lines","ref":"scripts/verify-local-release-evidence.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/verify-local-release-evidence.mjs#L122","weight":1.0},{"kind":"complex-function","description":"validateLocalDockerIsolation in scripts/verify-local-docker-isolation.mjs: complexity 56, 31 lines","ref":"scripts/verify-local-docker-isolation.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/verify-local-docker-isolation.mjs#L79","weight":0.9333333333333333},{"kind":"complex-function","description":"validateAuthorityEvidence in scripts/evaluate-security-report.mjs: complexity 51, 128 lines","ref":"scripts/evaluate-security-report.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/evaluate-security-report.mjs#L663","weight":0.85},{"kind":"complex-function","description":"validateReview in scripts/evaluate-security-report.mjs: complexity 47, 84 lines","ref":"scripts/evaluate-security-report.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/evaluate-security-report.mjs#L577","weight":0.7833333333333333},{"kind":"complex-function","description":"validateSyftEvidence in scripts/evaluate-upstream-dependency-report.mjs: complexity 46, 59 lines","ref":"scripts/evaluate-upstream-dependency-report.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/evaluate-upstream-dependency-report.mjs#L391","weight":0.7666666666666667},{"kind":"complex-function","description":"verifyProductSources in scripts/verify-product-facts.mjs: complexity 44, 161 lines","ref":"scripts/verify-product-facts.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/verify-product-facts.mjs#L280","weight":0.7333333333333333},{"kind":"complex-function","description":"validatePolicy in scripts/evaluate-upstream-dependency-report.mjs: complexity 41, 73 lines","ref":"scripts/evaluate-upstream-dependency-report.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/evaluate-upstream-dependency-report.mjs#L89","weight":0.6833333333333333},{"kind":"complex-function","description":"validateDocument in scripts/verify-immutable-inputs.mjs: complexity 40, 118 lines","ref":"scripts/verify-immutable-inputs.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/verify-immutable-inputs.mjs#L316","weight":0.6666666666666666},{"kind":"complex-function","description":"validateSchema in scripts/verify-product-facts.mjs: complexity 40, 75 lines","ref":"scripts/verify-product-facts.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/verify-product-facts.mjs#L29","weight":0.6666666666666666},{"kind":"complex-function","description":"validateProof in scripts/verify-local-docker-isolation.mjs: complexity 33, 22 lines","ref":"scripts/verify-local-docker-isolation.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/verify-local-docker-isolation.mjs#L56","weight":0.55}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":6663.0,"duplicated_lines":263.0,"duplicated_share":0.0395,"files":31.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/bind-security-authority-report.mjs:1 and scripts/preflight-security-policy.mjs:1","ref":"scripts/bind-security-authority-report.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/bind-security-authority-report.mjs#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/bind-security-authority-report.mjs:7 and scripts/evaluate-release-security-deferral.mjs:62","ref":"scripts/bind-security-authority-report.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/bind-security-authority-report.mjs#L7","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/bootstrap.sh:15 and scripts/entrypoint.sh:12","ref":"scripts/bootstrap.sh","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/bootstrap.sh#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/evaluate-release-security-deferral.mjs:28 and scripts/evaluate-release-security-deferral.mjs:39","ref":"scripts/evaluate-release-security-deferral.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/evaluate-release-security-deferral.mjs#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/evaluate-security-report.mjs:103 and scripts/evaluate-upstream-dependency-report.mjs:31","ref":"scripts/evaluate-security-report.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/evaluate-security-report.mjs#L103","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/evaluate-security-report.mjs:104 and scripts/verify-immutable-inputs.mjs:22","ref":"scripts/evaluate-security-report.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/evaluate-security-report.mjs#L104","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/evaluate-security-report.mjs:1093 and scripts/evaluate-security-report.mjs:1143","ref":"scripts/evaluate-security-report.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/evaluate-security-report.mjs#L1093","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/patch-cloudcli-apprise-notifications.mjs:187 and scripts/patch-cloudcli-codex-complete-exit-code.mjs:57","ref":"scripts/patch-cloudcli-apprise-notifications.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/patch-cloudcli-apprise-notifications.mjs#L187","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/patch-cloudcli-base-path.mjs:14 and scripts/patch-cloudcli-base-path.mjs:196","ref":"scripts/patch-cloudcli-base-path.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/patch-cloudcli-base-path.mjs#L14","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/patch-cloudcli-base-path.mjs:248 and scripts/patch-cloudcli-web-terminal-rendering.mjs:77","ref":"scripts/patch-cloudcli-base-path.mjs","url":"https://github.com/CoderLuii/HolyClaude/blob/c87a6587d7ccdadd04a7b1c1d2dd1215c1d4e908/scripts/patch-cloudcli-base-path.mjs#L248","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":49.0,"weighted_findings":17.5,"scanned_lines":9027.0,"category:correctness":49.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/build-cloudcli-account-management-artifact.mjs","line":280,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/build-cloudcli-account-management-artifact.mjs:280"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/evaluate-security-report.mjs","line":764,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/evaluate-security-report.mjs:764"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/verify-cloudcli-account-management-lock.mjs","line":74,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/verify-cloudcli-account-management-lock.mjs:74"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/verify-cloudcli-account-management-lock.mjs","line":74,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/verify-cloudcli-account-management-lock.mjs:74"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/verify-local-release-evidence.mjs","line":46,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/verify-local-release-evidence.mjs:46"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/verify-product-facts.mjs","line":18,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/verify-product-facts.mjs:18"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/verify-product-facts.mjs","line":18,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/verify-product-facts.mjs:18"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-cloudcli-account-management-artifact.mjs","line":150,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-cloudcli-account-management-artifact.mjs:150"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-cloudcli-account-management-artifact.mjs","line":150,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-cloudcli-account-management-artifact.mjs:150"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-cloudcli-account-management-artifact.mjs","line":574,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-cloudcli-account-management-artifact.mjs:574"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-cloudcli-account-management-artifact.mjs","line":574,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-cloudcli-account-management-artifact.mjs:574"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-apprise-notifications.mjs","line":19,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-apprise-notifications.mjs:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-apprise-notifications.mjs","line":19,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-apprise-notifications.mjs:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-apprise-notifications.mjs","line":73,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-apprise-notifications.mjs:73"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-apprise-notifications.mjs","line":73,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-apprise-notifications.mjs:73"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-apprise-notifications.mjs","line":83,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-apprise-notifications.mjs:83"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-apprise-notifications.mjs","line":83,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-apprise-notifications.mjs:83"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":9,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:9"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":9,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:9"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":194,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:194"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":194,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:194"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":300,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:300"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":300,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:300"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":301,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:301"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":301,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:301"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":334,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:334"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":334,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:334"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":335,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:335"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":340,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:340"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-base-path.mjs","line":340,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-base-path.mjs:340"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-codex-permissions.mjs","line":25,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-codex-permissions.mjs:25"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-codex-permissions.mjs","line":40,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-codex-permissions.mjs:40"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-disable-self-update.mjs","line":262,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-disable-self-update.mjs:262"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-disable-self-update.mjs","line":262,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-disable-self-update.mjs:262"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-disable-self-update.mjs","line":309,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-disable-self-update.mjs:309"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-disable-self-update.mjs","line":309,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-disable-self-update.mjs:309"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":12,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:12"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":12,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:12"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":39,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:39"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":39,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:39"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":41,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:41"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":41,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:41"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":48,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:48"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":48,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:48"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":53,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:53"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/patch-cloudcli-web-terminal-rendering.mjs","line":53,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/patch-cloudcli-web-terminal-rendering.mjs:53"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":21631.0,"source_lines":9027.0,"test_ratio":2.3963,"ci_files":2.0,"cochange_share":0.7143,"cochange_commits":42.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/docker-publish.yml","ref":".github/workflows/docker-publish.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/source-security.yml","ref":".github/workflows/source-security.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (unittest)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["unittest"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":1095.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"docs/CHANGELOG.md","ref":"docs/CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}