{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:38:47.041479Z","repo":{"ref":{"host":"github.com","owner":"alibaba","name":"GGEditor"},"default_branch":"master","clone_url":"https://github.com/alibaba/GGEditor.git","html_url":"https://github.com/alibaba/GGEditor","description":"A visual graph editor based on G6 and React","stars":3402,"forks":561,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":13834,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2018-08-24T05:50:30Z","pushed_at":"2020-09-10T10:08:53Z","security_policy_url":null,"distribution":{"owner_created_at":"2012-07-12T08:40:35Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"68e4cb609a15428d93467564a31ea443e4da35c7","profile":{"lines_by_language":{"TypeScript":5600,"JavaScript":200},"files_by_category":{"source":76,"docs":32,"other":12,"config":10},"source_lines":5800,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":46.1,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":89.6,"duplication":37.2,"lint":55.9,"testing":15.0,"docs":85.0,"type_safety":40.0,"process":0.0},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 4% of function code in complex or long functions; 16% duplicated lines. Weakest area: process."},"security":{"score":69.3,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":93.6,"sast":98.5,"dependencies":null,"ci_actions":63.1,"posture":0.0,"scorecard":28.6},"summary":"Security posture is weak: 2 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":2.8,"check:Maintained":0.0,"check:Dangerous-Workflow":10.0,"check:Code-Review":0.0,"check:Token-Permissions":0.0,"check:Pinned-Dependencies":0.0,"check:Binary-Artifacts":10.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:Fuzzing":0.0,"check:License":10.0,"check:Branch-Protection":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)","ref":"Dangerous-Workflow","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Code-Review: 0/10 (Found 0/18 approved changesets -- score normalized to 0)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Token-Permissions: 0/10 (detected GitHub workflow tokens with excessive permissions)","ref":"Token-Permissions","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Pinned-Dependencies: 0/10 (dependency not pinned by hash detected -- score normalized to 0)","ref":"Pinned-Dependencies","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":0.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/alibaba/GGEditor","weight":1.0}],"data":{"date":"2026-11-09","commit":"68e4cb609a15428d93467564a31ea443e4da35c7","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":39.0,"checked":39.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":392.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":49558.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2018-08":{"loc":2187,"attributed_loc":0},"2018-09":{"loc":770,"attributed_loc":0},"2018-10":{"loc":278,"attributed_loc":0},"2018-11":{"loc":20,"attributed_loc":0},"2018-12":{"loc":319,"attributed_loc":0},"2019-01":{"loc":68,"attributed_loc":0},"2019-03":{"loc":4,"attributed_loc":0},"2019-04":{"loc":852,"attributed_loc":0},"2019-10":{"loc":26146,"attributed_loc":0},"2019-11":{"loc":14907,"attributed_loc":0},"2019-12":{"loc":1292,"attributed_loc":0},"2020-01":{"loc":635,"attributed_loc":0},"2020-02":{"loc":197,"attributed_loc":0},"2020-03":{"loc":376,"attributed_loc":0},"2020-04":{"loc":1465,"attributed_loc":0},"2020-05":{"loc":28,"attributed_loc":0},"2020-06":{"loc":9,"attributed_loc":0},"2020-07":{"loc":5,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":189.0,"flagged_units":0.0,"pre_ai_era_bursts":2.0,"pre_ai_era_measured_loc":42470.0,"pre_ai_era_burst_loc":31284.0,"measured_loc":42470.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":4538.985296065704,"median_loc_per_hour":60.26918882898164,"pr_timed_units":41.0,"excluded_import_loc":7088.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["a5e574dd4dc04a64801fe877b8df172707132f01"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":34.0,"flagged_releases":0.0,"max_loc_per_day":148.5},"findings":[],"evidence":[],"data":{"releases":[{"from":"1.1.1","to":"1.1.2","loc":85,"days":4.02,"loc_per_day":21.2,"flagged":false},{"from":"1.1.2","to":"1.1.3","loc":40,"days":0.96,"loc_per_day":41.6,"flagged":false},{"from":"1.1.3","to":"1.2.0","loc":130,"days":9.02,"loc_per_day":14.4,"flagged":false},{"from":"1.2.0","to":"1.2.1","loc":5,"days":8.74,"loc_per_day":0.6,"flagged":false},{"from":"1.2.1","to":"1.2.2","loc":11,"days":1.32,"loc_per_day":8.4,"flagged":false},{"from":"1.2.2","to":"1.2.3","loc":223,"days":19.0,"loc_per_day":11.7,"flagged":false},{"from":"1.2.3","to":"1.2.4","loc":10,"days":1.92,"loc_per_day":5.2,"flagged":false},{"from":"1.2.4","to":"1.2.5","loc":15,"days":0.1,"loc_per_day":148.5,"flagged":false},{"from":"1.2.5","to":"1.3.0","loc":30,"days":2.97,"loc_per_day":10.1,"flagged":false},{"from":"1.3.0","to":"1.3.1","loc":4,"days":9.05,"loc_per_day":0.4,"flagged":false},{"from":"1.3.1","to":"1.3.2","loc":6,"days":3.81,"loc_per_day":1.6,"flagged":false},{"from":"1.3.2","to":"1.3.3","loc":2,"days":0.15,"loc_per_day":13.7,"flagged":false},{"from":"1.3.3","to":"1.3.4","loc":8,"days":15.7,"loc_per_day":0.5,"flagged":false},{"from":"1.3.4","to":"1.3.5","loc":61,"days":22.17,"loc_per_day":2.8,"flagged":false},{"from":"1.3.5","to":"1.4.0","loc":176,"days":12.24,"loc_per_day":14.4,"flagged":false},{"from":"1.4.0","to":"1.5.0","loc":53,"days":1.93,"loc_per_day":27.5,"flagged":false},{"from":"1.5.0","to":"1.5.1","loc":7,"days":0.09,"loc_per_day":74.3,"flagged":false},{"from":"1.5.1","to":"1.5.2","loc":22,"days":0.69,"loc_per_day":31.8,"flagged":false},{"from":"1.5.2","to":"2.0.0","loc":14,"days":4.08,"loc_per_day":3.4,"flagged":false},{"from":"2.0.0","to":"2.0.1","loc":54,"days":13.11,"loc_per_day":4.1,"flagged":false},{"from":"2.0.1","to":"2.0.2","loc":4,"days":63.92,"loc_per_day":0.1,"flagged":false},{"from":"2.0.2","to":"2.0.3","loc":844,"days":18.81,"loc_per_day":44.9,"flagged":false},{"from":"2.0.3","to":"2.0.4","loc":8,"days":16.23,"loc_per_day":0.5,"flagged":false},{"from":"2.0.4","to":"3.0.0","loc":35682,"days":260.2,"loc_per_day":137.1,"flagged":false},{"from":"3.0.0","to":"3.0.1","loc":210,"days":5.83,"loc_per_day":36.0,"flagged":false},{"from":"3.0.1","to":"3.0.2","loc":5,"days":19.73,"loc_per_day":0.3,"flagged":false},{"from":"3.0.2","to":"3.0.3","loc":93,"days":2.24,"loc_per_day":41.5,"flagged":false},{"from":"3.0.3","to":"3.0.4","loc":98,"days":4.91,"loc_per_day":20.0,"flagged":false},{"from":"3.0.4","to":"3.0.5","loc":1,"days":0.1,"loc_per_day":9.6,"flagged":false},{"from":"3.0.5","to":"3.0.6","loc":111,"days":41.93,"loc_per_day":2.6,"flagged":false},{"from":"3.0.6","to":"3.1.0","loc":870,"days":14.18,"loc_per_day":61.4,"flagged":false},{"from":"3.1.0","to":"3.1.1","loc":860,"days":15.01,"loc_per_day":57.3,"flagged":false},{"from":"3.1.1","to":"3.1.2","loc":37,"days":49.83,"loc_per_day":0.7,"flagged":false},{"from":"3.1.2","to":"3.1.3","loc":5,"days":29.13,"loc_per_day":0.2,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":5800.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":2.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 15070a385b); removed from the current tree but still retrievable","path":"demo/dist/bundle.js","line":1,"fingerprint":"15070a385b84d48d2db131142b1088cc5b0e0110:demo/dist/bundle.js:generic-api-key:1"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 25068a59d8); removed from the current tree but still retrievable","path":"dist/bundle.js","line":1,"fingerprint":"25068a59d8880c75ffbe377324b7391ab5b3ff54:dist/bundle.js:generic-api-key:1"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1.0,"findings_high":0.0,"findings_medium":1.0,"findings_low":0.0,"weighted_findings":0.25,"scanned_lines":5800.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `externalArray` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-c [confidence low]","path":"scripts/build.js","line":22,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/build.js:22"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":4.0,"findings_high":2.0,"findings_medium":2.0,"findings_low":0.0,"penalty":27.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":12,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:12"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gh-pages.yml","line":16,"fingerprint":"unpinned-uses:.github/workflows/gh-pages.yml:16"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/gh-pages.yml","line":12,"fingerprint":"artipacked:.github/workflows/gh-pages.yml:12"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/gh-pages.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/gh-pages.yml:9"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"package.json has no lockfile alongside it (unpinned dependencies)","ref":"package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":351.0,"function_nloc":2916.0,"mean_ccn":1.67,"p90_ccn":3.0,"complex_functions":0.0,"long_functions":1.0,"many_param_functions":0.0,"risky_nloc_share":0.0367},"findings":[],"evidence":[{"kind":"complex-function","description":"build in scripts/build.js: complexity 4, 107 lines","ref":"scripts/build.js","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/scripts/build.js#L27","weight":0.06666666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":3430.0,"duplicated_lines":566.0,"duplicated_share":0.165,"files":76.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: examples/component/command/index.tsx:15 and examples/component/command/index.tsx:27","ref":"examples/component/command/index.tsx","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/examples/component/command/index.tsx#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/component/command/index.tsx:45 and examples/component/detail-panel/index.tsx:7","ref":"examples/component/command/index.tsx","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/examples/component/command/index.tsx#L45","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/component/command/index.tsx:71 and examples/graph/mind/index.tsx:7","ref":"examples/component/command/index.tsx","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/examples/component/command/index.tsx#L71","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/component/detail-panel/Panel/index.tsx:55 and examples/component/detail-panel/Panel/index.tsx:69","ref":"examples/component/detail-panel/Panel/index.tsx","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/examples/component/detail-panel/Panel/index.tsx#L55","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/component/detail-panel/index.tsx:6 and examples/editor/context/index.tsx:7","ref":"examples/component/detail-panel/index.tsx","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/examples/component/detail-panel/index.tsx#L6","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/editor/context/index.tsx:27 and examples/register/dom-node/index.tsx:25","ref":"examples/editor/context/index.tsx","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/examples/editor/context/index.tsx#L27","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/graph/flow/index.tsx:25 and examples/plugin/context-menu/index.tsx:26","ref":"examples/graph/flow/index.tsx","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/examples/graph/flow/index.tsx#L25","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/register/dom-node/index.tsx:31 and examples/register/node/index.tsx:31","ref":"examples/register/dom-node/index.tsx","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/examples/register/dom-node/index.tsx#L31","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/register/node/index.tsx:91 and examples/register/node/index.tsx:101","ref":"examples/register/node/index.tsx","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/examples/register/node/index.tsx#L91","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/build.js:43 and scripts/build.js:115","ref":"scripts/build.js","url":"https://github.com/alibaba/GGEditor/blob/68e4cb609a15428d93467564a31ea443e4da35c7/scripts/build.js#L43","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":15.0,"weighted_findings":13.5,"scanned_lines":5800.0,"category:best-practice":13.0,"category:correctness":2.0},"findings":[{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/common/withContext/index.tsx","line":28,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/common/withContext/index.tsx:28"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/common/withContext/index.tsx","line":28,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/common/withContext/index.tsx:28"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/common/withContext/index.tsx","line":28,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/common/withContext/index.tsx:28"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/common/withContext/index.tsx","line":28,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/common/withContext/index.tsx:28"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/common/withContext/index.tsx","line":34,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/common/withContext/index.tsx:34"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/DetailPanel/index.tsx","line":47,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/DetailPanel/index.tsx:47"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/DetailPanel/index.tsx","line":47,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/DetailPanel/index.tsx:47"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/Editor/index.tsx","line":170,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/Editor/index.tsx:170"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/Flow/index.tsx","line":121,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/Flow/index.tsx:121"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/Graph/index.tsx","line":152,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/Graph/index.tsx:152"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/ItemPanel/Item.tsx","line":35,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/ItemPanel/Item.tsx:35"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/ItemPanel/index.tsx","line":49,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/ItemPanel/index.tsx:49"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/Mind/index.tsx","line":139,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/Mind/index.tsx:139"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"scripts/build.js","line":12,"fingerprint":"javascript.lang.correctness.useless-assignment:scripts/build.js:12"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"scripts/build.js","line":13,"fingerprint":"javascript.lang.correctness.useless-assignment:scripts/build.js:13"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":5800.0,"test_ratio":0.0,"ci_files":2.0,"cochange_share":0.0,"cochange_commits":197.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/gh-pages.yml","ref":".github/workflows/gh-pages.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":82.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":15.0,"escapes_per_kloc":2.679},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}