{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:28:28.824609Z","repo":{"ref":{"host":"github.com","owner":"RailsApps","name":"rails-composer"},"default_branch":"master","clone_url":"https://github.com/RailsApps/rails-composer.git","html_url":"https://github.com/RailsApps/rails-composer","description":"Rails Composer. The Rails generator on steroids for starter apps.","stars":3360,"forks":474,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":760,"primary_language":"Ruby","license_spdx":null,"created_at":"2012-07-24T18:43:01Z","pushed_at":"2019-05-30T19:00:30Z","security_policy_url":null,"distribution":{"owner_created_at":"2011-05-14T19:04:15Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"5a9985f6ddae1cc9475568c2d1f6a7ae28c005a7","profile":{"lines_by_language":{"Ruby":6133,"Shell":12},"files_by_category":{"other":28,"config":6,"docs":6,"source":6,"binary":1},"source_lines":6145,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":46.6,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":100.0,"duplication":7.3,"lint":97.0,"testing":0.0,"docs":40.0,"type_safety":null,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 44% duplicated lines. Weakest area: testing."},"security":{"score":63.7,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":50.1,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 1 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":320.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":12107.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2012-07":{"loc":1320,"attributed_loc":0},"2012-08":{"loc":1107,"attributed_loc":0},"2012-09":{"loc":27,"attributed_loc":0},"2012-10":{"loc":402,"attributed_loc":0},"2012-11":{"loc":67,"attributed_loc":0},"2012-12":{"loc":558,"attributed_loc":0},"2013-01":{"loc":29,"attributed_loc":0},"2013-02":{"loc":130,"attributed_loc":0},"2013-03":{"loc":45,"attributed_loc":0},"2013-04":{"loc":18,"attributed_loc":0},"2013-05":{"loc":1,"attributed_loc":0},"2013-06":{"loc":417,"attributed_loc":0},"2013-07":{"loc":220,"attributed_loc":0},"2013-08":{"loc":64,"attributed_loc":0},"2013-09":{"loc":31,"attributed_loc":0},"2013-11":{"loc":102,"attributed_loc":0},"2013-12":{"loc":16,"attributed_loc":0},"2014-01":{"loc":156,"attributed_loc":0},"2014-02":{"loc":518,"attributed_loc":0},"2014-03":{"loc":25,"attributed_loc":0},"2014-04":{"loc":432,"attributed_loc":0},"2014-05":{"loc":4383,"attributed_loc":0},"2014-06":{"loc":337,"attributed_loc":0},"2014-07":{"loc":329,"attributed_loc":0},"2014-08":{"loc":67,"attributed_loc":0},"2014-09":{"loc":244,"attributed_loc":0},"2014-10":{"loc":45,"attributed_loc":0},"2014-11":{"loc":110,"attributed_loc":0},"2014-12":{"loc":30,"attributed_loc":0},"2015-02":{"loc":151,"attributed_loc":0},"2015-04":{"loc":159,"attributed_loc":0},"2015-05":{"loc":46,"attributed_loc":0},"2015-06":{"loc":2,"attributed_loc":0},"2015-08":{"loc":0,"attributed_loc":0},"2015-09":{"loc":0,"attributed_loc":0},"2015-10":{"loc":114,"attributed_loc":0},"2015-11":{"loc":46,"attributed_loc":0},"2015-12":{"loc":28,"attributed_loc":0},"2016-01":{"loc":2,"attributed_loc":0},"2016-02":{"loc":22,"attributed_loc":0},"2016-05":{"loc":4,"attributed_loc":0},"2016-08":{"loc":4,"attributed_loc":0},"2016-09":{"loc":21,"attributed_loc":0},"2016-10":{"loc":43,"attributed_loc":0},"2016-11":{"loc":5,"attributed_loc":0},"2017-01":{"loc":1,"attributed_loc":0},"2017-04":{"loc":3,"attributed_loc":0},"2017-05":{"loc":60,"attributed_loc":0},"2017-11":{"loc":2,"attributed_loc":0},"2018-01":{"loc":2,"attributed_loc":0},"2018-02":{"loc":17,"attributed_loc":0},"2018-05":{"loc":98,"attributed_loc":0},"2018-09":{"loc":47,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":188.0,"flagged_units":0.0,"pre_ai_era_bursts":1.0,"pre_ai_era_measured_loc":12107.0,"pre_ai_era_burst_loc":3198.0,"measured_loc":12107.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":799.5,"median_loc_per_hour":45.5,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":6145.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":27.0,"findings_high":1.0,"findings_medium":26.0,"findings_low":0.0,"weighted_findings":12.15,"scanned_lines":6145.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/ruby.lang.security.missing-csrf-protection","severity":"high","message":"Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class. [confidence low]","path":"files/app/controllers/application_controller-omniauth.rb","line":1,"fingerprint":"ruby.lang.security.missing-csrf-protection:files/app/controllers/application_controller-omniauth.rb:1"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"composer-Rails3_2.rb","line":209,"fingerprint":"ruby.lang.security.dangerous-open:composer-Rails3_2.rb:209"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"composer-Rails3_2.rb","line":214,"fingerprint":"ruby.lang.security.dangerous-open:composer-Rails3_2.rb:214"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"composer-Rails3_2.rb","line":226,"fingerprint":"ruby.lang.security.dangerous-open:composer-Rails3_2.rb:226"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer-Rails3_2.rb","line":2348,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer-Rails3_2.rb:2348"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer-Rails3_2.rb","line":2351,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer-Rails3_2.rb:2351"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer-Rails3_2.rb","line":2354,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer-Rails3_2.rb:2354"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer-Rails3_2.rb","line":2358,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer-Rails3_2.rb:2358"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer-Rails3_2.rb","line":2359,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer-Rails3_2.rb:2359"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer-Rails3_2.rb","line":2362,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer-Rails3_2.rb:2362"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer-Rails3_2.rb","line":2365,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer-Rails3_2.rb:2365"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"composer.rb","line":208,"fingerprint":"ruby.lang.security.dangerous-open:composer.rb:208"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"composer.rb","line":213,"fingerprint":"ruby.lang.security.dangerous-open:composer.rb:213"},{"rule_id":"opengrep/ruby.lang.security.dangerous-open","severity":"medium","message":"Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"composer.rb","line":225,"fingerprint":"ruby.lang.security.dangerous-open:composer.rb:225"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer.rb","line":2400,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer.rb:2400"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer.rb","line":2403,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer.rb:2403"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer.rb","line":2406,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer.rb:2406"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer.rb","line":2410,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer.rb:2410"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer.rb","line":2411,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer.rb:2411"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-secrets","severity":"medium","message":"Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium]","path":"composer.rb","line":2414,"fingerprint":"ruby.rails.security.brakeman.check-secrets:composer.rb:2414"},{"rule_id":"opengrep/ruby.rails.security.brakeman.check-unscoped-find","severity":"medium","message":"Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium]","path":"files/app/controllers/application_controller-omniauth.rb","line":21,"fingerprint":"ruby.rails.security.brakeman.check-unscoped-find:files/app/controllers/application_controller-omniauth.rb:21"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-content-tag","severity":"medium","message":"'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external d [confidence low]","path":"files/app/helpers/application_helper-simple_form.rb","line":5,"fingerprint":"ruby.rails.security.audit.xss.avoid-content-tag:files/app/helpers/application_helper-simple_form.rb:5"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.avoid-html-safe","severity":"medium","message":"'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low]","path":"files/app/helpers/application_helper-simple_form.rb","line":12,"fingerprint":"ruby.rails.security.audit.xss.avoid-html-safe:files/app/helpers/application_helper-simple_form.rb:12"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute","severity":"medium","message":"Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: \"<%= expr %>\". [confidence low]","path":"files/app/views/layouts/_messages-bootstrap.html.erb","line":3,"fingerprint":"ruby.rails.security.audit.xss.templates.unquoted-attribute:files/app/views/layouts/_messages-bootstrap.html.erb:3"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-content-tag","severity":"medium","message":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it i [confidence low]","path":"files/app/views/layouts/_messages-bootstrap.html.erb","line":5,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-content-tag:files/app/views/layouts/_messages-bootstrap.html.erb:5"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.avoid-content-tag","severity":"medium","message":"'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it i [confidence low]","path":"files/app/views/layouts/_messages.html.erb","line":3,"fingerprint":"ruby.rails.security.audit.xss.templates.avoid-content-tag:files/app/views/layouts/_messages.html.erb:3"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to","severity":"medium","message":"Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low]","path":"files/app/views/users/show-subdomains_app.html.erb","line":3,"fingerprint":"ruby.rails.security.audit.xss.templates.dangerous-link-to:files/app/views/users/show-subdomains_app.html.erb:3"}],"evidence":[],"data":{"rulesets":["ruby","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.textile","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":71.0,"function_nloc":365.0,"mean_ccn":2.1,"p90_ccn":4.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":4908.0,"duplicated_lines":2137.0,"duplicated_share":0.4354,"files":6.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: composer-Rails3_2.rb:1 and composer.rb:1","ref":"composer-Rails3_2.rb","url":"https://github.com/RailsApps/rails-composer/blob/5a9985f6ddae1cc9475568c2d1f6a7ae28c005a7/composer-Rails3_2.rb#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: composer-Rails3_2.rb:405 and composer-Rails3_2.rb:423","ref":"composer-Rails3_2.rb","url":"https://github.com/RailsApps/rails-composer/blob/5a9985f6ddae1cc9475568c2d1f6a7ae28c005a7/composer-Rails3_2.rb#L405","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: composer.rb:365 and composer.rb:397","ref":"composer.rb","url":"https://github.com/RailsApps/rails-composer/blob/5a9985f6ddae1cc9475568c2d1f6a7ae28c005a7/composer.rb#L365","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":3.0,"weighted_findings":0.75,"scanned_lines":6145.0,"category:correctness":3.0},"findings":[{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"railsComposer.sh","line":8,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:railsComposer.sh:8"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"railsComposer.sh","line":9,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:railsComposer.sh:9"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"railsComposer.sh","line":10,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:railsComposer.sh:10"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":6145.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":195.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":342.0},"findings":[],"evidence":[{"kind":"docs","description":"README.textile","ref":"README.textile","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}