{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:18:52.383373Z","repo":{"ref":{"host":"github.com","owner":"anthropics","name":"claude-code-action"},"default_branch":"main","clone_url":"https://github.com/anthropics/claude-code-action.git","html_url":"https://github.com/anthropics/claude-code-action","description":null,"stars":9924,"forks":2276,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3580,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2025-05-19T15:26:50Z","pushed_at":"2026-11-13T22:23:55Z","security_policy_url":"https://github.com/anthropics/claude-code-action/security/policy","distribution":{"owner_created_at":"2020-12-19T18:49:20Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"9fa68854da5fadef4ed3dce240325a0dfe251880","profile":{"lines_by_language":{"TypeScript":34769,"Python":2167,"Shell":421,"JavaScript":162},"files_by_category":{"source":81,"test":66,"config":51,"docs":35,"other":6,"generated":1},"source_lines":15229,"test_lines":22290},"pillars":{"ai_provenance":{"score":52.9,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.5292,"suspected_share":0.0,"estimated_share":0.5292,"ai_artifacts":15.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 53% of first-party code added; an estimated 53% including velocity signals."},"quality":{"score":74.8,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":29.2,"duplication":71.9,"lint":87.3,"testing":100.0,"docs":80.0,"type_safety":91.1,"process":null},"summary":"Code quality is adequate: test-to-source ratio 1.46, CI runs tests; 41% of function code in complex or long functions; 6% duplicated lines. Weakest area: complexity."},"security":{"score":38.3,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":69.3,"sast":55.0,"dependencies":10.0,"ci_actions":1.0,"posture":40.0,"scorecard":null},"summary":"Security posture is poor: 113 known vulnerabilities in 18 dependencies; 1 high-severity SAST findings; 23 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":16.0,"checked":16.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":848.0,"attributed_commits":215.0,"attributed_commit_share":0.2535377358490566,"effective_loc":47156.0,"attributed_loc":24957.0,"attributed_loc_share":0.5292433624565273,"tools_detected":3.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 208 attributed commits, 24,269 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 5 attributed commits, 452 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Cursor agent: 2 attributed commits, 236 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"9fa68854da5fadef4ed3dce240325a0dfe251880","url":"https://github.com/anthropics/claude-code-action/commit/9fa68854da5fadef4ed3dce240325a0dfe251880","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"4d75e5f390ee76b2e09c1980ecc99ff3a2e088c8","url":"https://github.com/anthropics/claude-code-action/commit/4d75e5f390ee76b2e09c1980ecc99ff3a2e088c8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"274a39507b06041a0e5561ac4013fe231271fa75","url":"https://github.com/anthropics/claude-code-action/commit/274a39507b06041a0e5561ac4013fe231271fa75","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"8a29bc6f0ae11a363721054b6739feba6adabe57","url":"https://github.com/anthropics/claude-code-action/commit/8a29bc6f0ae11a363721054b6739feba6adabe57","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"e52db4509809f06a902cb58b6a9d64a52b64aa6e","url":"https://github.com/anthropics/claude-code-action/commit/e52db4509809f06a902cb58b6a9d64a52b64aa6e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"75b2776d96a8c27f07e81b6384ebe2c4eae75f48","url":"https://github.com/anthropics/claude-code-action/commit/75b2776d96a8c27f07e81b6384ebe2c4eae75f48","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"650432d39672d18d4d6cc9a82b4fbd9bef675d5e","url":"https://github.com/anthropics/claude-code-action/commit/650432d39672d18d4d6cc9a82b4fbd9bef675d5e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"462c312141ff325a036bed3070d9abf78afcb28d","url":"https://github.com/anthropics/claude-code-action/commit/462c312141ff325a036bed3070d9abf78afcb28d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"ead3158f27680821ad16bdccc0471e84982b0129","url":"https://github.com/anthropics/claude-code-action/commit/ead3158f27680821ad16bdccc0471e84982b0129","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"8565ca8f18470bf24f77f309901b0de8b385f92e","url":"https://github.com/anthropics/claude-code-action/commit/8565ca8f18470bf24f77f309901b0de8b385f92e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"3fd089526cbc3dfda9c1fcc3f60d62991a901fc6","url":"https://github.com/anthropics/claude-code-action/commit/3fd089526cbc3dfda9c1fcc3f60d62991a901fc6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"d5f7970ae232b6039636a16ea7f251e58e814f38","url":"https://github.com/anthropics/claude-code-action/commit/d5f7970ae232b6039636a16ea7f251e58e814f38","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"98a9e39fe1e0e81f39cec7f8b24f04c3e39192ed","url":"https://github.com/anthropics/claude-code-action/commit/98a9e39fe1e0e81f39cec7f8b24f04c3e39192ed","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/vigilant-cray-pileu4'","ref":"925afb53776cf1a2b738c6bdbed37b4d4000ef13","url":"https://github.com/anthropics/claude-code-action/commit/925afb53776cf1a2b738c6bdbed37b4d4000ef13","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"8d70a0dd265122bd65b8e09d3d959e65373ae2a1","url":"https://github.com/anthropics/claude-code-action/commit/8d70a0dd265122bd65b8e09d3d959e65373ae2a1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"a8cb0db4d8c2baea0bf33aac6db34a3ce00b4014","url":"https://github.com/anthropics/claude-code-action/commit/a8cb0db4d8c2baea0bf33aac6db34a3ce00b4014","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"46a42b43239748e5b25771606bf1f551c3b1b517","url":"https://github.com/anthropics/claude-code-action/commit/46a42b43239748e5b25771606bf1f551c3b1b517","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"2d7a787fbd4fb28fdbb7ab4dd6376f6568ace331","url":"https://github.com/anthropics/claude-code-action/commit/2d7a787fbd4fb28fdbb7ab4dd6376f6568ace331","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor'","ref":"492d2d78ee1f7dd5b58581c639b49752db9a2fab","url":"https://github.com/anthropics/claude-code-action/commit/492d2d78ee1f7dd5b58581c639b49752db9a2fab","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"65b50df0838d26293e18bb62f71492d3c11dc82d","url":"https://github.com/anthropics/claude-code-action/commit/65b50df0838d26293e18bb62f71492d3c11dc82d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"05ee4b30d732dc4e5498bbac22ec8aece7016faf","url":"https://github.com/anthropics/claude-code-action/commit/05ee4b30d732dc4e5498bbac22ec8aece7016faf","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"a2489efcb95430999fc7da9c8a6fd2ba03a27175","url":"https://github.com/anthropics/claude-code-action/commit/a2489efcb95430999fc7da9c8a6fd2ba03a27175","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2988cbe14a98691d372924b88adf410a9c52b221","url":"https://github.com/anthropics/claude-code-action/commit/2988cbe14a98691d372924b88adf410a9c52b221","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"5bfa96a5b03ee5a0755064602e0937704db61734","url":"https://github.com/anthropics/claude-code-action/commit/5bfa96a5b03ee5a0755064602e0937704db61734","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-claude-args-model-sdk-option'","ref":"214a70611b9f31a346f9d2635f3179429e7148b3","url":"https://github.com/anthropics/claude-code-action/commit/214a70611b9f31a346f9d2635f3179429e7148b3","weight":0.9}],"data":{"attributed_loc_by_commit":{"9e23f6d9edee0708524d95cebf59dade71d50acc":0,"d15de3a8e38783027765c731ad06b21a6c8f8e2f":0,"e67f992a1347b7e3264df0fe7a6b4035d3e4c945":1,"08e084156a6ea2137fcdb8c180a37c49749d7c81":1,"1e9ea49f7ac20d32bceaedda8936bde5b4b2295a":0,"d3bb4afed54a3207e6e8cc9b1b049a41cc6b9f50":0,"57ae256d386dc853442e1b23b3d53079e75d8b2a":0,"36c5ee33cd011d2f2008a96961f444cac15b9f38":0,"3c6a85b54b18961be6af7495bd63c6df25b3eb11":15,"253f2c6796983b2297997f0c3d9960406cc9fd3b":0,"0eb34ae4419833fa213dfd354610bbafc38a20fb":5,"37c3c29341a34987db13d9bdce44a8fa1a442e4f":67,"52efa5e498aaed954a436f12fad256d8f8a02903":72,"fcbdac91f2b781fd1fcd0a56205f53640797e11d":87,"fb7365fba9add22f3986dcb26fede5f7031375b4":0,"8da47815ec964716298696421c21e1ddf85a3f7b":5,"e409c57d904a98dd5e69d686a75629d749d8cf13":381,"1d4d6c4b93f4ca8a7beb52af8bb1034add5353d0":704,"70245e56e330657c561c4315cc1d275d88b8546d":0,"bd71ac0e8fce5a1d933d1de0482ccb09274f4984":0,"94c0c31c1baca5e115281f1d4bd8b40eeb46dd72":1,"699aa26b4191ac1743a1819c5c724bfdb16e6bee":159,"8e8be41f1578a3e233d3314a276bf64c87785f90":0,"37483ba1128de6e5b33da71cff57ee65c25a4372":0,"3bcfbe73859ddf55e4cb2cda805ba8582b5b2237":1,"25f9b8ef9ec0e3c1882b2075a6f1a14bd2458ab7":3,"41dd0aa695a06b94f18ce26fd851bfd6ed9d8760":48,"def1b3a94ee489d17f4959f366dd44e1434da02a":0,"ffb2927088ee8d2e3fab39463c9742d64c4ebefc":0,"1b94b9e5a85d066d540e74f2b5f616919a874336":44,"13ccdab2f8b45fde1825caf9a88c1901f38c92c5":21,"91f620f8c24a9a3d3dbd1b60a4d67cecc13df0ce":0,"882586e4968e81b5df9ef7081d594daa203303b9":0,"38254908ae505a7fc87cdc8ca3510717b8142803":78,"a7665d369844457f375050352d7352ee9cad490d":52,"8fe405c45f1b154c4848abab0c144ea635dec81f":900,"55b7205cd2488701b60dded79604e04cd4c59cf3":0,"23fae74fdb7f3bb4fdd3ef029a08b1db410a4240":669,"6364776f60df0aeb83d4efda5906d68d8cc72137":1,"86665d0984fd49d450080db71c55f8aafcf060c2":0,"a804c9e83f1c7a3288cc7a7bbca208491a4bb2f8":0,"87facd7051952ac2f27354dfadb90dc91e9ebc76":659,"c09fc691c5fcbf3cc5c4f95c39082636aaf165b7":0,"a9d9ad3612d6d61922fb1af719a32b9f1366f3f2":0,"4e2cfbac3621fa54f6996ff6f0fc4b3978e3eebf":271,"bf2400d475b6c47e7145968c4d27551410d3d756":0,"06b3126baf22c0eb3835094d301a19ee4673d7f1":0,"d4d7974604c97ec79208ca115b863b41a325d62d":9,"00b4a235512198bb7d7583a67b835024bd528812":2,"8335bda2435c52aacc353fc7ec9c1568c498d1b2":1417,"dfa92d695228cdc22697d203b91e4104e7e84ae8":0,"d1e03ad18e564025979ec6891ad333315b8671c1":0,"f6e7adf89ef0a0b369a2b7e69a78bbb7cdb0030c":0,"de86beb3aee5187589f6ef3483c72172dd653b68":5,"d290268f83c4c69c6111ef0b8312c96e79c6b3f4":0,"93df09fd88688c19bd9e4ca40e5c7281cba39ed1":11,"b89253bcb0a1d0a0f58b39366edc9cd12338caab":0,"c96a923d95df2bd0b5377578a23afb7b1abee443":3,"204266ca456d17f07482e2f9fa78d2d5d9039a17":336,"0763498a5a7dd1778edfb255374e71ce88d91d6b":0,"963754fa12b38d17c5a7b5068b764e8b0cd9ff73":123,"9cf75f75b9d954f16b5fd70f7bd58ebcbc667e6a":8,"c3e0ab4d6d0bcd68769fcf88ed8ccc236c06413d":170,"8fc9a366cb5d4bb8e12ec55dd3bbd0c2ac803a0b":0,"ec0e9b4f87ab886a0d7241b8249caa42208066d1":406,"daac7e353fcc76d32702af42e45fb334a08063d9":166,"5bdc533a5221a66c2ba3982c53ac4c911f8187b8":0,"56179f5fc968c41c9e2661c7411c1f2e234cd8a9":504,"0a78530f89a561977392045fd15f54d0c65554a5":0,"458e4b9e7f76435c45b7ee16064c0775b2a9f11f":88,"0d9513b3b355113c13a5c2405b330a5427fa056f":0,"85287e957da85d41d87fb98c923b81842e967d6c":18,"a519840051f28104f828d0341e481e656a0186e2":0,"15db2b3c79c0681556c056e9bc3f61fd3fc0347d":201,"fec554fc7ce7e8b91c17f524c25d57d570aa8d1f":156,"ae66eb6a644f9c34886cd7d4d5a7516e9b472b85":0,"a1507aefdc04f00f278407dba905d158ac62399e":148,"e89411bb6f540b448a41d4a997c7c8dd9376dafb":26,"f05d669d5fcfaa9e5372eb0eb6f8aaaad32ce383":4,"8f0a7fe9d35c92432ae635cdfd1d10a13862bcc6":2,"194fca8b05f044ca6678c516c60c73d6b1d6dbae":35,"9f02f6f6d43ec1d1da0f80028250535a057f3f32":8,"dc65f4ac98d71813b5361d5266d0d0082e367b30":7,"9c7e1bac949439d391a133337eb0498238d1c2b4":0,"0630ef383a451c46ccac86eb86ee7641e99c4c9a":993,"d6d3ddd4a76d757b42c96fe70521cfe7ff4168fb":0,"e6f32c832142273aeb268ba12cc6487db335daee":0,"41e5ba90127e18a42963bd161925d1ed14a5d5ff":0,"5218d84d4fd4124ed7c96b46f31e228b425d8cd0":0,"dfef61fdeefaa42e87ff0262a6c9743859173142":0,"f0925925f14ac5e5ea38151c9c999935b05e54dc":1,"0c127307fa529d701bc1f0f8f9c0bea881c49a9b":0,"c041f894935e23b9badcd6de3f8fe3dfb4d9069d":408,"a6888c03f22170d00d2a92fa2317584ca7d5e108":851,"45408b4058a64c5cc60290ad5e86f923712bb67e":46,"3ed14485f8d90a0bfa28d808165966320744b6ab":0,"b60e3f0e60509e51886110d313b82bf9d0df84dd":0,"a6ca65328b70e0f86bf5cef4c5257b8af8a12e57":0,"9e9123239f98436066edd03c9705ea25512fe2f1":0,"fb823f6dd604f57240fe673f426e49f1cb0e2919":0,"63f1c772bd5522490d809d3bfbbde5b5d9fd6b2b":101,"fd2c17f101639b10696381c1fd85fa735239090a":0,"765fadc6a6fd252419391be537e01b5f94d1a393":0,"13e47489f467b2deeedf92aca02795366ee7030b":98,"9975f36410aaf8c6ab1a00625a6d473601066909":31,"1a8e7d330abf7dc9fa58cff1e872d1656fc88363":1,"69dec299f882fef0fff1652a1309b7e9771b9f98":157,"11a01b7183ef5cf1c7fbb75eaf39379c6b11bdc8":0,"a3ff61d47aa5118a43b33ae44c4087d9eb51111a":34,"89f9131f6c76a802e685c3d7561aa33b3b71f0c0":0,"f197e7bfd5369e4188ac0e4127e2164eacceaadc":0,"86d6f44e34f1e8eac49bdeeb94f19138b72c24dd":3,"1d4650c102d922ea85062d567f39fbd6fab85a3f":1,"93f8ab56c25eb7a600184272bc9b99f400ea8042":20,"bd70a3ef2b0ceb6f444361c541cd24082733515b":518,"90d189f3abd48655ec3e2c67c552cc23e92d6028":0,"521d069da7c8c2f78e2964e041c7d6fff78bf9d8":0,"1c0c3eaced7e0f0c8d3c584ab5b6815f3b3a7887":0,"d4c09790f562a80f0e11d544eaa507ec6283a424":611,"7b914ae5c08260c1ec0aecfbf27b76d71578102c":103,"8ad13bd20b7bd5796404bfef41fe409e9c88915b":0,"29fe50368ce880d2186a239694441eb846bcc5fa":312,"037b85d0d2140e92af387c40ee8bbd9f0fc4d7a5":0,"6902c227aaa9536481b99d56f3014bbbad6c6da8":234,"4318310481bb86de0d1f1c864f4474aa3a50f18c":0,"f092d4cefd99343a0fa45ec7c5f9387f3e65d79e":115,"798cf0988d672fc8049482ce79e55d909193e150":0,"7febbb006b594e0b9cec201bdad509bfa35f62a6":0,"a7e4c51380c42dd89b127f5e5f9be7b54020bc6b":0,"6337623ebba10cf8c8214b507993f8062fd4ccfb":304,"469fc9c1a4220d6c6a02a1a9e7ed246461f5d3f0":273,"bb4a3f68f7b2aaea41e7c8879baa393845707719":121,"05c95aed7977cd1f47dce86cb5b617c56d8fd529":206,"a3bb51dac19ba1ffd7bc3e0473b82cf696d2c5a7":13,"68a0348c2068d85d2d735c8655f72bafe32d4c5d":0,"609c388361a522912370f658074908547a5d36c6":316,"79b343c094af25e9abc90ff1a43ec876b22294d8":2,"67bf0594ce72f9928d505dfb5a262722de28f6f3":103,"f375cabfaba7315f02595fd95eb2e3c6bd860b90":0,"d7b6d50442a89f005016e778bf825a72ef582525":280,"f98c1a5aa8133c51d4e244f6249b22c506947ab9":10,"95be46676d0100443bede571232bf9c1c6044ec8":0,"b89827f8d12d3e27016e9bf5fc1e7d4a8bbf179a":0,"154d0de144ff82240e1c3deedff56280381fd122":13,"b17b541bbc4d94ffa42edf2e2384ffe702e59370":248,"653f9cd7a3be31b2bd02829bfccb23a65d318ee6":150,"63ea7e317465e9909497ac1bdcbe7a512f6f3eb3":0,"c9ec2b02b40ac0444c6716e51d5e19ef2e0b8d00":2,"5da7ba548c7c2a4ef0bd92b436b6151fef19ca46":300,"005436f51d0d62708b8476149265f7a3cc9c3934":55,"625ea1519c56d48296d4c5a88f1481cac91197f9":0,"a017b830c03e23789b11fb69ed571ea61c12e45c":0,"ba60ef7ba252481af061215abd63273745a2eb82":0,"49cfcf81070eac8de029f52cf67d7214185a2212":12,"fab4258c6e9d27c6ee22af009d8c1988182bb69f":55,"d5b01b6843f9833af40ed0d03537f5c352dccfd5":0,"7695f7866a6439966f7c3a61e7a171915ff4e5ae":0,"1bb0e7464b934392210ba86f06bec55297259d82":27,"f669191d7d1e67f08a54b0c11cf5683a9a391951":15,"c22f7c3f9dbdf2faa98a4c3139f7ec9eb5a691dc":6,"cc5ef44546fda0649ddde3c5ab0cd3db7b7c5035":6,"220272d38887a1caed373da96a9ffdb0919c26cc":0,"85133eeab220b669a1327e80483cdd0cd5e6f443":0,"21b0f0f9aa329dd98d3b82e15fa71d2f34e5ceee":1,"d8af4e9f017ccc66d807d10675d3ce80cba3d199":132,"d5db8208f9147761c05b11340bed1e540b63f549":0,"b15d4751a6478e3d2b6565953cf654a3e7320eeb":13,"f328a5c8890b866764c829fce9ce405996ebd942":20,"5150ea9643a49aa8186b9ceb0caccdc480997e7b":14,"0f1fe5ef851a13d28734e675cf8504f540ba5d93":0,"6cad158a175744eb2e76f7f5fd108ec63145598c":5,"78758edf84903744fffe01b3d17c12b8757b4454":0,"6ee201f0231fbb762d22664f12aad2e7ae0401ae":16,"0756f6ef2bee1c37e43b07fb1dd8e83d835a0b60":204,"1450f658d3a8e185d1ff9be0810420ac8bfbc5f4":157,"9eb125afe37fb6baf7bf6e914e6cdf151c4d088d":286,"dc081a38099d56e9c6b87cf49d4ea001d1d92b24":0,"232c9a15f49822c165d462e7f0a3aa9287ed2a60":0,"ee2b19d8820907c22bd4d397bf63f8121a8b25b4":520,"24b915648e7331d5599ee6a656207a7d070b35c5":87,"8551f4b0aa500ecf8d089328f7e4855ec4f88b97":115,"a5e5d3b82e68f62fd7da6e6cdea64e0191cd9a93":146,"6b8063043eb8bc14e8448185a12d6d9dcf07ce55":107,"e452eb9dce5f3ab14b90cf9386247fbcb3c4ac92":48,"360be9c8fc5d80cb33661e0ffd33dcef4c7155aa":34,"f8076dc00886157bd2e1bd828246d01274b9cb62":0,"846d5d8993b09aeea48c5cdde44b7c68f0ba24bc":1828,"235b39bf21ce5bca22c31b37d171bd6e27cdd743":50,"58dc33d9ad210f0c6b8f41dcf8a6fe76608d6a62":156,"5f509a1c1f196bb716ff3977478d0b7396bcc51d":23,"214a70611b9f31a346f9d2635f3179429e7148b3":41,"5bfa96a5b03ee5a0755064602e0937704db61734":16,"2988cbe14a98691d372924b88adf410a9c52b221":0,"a2489efcb95430999fc7da9c8a6fd2ba03a27175":45,"05ee4b30d732dc4e5498bbac22ec8aece7016faf":12,"65b50df0838d26293e18bb62f71492d3c11dc82d":93,"492d2d78ee1f7dd5b58581c639b49752db9a2fab":30,"2d7a787fbd4fb28fdbb7ab4dd6376f6568ace331":206,"46a42b43239748e5b25771606bf1f551c3b1b517":0,"a8cb0db4d8c2baea0bf33aac6db34a3ce00b4014":339,"8d70a0dd265122bd65b8e09d3d959e65373ae2a1":105,"925afb53776cf1a2b738c6bdbed37b4d4000ef13":0,"98a9e39fe1e0e81f39cec7f8b24f04c3e39192ed":0,"d5f7970ae232b6039636a16ea7f251e58e814f38":72,"3fd089526cbc3dfda9c1fcc3f60d62991a901fc6":671,"8565ca8f18470bf24f77f309901b0de8b385f92e":370,"ead3158f27680821ad16bdccc0471e84982b0129":120,"462c312141ff325a036bed3070d9abf78afcb28d":605,"650432d39672d18d4d6cc9a82b4fbd9bef675d5e":207,"75b2776d96a8c27f07e81b6384ebe2c4eae75f48":541,"e52db4509809f06a902cb58b6a9d64a52b64aa6e":622,"8a29bc6f0ae11a363721054b6739feba6adabe57":0,"274a39507b06041a0e5561ac4013fe231271fa75":0,"4d75e5f390ee76b2e09c1980ecc99ff3a2e088c8":756,"9fa68854da5fadef4ed3dce240325a0dfe251880":891},"tools":{"claude-code":{"name":"Claude Code","commits":208,"loc":24269,"first_seen":1747923438,"last_seen":1794608632},"openai-codex":{"name":"OpenAI Codex","commits":5,"loc":452,"first_seen":1778798217,"last_seen":1784172135},"cursor":{"name":"Cursor agent","commits":2,"loc":236,"first_seen":1787267873,"last_seen":1787672733}},"monthly":{"2025-05":{"loc":8302,"attributed_loc":253},"2025-06":{"loc":1740,"attributed_loc":1440},"2025-07":{"loc":7072,"attributed_loc":5208},"2025-08":{"loc":4026,"attributed_loc":3496},"2025-09":{"loc":1002,"attributed_loc":964},"2025-10":{"loc":1114,"attributed_loc":1026},"2025-11":{"loc":402,"attributed_loc":349},"2025-12":{"loc":1708,"attributed_loc":1641},"2026-01":{"loc":2649,"attributed_loc":767},"2026-02":{"loc":1686,"attributed_loc":109},"2026-03":{"loc":583,"attributed_loc":0},"2026-04":{"loc":453,"attributed_loc":201},"2026-05":{"loc":1295,"attributed_loc":647},"2026-06":{"loc":3472,"attributed_loc":2885},"2026-07":{"loc":1217,"attributed_loc":286},"2026-08":{"loc":5076,"attributed_loc":386},"2026-09":{"loc":366,"attributed_loc":339},"2026-10":{"loc":131,"attributed_loc":105},"2026-11":{"loc":4862,"attributed_loc":4855}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":12.0,"workflow_agents":3.0,"tools_configured":1.0,"earliest_adoption":1747668752.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/agents/code-quality-reviewer.md (claude-code configuration)","ref":".claude/agents/code-quality-reviewer.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/agents/code-quality-reviewer.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/documentation-accuracy-reviewer.md (claude-code configuration)","ref":".claude/agents/documentation-accuracy-reviewer.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/agents/documentation-accuracy-reviewer.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/performance-reviewer.md (claude-code configuration)","ref":".claude/agents/performance-reviewer.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/agents/performance-reviewer.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/security-code-reviewer.md (claude-code configuration)","ref":".claude/agents/security-code-reviewer.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/agents/security-code-reviewer.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/test-coverage-reviewer.md (claude-code configuration)","ref":".claude/agents/test-coverage-reviewer.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/agents/test-coverage-reviewer.md","weight":0.5},{"kind":"ai-artifact","description":".claude/commands/commit-and-pr.md (claude-code configuration)","ref":".claude/commands/commit-and-pr.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/commands/commit-and-pr.md","weight":0.5},{"kind":"ai-artifact","description":".claude/commands/label-issue.md (claude-code configuration)","ref":".claude/commands/label-issue.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/commands/label-issue.md","weight":0.5},{"kind":"ai-artifact","description":".claude/commands/review-pr.md (claude-code configuration)","ref":".claude/commands/review-pr.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/commands/review-pr.md","weight":0.5},{"kind":"ai-artifact","description":".claude/settings.json (claude-code configuration)","ref":".claude/settings.json","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/settings.json","weight":0.5},{"kind":"ai-artifact","description":".claude/workflows/pr-stamp-sweep.js (claude-code configuration)","ref":".claude/workflows/pr-stamp-sweep.js","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.claude/workflows/pr-stamp-sweep.js","weight":0.5},{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"base-action/CLAUDE.md (claude-code configuration)","ref":"base-action/CLAUDE.md","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/base-action/CLAUDE.md","weight":0.5},{"kind":"ai-workflow","description":".github/workflows/claude-review.yml runs anthropics/claude-code-action","ref":".github/workflows/claude-review.yml","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.github/workflows/claude-review.yml","weight":0.6},{"kind":"ai-workflow","description":".github/workflows/claude.yml runs anthropics/claude-code-action","ref":".github/workflows/claude.yml","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.github/workflows/claude.yml","weight":0.6},{"kind":"ai-workflow","description":".github/workflows/issue-triage.yml runs anthropics/claude-code-action","ref":".github/workflows/issue-triage.yml","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.github/workflows/issue-triage.yml","weight":0.6}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/agents/code-quality-reviewer.md","added_at":1757340412},{"tool":"claude-code","path":".claude/agents/documentation-accuracy-reviewer.md","added_at":1757340412},{"tool":"claude-code","path":".claude/agents/performance-reviewer.md","added_at":1757340412},{"tool":"claude-code","path":".claude/agents/security-code-reviewer.md","added_at":1757340412},{"tool":"claude-code","path":".claude/agents/test-coverage-reviewer.md","added_at":1757340412},{"tool":"claude-code","path":".claude/commands/commit-and-pr.md","added_at":1747668752},{"tool":"claude-code","path":".claude/commands/label-issue.md","added_at":1757280002},{"tool":"claude-code","path":".claude/commands/review-pr.md","added_at":1757340412},{"tool":"claude-code","path":".claude/settings.json","added_at":1757535593},{"tool":"claude-code","path":".claude/workflows/pr-stamp-sweep.js","added_at":1781240088},{"tool":"claude-code","path":"CLAUDE.md","added_at":1747668752},{"tool":"claude-code","path":"base-action/CLAUDE.md","added_at":1752871976}],"workflows":[{"tool":"claude-code","path":".github/workflows/claude-review.yml","action":"anthropics/claude-code-action"},{"tool":"claude-code","path":".github/workflows/claude.yml","action":"anthropics/claude-code-action"},{"tool":"claude-code","path":".github/workflows/issue-triage.yml","action":"anthropics/claude-code-action"}],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":506.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":39999.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":946.0,"median_loc_per_hour":10.422070327567278,"pr_timed_units":275.0,"excluded_import_loc":7157.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["f66f337f4e2000f427352c56f5537b872ab337eb"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":99.0,"flagged_releases":0.0,"max_loc_per_day":17989.1},"findings":[],"evidence":[],"data":{"releases":[{"from":"v1.0.178","to":"v1.0.179","loc":1,"days":1.8,"loc_per_day":0.6,"flagged":false},{"from":"v1.0.179","to":"v1.0.180","loc":1,"days":0.97,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.180","to":"v1.0.181","loc":216,"days":0.99,"loc_per_day":217.3,"flagged":false},{"from":"v1.0.181","to":"v1.0.182","loc":1,"days":1.82,"loc_per_day":0.5,"flagged":false},{"from":"v1.0.182","to":"v1.0.183","loc":1,"days":0.35,"loc_per_day":2.9,"flagged":false},{"from":"v1.0.183","to":"v1.0.184","loc":1,"days":9.94,"loc_per_day":0.1,"flagged":false},{"from":"v1.0.184","to":"v1.0.185","loc":1137,"days":0.93,"loc_per_day":1217.1,"flagged":false},{"from":"v1.0.185","to":"v1.0.186","loc":14,"days":1.09,"loc_per_day":12.8,"flagged":false},{"from":"v1.0.186","to":"v1.0.187","loc":1133,"days":1.13,"loc_per_day":1001.7,"flagged":false},{"from":"v1.0.187","to":"v1.0.188","loc":663,"days":0.88,"loc_per_day":750.0,"flagged":false},{"from":"v1.0.188","to":"v1.0.189","loc":1,"days":0.06,"loc_per_day":15.4,"flagged":false},{"from":"v1.0.189","to":"v1.0.190","loc":1,"days":2.85,"loc_per_day":0.4,"flagged":false},{"from":"v1.0.190","to":"v1.0.191","loc":1,"days":0.87,"loc_per_day":1.2,"flagged":false},{"from":"v1.0.191","to":"v1.0.192","loc":233,"days":2.14,"loc_per_day":108.7,"flagged":false},{"from":"v1.0.192","to":"v1.0.193","loc":1,"days":0.95,"loc_per_day":1.1,"flagged":false},{"from":"v1.0.193","to":"v1.0.194","loc":485,"days":2.92,"loc_per_day":166.2,"flagged":false},{"from":"v1.0.194","to":"v1.0.195","loc":1,"days":1.01,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.195","to":"v1.0.196","loc":211,"days":0.98,"loc_per_day":216.1,"flagged":false},{"from":"v1.0.196","to":"v1.0.197","loc":38,"days":0.2,"loc_per_day":189.3,"flagged":false},{"from":"v1.0.197","to":"v1.0.198","loc":1,"days":0.82,"loc_per_day":1.2,"flagged":false},{"from":"v1.0.198","to":"v1.0.199","loc":752,"days":0.97,"loc_per_day":772.5,"flagged":false},{"from":"v1.0.199","to":"v1.0.200","loc":1,"days":0.78,"loc_per_day":1.3,"flagged":false},{"from":"v1.0.200","to":"v1.0.201","loc":1,"days":0.42,"loc_per_day":2.4,"flagged":false},{"from":"v1.0.201","to":"v1.0.202","loc":1,"days":1.95,"loc_per_day":0.5,"flagged":false},{"from":"v1.0.202","to":"v1.0.203","loc":1,"days":0.17,"loc_per_day":6.0,"flagged":false},{"from":"v1.0.203","to":"v1.0.204","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.0.204","to":"v1.0.205","loc":1,"days":0.06,"loc_per_day":15.9,"flagged":false},{"from":"v1.0.205","to":"v1.0.206","loc":393,"days":0.72,"loc_per_day":544.8,"flagged":false},{"from":"v1.0.206","to":"v1.0.207","loc":1,"days":1.07,"loc_per_day":0.9,"flagged":false},{"from":"v1.0.207","to":"v1.0.208","loc":1,"days":0.92,"loc_per_day":1.1,"flagged":false},{"from":"v1.0.208","to":"v1.0.209","loc":1,"days":0.11,"loc_per_day":9.1,"flagged":false},{"from":"v1.0.209","to":"v1.0.210","loc":1,"days":0.73,"loc_per_day":1.4,"flagged":false},{"from":"v1.0.210","to":"v1.0.211","loc":1,"days":3.06,"loc_per_day":0.3,"flagged":false},{"from":"v1.0.211","to":"v1.0.212","loc":1,"days":0.92,"loc_per_day":1.1,"flagged":false},{"from":"v1.0.212","to":"v1.0.213","loc":1,"days":0.19,"loc_per_day":5.2,"flagged":false},{"from":"v1.0.213","to":"v1.0.214","loc":1,"days":1.0,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.214","to":"v1.0.215","loc":1,"days":1.05,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.215","to":"v1.0.216","loc":1,"days":0.84,"loc_per_day":1.2,"flagged":false},{"from":"v1.0.216","to":"v1.0.217","loc":1,"days":1.29,"loc_per_day":0.8,"flagged":false},{"from":"v1.0.217","to":"v1.0.218","loc":1,"days":2.74,"loc_per_day":0.4,"flagged":false},{"from":"v1.0.218","to":"v1.0.219","loc":1,"days":0.14,"loc_per_day":7.3,"flagged":false},{"from":"v1.0.219","to":"v1.0.220","loc":1,"days":0.84,"loc_per_day":1.2,"flagged":false},{"from":"v1.0.220","to":"v1.0.221","loc":1,"days":1.02,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.221","to":"v1.0.222","loc":1,"days":0.94,"loc_per_day":1.1,"flagged":false},{"from":"v1.0.222","to":"v1.0.223","loc":1,"days":1.02,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.223","to":"v1.0.224","loc":1,"days":2.1,"loc_per_day":0.5,"flagged":false},{"from":"v1.0.224","to":"v1.0.225","loc":1,"days":0.1,"loc_per_day":9.6,"flagged":false},{"from":"v1.0.225","to":"v1.0.226","loc":1,"days":0.82,"loc_per_day":1.2,"flagged":false},{"from":"v1.0.226","to":"v1.0.227","loc":1,"days":1.16,"loc_per_day":0.9,"flagged":false},{"from":"v1.0.227","to":"v1.0.228","loc":1,"days":0.93,"loc_per_day":1.1,"flagged":false},{"from":"v1.0.228","to":"v1.0.229","loc":1,"days":0.15,"loc_per_day":6.6,"flagged":false},{"from":"v1.0.229","to":"v1.0.230","loc":1,"days":0.66,"loc_per_day":1.5,"flagged":false},{"from":"v1.0.230","to":"v1.0.231","loc":1,"days":0.38,"loc_per_day":2.6,"flagged":false},{"from":"v1.0.231","to":"v1.0.232","loc":1,"days":4.56,"loc_per_day":0.2,"flagged":false},{"from":"v1.0.232","to":"v1.0.233","loc":1,"days":0.13,"loc_per_day":8.0,"flagged":false},{"from":"v1.0.233","to":"v1.0.234","loc":1,"days":1.03,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.234","to":"v1.0.235","loc":1,"days":1.06,"loc_per_day":0.9,"flagged":false},{"from":"v1.0.235","to":"v1.0.236","loc":1,"days":2.84,"loc_per_day":0.4,"flagged":false},{"from":"v1.0.236","to":"v1.0.237","loc":1,"days":1.06,"loc_per_day":0.9,"flagged":false},{"from":"v1.0.237","to":"v1.0.238","loc":340,"days":0.99,"loc_per_day":344.4,"flagged":false},{"from":"v1.0.238","to":"v1.0.239","loc":1,"days":0.95,"loc_per_day":1.1,"flagged":false},{"from":"v1.0.239","to":"v1.0.240","loc":1,"days":1.1,"loc_per_day":0.9,"flagged":false},{"from":"v1.0.240","to":"v1.0.241","loc":1,"days":1.12,"loc_per_day":0.9,"flagged":false},{"from":"v1.0.241","to":"v1.0.242","loc":1,"days":2.02,"loc_per_day":0.5,"flagged":false},{"from":"v1.0.242","to":"v1.0.243","loc":1,"days":0.18,"loc_per_day":5.5,"flagged":false},{"from":"v1.0.243","to":"v1.0.244","loc":1,"days":0.63,"loc_per_day":1.6,"flagged":false},{"from":"v1.0.244","to":"v1.0.245","loc":1,"days":0.97,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.245","to":"v1.0.246","loc":1,"days":0.96,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.246","to":"v1.0.247","loc":1,"days":0.1,"loc_per_day":9.6,"flagged":false},{"from":"v1.0.247","to":"v1.0.248","loc":1,"days":0.99,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.248","to":"v1.0.249","loc":1,"days":4.31,"loc_per_day":0.2,"flagged":false},{"from":"v1.0.249","to":"v1.0.250","loc":1,"days":0.65,"loc_per_day":1.5,"flagged":false},{"from":"v1.0.250","to":"v1.0.251","loc":1,"days":1.04,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.251","to":"v1.0.252","loc":1,"days":1.06,"loc_per_day":0.9,"flagged":false},{"from":"v1.0.252","to":"v1.0.253","loc":1,"days":2.07,"loc_per_day":0.5,"flagged":false},{"from":"v1.0.253","to":"v1.0.254","loc":1,"days":0.96,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.254","to":"v1.0.255","loc":1,"days":0.97,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.255","to":"v1.0.256","loc":1,"days":0.27,"loc_per_day":3.7,"flagged":false},{"from":"v1.0.256","to":"v1.0.257","loc":1,"days":0.79,"loc_per_day":1.3,"flagged":false},{"from":"v1.0.257","to":"v1.0.258","loc":1,"days":0.26,"loc_per_day":3.8,"flagged":false},{"from":"v1.0.258","to":"v1.0.259","loc":1,"days":0.74,"loc_per_day":1.4,"flagged":false},{"from":"v1.0.259","to":"v1.0.260","loc":105,"days":0.75,"loc_per_day":139.3,"flagged":false},{"from":"v1.0.260","to":"v1.0.261","loc":1,"days":0.3,"loc_per_day":3.3,"flagged":false},{"from":"v1.0.261","to":"v1.0.262","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.0.262","to":"v1.0.263","loc":1,"days":2.88,"loc_per_day":0.3,"flagged":false},{"from":"v1.0.263","to":"v1.0.264","loc":1,"days":0.94,"loc_per_day":1.1,"flagged":false},{"from":"v1.0.264","to":"v1.0.265","loc":1,"days":2.2,"loc_per_day":0.5,"flagged":false},{"from":"v1.0.265","to":"v1.0.266","loc":1,"days":1.0,"loc_per_day":1.0,"flagged":false},{"from":"v1.0.266","to":"v1.0.267","loc":1,"days":3.02,"loc_per_day":0.3,"flagged":false},{"from":"v1.0.267","to":"v1.0.268","loc":1,"days":0.94,"loc_per_day":1.1,"flagged":false},{"from":"v1.0.268","to":"v1.0.269","loc":1,"days":2.71,"loc_per_day":0.4,"flagged":false},{"from":"v1.0.269","to":"v1.0.270","loc":1,"days":3.1,"loc_per_day":0.3,"flagged":false},{"from":"v1.0.270","to":"v1.0.271","loc":1,"days":0.3,"loc_per_day":3.4,"flagged":false},{"from":"v1.0.271","to":"v1.0.272","loc":72,"days":0.78,"loc_per_day":92.8,"flagged":false},{"from":"v1.0.272","to":"v1.0.273","loc":3136,"days":1.86,"loc_per_day":1682.0,"flagged":false},{"from":"v1.0.273","to":"v1.0.274","loc":1,"days":0.18,"loc_per_day":5.5,"flagged":false},{"from":"v1.0.274","to":"v1.0.275","loc":756,"days":0.04,"loc_per_day":17989.1,"flagged":false},{"from":"v1.0.275","to":"v1","loc":1,"days":0.89,"loc_per_day":1.1,"flagged":false},{"from":"v1","to":"v1.0.276","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":15229.0,"index":0.657,"count:narrated_steps":3.0,"per_kloc:narrated_steps":0.197,"files:narrated_steps":2.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":14.0,"per_kloc:emoji_in_code":0.919,"files:emoji_in_code":7.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Check write permissions (entity contexts and workflow_run)","ref":"src/entrypoints/prepare.ts:40","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/entrypoints/prepare.ts#L40","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, try to parse the URL to see if it's already properly encoded","ref":"src/github/operations/comment-logic.ts:25","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/github/operations/comment-logic.ts#L25","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, remove the \"Claude Code is working…\" or \"Claude Code is working...\" message","ref":"src/github/operations/comment-logic.ts:85","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/github/operations/comment-logic.ts#L85","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":11.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/private-key","severity":"low","message":"Possible private-key secret in the current tree (test/docs/example file)","path":"test/ssh-signing.test.ts","line":21,"fingerprint":"test/ssh-signing.test.ts:private-key:21"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"test/public-comment-redaction.test.ts","line":11,"fingerprint":"test/public-comment-redaction.test.ts:generic-api-key:11"},{"rule_id":"gitleaks/jwt","severity":"low","message":"Possible jwt secret in the current tree (test/docs/example file)","path":"test/public-comment-redaction.test.ts","line":12,"fingerprint":"test/public-comment-redaction.test.ts:jwt:12"},{"rule_id":"gitleaks/github-pat","severity":"low","message":"Possible github-pat secret in the current tree (test/docs/example file)","path":"test/format-turns.test.ts","line":616,"fingerprint":"test/format-turns.test.ts:github-pat:616"},{"rule_id":"gitleaks/github-app-token","severity":"low","message":"Possible github-app-token secret in the current tree (test/docs/example file)","path":"test/format-turns.test.ts","line":588,"fingerprint":"test/format-turns.test.ts:github-app-token:588"},{"rule_id":"gitleaks/github-app-token","severity":"low","message":"Possible github-app-token secret in the current tree (test/docs/example file)","path":"test/sanitizer.test.ts","line":297,"fingerprint":"test/sanitizer.test.ts:github-app-token:297"},{"rule_id":"gitleaks/github-pat","severity":"low","message":"Possible github-pat secret in the current tree (test/docs/example file)","path":"test/sanitizer.test.ts","line":280,"fingerprint":"test/sanitizer.test.ts:github-pat:280"},{"rule_id":"gitleaks/github-oauth","severity":"low","message":"Possible github-oauth secret in the current tree (test/docs/example file)","path":"test/sanitizer.test.ts","line":290,"fingerprint":"test/sanitizer.test.ts:github-oauth:290"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"test/sanitizer.test.ts","line":408,"fingerprint":"test/sanitizer.test.ts:generic-api-key:408"},{"rule_id":"gitleaks/github-refresh-token","severity":"low","message":"Possible github-refresh-token secret in the current tree (test/docs/example file)","path":"test/sanitizer.test.ts","line":314,"fingerprint":"test/sanitizer.test.ts:github-refresh-token:314"},{"rule_id":"gitleaks/jwt","severity":"low","message":"Possible jwt secret in the current tree (test/docs/example file)","path":"test/sanitizer.test.ts","line":423,"fingerprint":"test/sanitizer.test.ts:jwt:423"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":106.0,"findings_high":1.0,"findings_medium":96.0,"findings_low":9.0,"weighted_findings":26.012,"scanned_lines":15229.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `claudeExecutable`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"base-action/src/install-plugins.ts","line":144,"fingerprint":"javascript.lang.security.detect-child-process:base-action/src/install-plugins.ts:144"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"base-action/src/parse-sdk-options.ts","line":81,"fingerprint":"javascript.lang.security.insecure-object-assign:base-action/src/parse-sdk-options.ts:81"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/prepare-prompt.ts","line":32,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/prepare-prompt.ts:32"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/prepare-prompt.ts","line":37,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/prepare-prompt.ts:37"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `promptPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/prepare-prompt.ts","line":68,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/prepare-prompt.ts:68"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `promptPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/prepare-prompt.ts","line":69,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/prepare-prompt.ts:69"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/run-claude-sdk.ts","line":28,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/run-claude-sdk.ts:28"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `promptPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/run-claude-sdk.ts","line":48,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/run-claude-sdk.ts:48"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"base-action/src/run-claude-sdk.ts","line":51,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:base-action/src/run-claude-sdk.ts:51"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `promptPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/run-claude-sdk.ts","line":72,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/run-claude-sdk.ts:72"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"base-action/src/setup-claude-code-settings.ts","line":15,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:base-action/src/setup-claude-code-settings.ts:15"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `settingsInput` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/setup-claude-code-settings.ts","line":48,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/setup-claude-code-settings.ts:48"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"base-action/src/workload-identity.ts","line":96,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:base-action/src/workload-identity.ts:96"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/workload-identity.ts","line":98,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/workload-identity.ts:98"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"base-action/src/workload-identity.ts","line":98,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:base-action/src/workload-identity.ts:98"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"base-action/src/workload-identity.ts","line":100,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:base-action/src/workload-identity.ts:100"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"base-action/src/workload-identity.ts","line":100,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:base-action/src/workload-identity.ts:100"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"docs/create-app.html","line":438,"fingerprint":"python.django.security.django-no-csrf-token:docs/create-app.html:438"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"docs/create-app.html","line":456,"fingerprint":"python.django.security.django-no-csrf-token:docs/create-app.html:456"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/create-prompt/index.ts","line":609,"fingerprint":"javascript.lang.security.html-in-template-string:src/create-prompt/index.ts:609"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/create-prompt/index.ts","line":686,"fingerprint":"javascript.lang.security.html-in-template-string:src/create-prompt/index.ts:686"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/create-prompt/index.ts","line":694,"fingerprint":"javascript.lang.security.html-in-template-string:src/create-prompt/index.ts:694"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/create-prompt/index.ts","line":704,"fingerprint":"javascript.lang.security.html-in-template-string:src/create-prompt/index.ts:704"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/create-prompt/index.ts","line":705,"fingerprint":"javascript.lang.security.html-in-template-string:src/create-prompt/index.ts:705"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/create-prompt/index.ts","line":715,"fingerprint":"javascript.lang.security.html-in-template-string:src/create-prompt/index.ts:715"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `executionFile` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/entrypoints/run.ts","line":142,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/entrypoints/run.ts:142"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `executionFile` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/entrypoints/run.ts","line":155,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/entrypoints/run.ts:155"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `params` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"src/entrypoints/update-comment-link.ts","line":136,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/entrypoints/update-comment-link.ts:136"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `params` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/entrypoints/update-comment-link.ts","line":189,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/entrypoints/update-comment-link.ts:189"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/github/operations/branch-cleanup.ts","line":13,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/github/operations/branch-cleanup.ts:13"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/github/operations/branch-cleanup.ts","line":97,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/github/operations/branch-cleanup.ts:97"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/github/operations/branch-cleanup.ts","line":105,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/github/operations/branch-cleanup.ts:105"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/github/operations/branch-cleanup.ts","line":116,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/github/operations/branch-cleanup.ts:116"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/github/operations/git-config.ts","line":41,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/github/operations/git-config.ts:41"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/github/operations/git-config.ts","line":42,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/github/operations/git-config.ts:42"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/github/operations/git-config.ts","line":42,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/github/operations/git-config.ts:42"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/github/operations/git-config.ts","line":132,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/github/operations/git-config.ts:132"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/github/operations/git-config.ts","line":150,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:src/github/operations/git-config.ts:150"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/github/operations/restore-config.ts","line":125,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/github/operations/restore-config.ts:125"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/github/operations/restore-config.ts","line":126,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/github/operations/restore-config.ts:126"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `entryPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":132,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:132"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `src` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":148,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:148"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":152,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:152"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":153,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:153"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `src` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":179,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:179"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":179,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:179"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":196,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:196"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `src` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":198,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:198"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dest` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":198,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:198"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `entry` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/restore-config.ts","line":200,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/restore-config.ts:200"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/github/operations/session-guard.ts","line":58,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/github/operations/session-guard.ts:58"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/github/operations/session-guard.ts","line":116,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/github/operations/session-guard.ts:116"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":126,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:126"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":134,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:134"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":135,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:135"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":143,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:143"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":147,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:147"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":155,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:155"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `before` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":174,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:174"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/github/operations/session-guard.ts","line":260,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/github/operations/session-guard.ts:260"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":266,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:266"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":267,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:267"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/session-guard.ts","line":268,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/session-guard.ts:268"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/tool-config.ts","line":59,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/tool-config.ts:59"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/tool-config.ts","line":97,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/tool-config.ts:97"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/tool-config.ts","line":101,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/tool-config.ts:101"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/tool-config.ts","line":233,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/tool-config.ts:233"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/tool-config.ts","line":234,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/tool-config.ts:234"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseBranch` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/tool-config.ts","line":329,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/tool-config.ts:329"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseBranch` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/tool-config.ts","line":330,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/tool-config.ts:330"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `baseBranch` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/operations/tool-config.ts","line":333,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/operations/tool-config.ts:333"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/github/utils/image-downloader.ts","line":13,"fingerprint":"javascript.lang.security.html-in-template-string:src/github/utils/image-downloader.ts:13"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/github/utils/image-downloader.ts","line":265,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/github/utils/image-downloader.ts:265"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `options` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/github/utils/image-downloader.ts","line":267,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/github/utils/image-downloader.ts:267"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `context` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/github/validation/trigger.ts","line":85,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/github/validation/trigger.ts:85"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `context` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/github/validation/trigger.ts","line":112,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/github/validation/trigger.ts:112"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `context` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/github/validation/trigger.ts","line":141,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/github/validation/trigger.ts:141"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `context` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/github/validation/trigger.ts","line":160,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/github/validation/trigger.ts:160"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runnerTemp` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/github-actions-server.ts","line":235,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/github-actions-server.ts:235"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `params` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/github-actions-server.ts","line":238,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/github-actions-server.ts:238"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runnerTemp` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/github-actions-server.ts","line":238,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/github-actions-server.ts:238"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/github-file-ops-server.ts","line":177,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/github-file-ops-server.ts:177"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/mcp/github-file-ops-server.ts","line":224,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/mcp/github-file-ops-server.ts:224"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `{ fullPath, relativePath }` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/github-file-ops-server.ts","line":264,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/github-file-ops-server.ts:264"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/mcp/github-file-ops-server.ts","line":435,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/mcp/github-file-ops-server.ts:435"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `bufferPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/inline-comment-buffer.ts","line":27,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/inline-comment-buffer.ts:27"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `bufferPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/inline-comment-buffer.ts","line":31,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/inline-comment-buffer.ts:31"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `bufferPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/inline-comment-buffer.ts","line":51,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/inline-comment-buffer.ts:51"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/mcp/path-validation.ts","line":17,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/mcp/path-validation.ts:17"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/mcp/path-validation.ts","line":17,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/mcp/path-validation.ts:17"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `repoRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/path-validation.ts","line":25,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/path-validation.ts:25"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/path-validation.ts","line":31,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/path-validation.ts:31"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `repoRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/path-validation.ts","line":31,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/path-validation.ts:31"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/mcp/path-validation.ts","line":35,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/mcp/path-validation.ts:35"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/path-validation.ts","line":37,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/path-validation.ts:37"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `repoRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/mcp/path-validation.ts","line":37,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/mcp/path-validation.ts:37"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/modes/agent/parse-tools.ts","line":134,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/modes/agent/parse-tools.ts:134"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"base-action/src/retry.ts","line":30,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:base-action/src/retry.ts:30"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/entrypoints/update-comment-link.ts","line":244,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/entrypoints/update-comment-link.ts:244"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/github/data/fetcher.ts","line":191,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/github/data/fetcher.ts:191"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/github/data/fetcher.ts","line":491,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/github/data/fetcher.ts:491"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/github/data/fetcher.ts","line":517,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/github/data/fetcher.ts:517"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/github/data/fetcher.ts","line":673,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/github/data/fetcher.ts:673"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/github/operations/branch-cleanup.ts","line":166,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/github/operations/branch-cleanup.ts:166"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/github/utils/image-downloader.ts","line":272,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/github/utils/image-downloader.ts:272"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/github/utils/image-downloader.ts","line":283,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/github/utils/image-downloader.ts:283"}],"evidence":[],"data":{"rulesets":["typescript","javascript","python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":18.0,"vulnerabilities":113.0,"vulns_critical":2.0,"vulns_high":32.0,"vulns_medium":68.0,"vulns_low":11.0,"vulns_unknown":0.0,"penalty":138.0},"findings":[{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-pqg4-j6r4-53mv","severity":"critical","message":"shell-quote@1.8.4 (npm) is affected by GHSA-pqg4-j6r4-53mv; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"shell-quote@1.8.4 (npm):GHSA-pqg4-j6r4-53mv"},{"rule_id":"osv/GHSA-x8mw-p69m-v3mx","severity":"high","message":"@fastify/busboy@2.1.1 (npm) is affected by GHSA-x8mw-p69m-v3mx; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"@fastify/busboy@2.1.1 (npm):GHSA-x8mw-p69m-v3mx"},{"rule_id":"osv/GHSA-22jm-h49p-29qw","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-22jm-h49p-29qw","path":"base-action/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-22jm-h49p-29qw"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-46jr-4wx8-v453","path":"base-action/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"base-action/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-f897-62hf-6gxq","path":"base-action/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.2 (npm) is affected by GHSA-27r3-jxmh-p828","path":"base-action/bun.lock","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-4c8g-83qw-93j6","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-7p8r-x3mc-p8w7","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-f65p-4m7j-42xc","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-jqff-g426-hqxp","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-q3j6-qgpj-74h6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-q3j6-qgpj-74h6","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-q3j6-qgpj-74h6"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v2hh-gcrm-f6hx","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-v39h-62p7-jpjc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v39h-62p7-jpjc","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v39h-62p7-jpjc"},{"rule_id":"osv/GHSA-88fw-hqm2-52qc","severity":"high","message":"hono@4.12.9 (npm) is affected by GHSA-88fw-hqm2-52qc","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-88fw-hqm2-52qc"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@10.1.0 (npm) is affected by GHSA-mwp4-54f8-5fhr","path":"base-action/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-395f-4hp3-45gv","severity":"high","message":"shell-quote@1.8.4 (npm) is affected by GHSA-395f-4hp3-45gv; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"shell-quote@1.8.4 (npm):GHSA-395f-4hp3-45gv"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-2m5v-pch6-74hx; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-v9p9-hfj2-hcw8","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-v9p9-hfj2-hcw8; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-v9p9-hfj2-hcw8"},{"rule_id":"osv/GHSA-vrm6-8vpv-qv8q","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-vrm6-8vpv-qv8q; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-vrm6-8vpv-qv8q"},{"rule_id":"osv/GHSA-vxpw-j846-p89q","severity":"high","message":"undici@5.29.0 (npm) is affected by GHSA-vxpw-j846-p89q; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-vxpw-j846-p89q"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-345p-7cg4-v4c7","severity":"high","message":"@modelcontextprotocol/sdk@1.16.0 (npm) is affected by GHSA-345p-7cg4-v4c7","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.16.0 (npm):GHSA-345p-7cg4-v4c7"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.16.0 (npm) is affected by GHSA-46jr-4wx8-v453","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.16.0 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.16.0 (npm) is affected by GHSA-6qxp-vccf-f47h","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.16.0 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-8r9q-7v3j-jr4g","severity":"high","message":"@modelcontextprotocol/sdk@1.16.0 (npm) is affected by GHSA-8r9q-7v3j-jr4g","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.16.0 (npm):GHSA-8r9q-7v3j-jr4g"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.16.0 (npm) is affected by GHSA-f897-62hf-6gxq","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.16.0 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-w48q-cv73-mx4w","severity":"high","message":"@modelcontextprotocol/sdk@1.16.0 (npm) is affected by GHSA-w48q-cv73-mx4w","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.16.0 (npm):GHSA-w48q-cv73-mx4w"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.0 (npm) is affected by GHSA-27r3-jxmh-p828","path":"bun.lock","line":null,"fingerprint":"body-parser@2.2.0 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@4.0.4 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"bun.lock","line":null,"fingerprint":"form-data@4.0.4 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-j3q9-mxjg-w52f","severity":"high","message":"path-to-regexp@8.2.0 (npm) is affected by GHSA-j3q9-mxjg-w52f","path":"bun.lock","line":null,"fingerprint":"path-to-regexp@8.2.0 (npm):GHSA-j3q9-mxjg-w52f"},{"rule_id":"osv/GHSA-gxm5-99cw-xjw9","severity":"medium","message":"@fastify/busboy@2.1.1 (npm) is affected by GHSA-gxm5-99cw-xjw9; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"@fastify/busboy@2.1.1 (npm):GHSA-gxm5-99cw-xjw9"},{"rule_id":"osv/GHSA-92pp-h63x-v22m","severity":"medium","message":"@hono/node-server@1.19.11 (npm) is affected by GHSA-92pp-h63x-v22m","path":"base-action/bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.11 (npm):GHSA-92pp-h63x-v22m"},{"rule_id":"osv/GHSA-frvp-7c67-39w9","severity":"medium","message":"@hono/node-server@1.19.11 (npm) is affected by GHSA-frvp-7c67-39w9","path":"base-action/bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.11 (npm):GHSA-frvp-7c67-39w9"},{"rule_id":"osv/GHSA-jpvv-r467-5p4w","severity":"medium","message":"@hono/node-server@1.19.11 (npm) is affected by GHSA-jpvv-r467-5p4w","path":"base-action/bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.11 (npm):GHSA-jpvv-r467-5p4w"},{"rule_id":"osv/GHSA-rmxm-3fg6-px4f","severity":"medium","message":"@hono/node-server@1.19.11 (npm) is affected by GHSA-rmxm-3fg6-px4f","path":"base-action/bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.11 (npm):GHSA-rmxm-3fg6-px4f"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-6prh-2h8m-c8cw","path":"base-action/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-rvq5-wwqv-78pq","path":"base-action/bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-hrr3-gc8f-f4qj","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-26pp-8wgv-hjvm","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-26pp-8wgv-hjvm","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-26pp-8wgv-hjvm"},{"rule_id":"osv/GHSA-2gcr-mfcq-wcc3","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-2gcr-mfcq-wcc3","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-2gcr-mfcq-wcc3"},{"rule_id":"osv/GHSA-3hrh-pfw6-9m5x","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-3hrh-pfw6-9m5x","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-3hrh-pfw6-9m5x"},{"rule_id":"osv/GHSA-458j-xx4x-4375","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-458j-xx4x-4375","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-458j-xx4x-4375"},{"rule_id":"osv/GHSA-46wx-v44x-9hh2","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-46wx-v44x-9hh2","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-46wx-v44x-9hh2"},{"rule_id":"osv/GHSA-4h7h-rv7c-7m2v","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-4h7h-rv7c-7m2v","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-4h7h-rv7c-7m2v"},{"rule_id":"osv/GHSA-4m76-xfj5-7975","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-4m76-xfj5-7975","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-4m76-xfj5-7975"},{"rule_id":"osv/GHSA-54fx-42gc-7vw4","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-54fx-42gc-7vw4","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-54fx-42gc-7vw4"},{"rule_id":"osv/GHSA-5r4p-p66f-jhc7","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-5r4p-p66f-jhc7","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-5r4p-p66f-jhc7"},{"rule_id":"osv/GHSA-69xw-7hcm-h432","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-69xw-7hcm-h432","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-69xw-7hcm-h432"},{"rule_id":"osv/GHSA-8j4g-w8fx-2239","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-8j4g-w8fx-2239","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-8j4g-w8fx-2239"},{"rule_id":"osv/GHSA-9vqf-7f2p-gf9v","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-9vqf-7f2p-gf9v","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-9vqf-7f2p-gf9v"},{"rule_id":"osv/GHSA-crvj-82cr-hjcx","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-crvj-82cr-hjcx","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-crvj-82cr-hjcx"},{"rule_id":"osv/GHSA-f23p-vx2j-j53r","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-f23p-vx2j-j53r","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-f23p-vx2j-j53r"},{"rule_id":"osv/GHSA-f577-qrjj-4474","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-f577-qrjj-4474","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-f577-qrjj-4474"},{"rule_id":"osv/GHSA-g6gw-c38x-mqfc","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-g6gw-c38x-mqfc","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-g6gw-c38x-mqfc"},{"rule_id":"osv/GHSA-gqvv-2mrq-wpjv","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-gqvv-2mrq-wpjv","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-gqvv-2mrq-wpjv"},{"rule_id":"osv/GHSA-h7mg-cq63-vhpq","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-h7mg-cq63-vhpq","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-h7mg-cq63-vhpq"},{"rule_id":"osv/GHSA-hvrm-45r6-mjfj","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-hvrm-45r6-mjfj","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-hvrm-45r6-mjfj"},{"rule_id":"osv/GHSA-hxh3-vqpv-xpqv","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-hxh3-vqpv-xpqv","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-hxh3-vqpv-xpqv"},{"rule_id":"osv/GHSA-j6c9-x7qj-28xf","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-j6c9-x7qj-28xf","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-j6c9-x7qj-28xf"},{"rule_id":"osv/GHSA-p77w-8qqv-26rm","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-p77w-8qqv-26rm","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-p77w-8qqv-26rm"},{"rule_id":"osv/GHSA-qp7p-654g-cw7p","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-qp7p-654g-cw7p","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-qp7p-654g-cw7p"},{"rule_id":"osv/GHSA-r5rp-j6wh-rvv4","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-r5rp-j6wh-rvv4","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-r5rp-j6wh-rvv4"},{"rule_id":"osv/GHSA-rv63-4mwf-qqc2","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-rv63-4mwf-qqc2","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-rv63-4mwf-qqc2"},{"rule_id":"osv/GHSA-w62v-xxxg-mg59","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-w62v-xxxg-mg59","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-w62v-xxxg-mg59"},{"rule_id":"osv/GHSA-wgpf-jwqj-8h8p","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-wgpf-jwqj-8h8p","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-wgpf-jwqj-8h8p"},{"rule_id":"osv/GHSA-wmmm-f939-6g9c","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-wmmm-f939-6g9c","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-wmmm-f939-6g9c"},{"rule_id":"osv/GHSA-wwfh-h76j-fc44","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-wwfh-h76j-fc44","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-wwfh-h76j-fc44"},{"rule_id":"osv/GHSA-xf4j-xp2r-rqqx","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-xf4j-xp2r-rqqx","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-xf4j-xp2r-rqqx"},{"rule_id":"osv/GHSA-xgm2-5f3f-mvvc","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-xgm2-5f3f-mvvc","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-xgm2-5f3f-mvvc"},{"rule_id":"osv/GHSA-xpcf-pg52-r92g","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-xpcf-pg52-r92g","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-xpcf-pg52-r92g"},{"rule_id":"osv/GHSA-xrhx-7g5j-rcj5","severity":"medium","message":"hono@4.12.9 (npm) is affected by GHSA-xrhx-7g5j-rcj5","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-xrhx-7g5j-rcj5"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"base-action/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"base-action/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"base-action/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"base-action/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-v2v4-37r5-5v8g","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-v2v4-37r5-5v8g","path":"base-action/bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-v2v4-37r5-5v8g"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"base-action/bun.lock","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"base-action/bun.lock","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-q8mj-m7cp-5q26","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-q8mj-m7cp-5q26","path":"base-action/bun.lock","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-q8mj-m7cp-5q26"},{"rule_id":"osv/GHSA-x5fp-wj9c-mxmx","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-x5fp-wj9c-mxmx","path":"base-action/bun.lock","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-x5fp-wj9c-mxmx"},{"rule_id":"osv/GHSA-2mjp-6q6p-2qxm","severity":"medium","message":"undici@5.29.0 (npm) is affected by GHSA-2mjp-6q6p-2qxm; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-2mjp-6q6p-2qxm"},{"rule_id":"osv/GHSA-4992-7rv2-5pvq","severity":"medium","message":"undici@5.29.0 (npm) is affected by GHSA-4992-7rv2-5pvq; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-4992-7rv2-5pvq"},{"rule_id":"osv/GHSA-8xcm-r25x-g524","severity":"medium","message":"undici@5.29.0 (npm) is affected by GHSA-8xcm-r25x-g524; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-8xcm-r25x-g524"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@5.29.0 (npm) is affected by GHSA-9fm3-97px-rjf6; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-g9mf-h72j-4rw9","severity":"medium","message":"undici@5.29.0 (npm) is affected by GHSA-g9mf-h72j-4rw9; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-g9mf-h72j-4rw9"},{"rule_id":"osv/GHSA-m8rv-5g2x-5cg5","severity":"medium","message":"undici@5.29.0 (npm) is affected by GHSA-m8rv-5g2x-5cg5; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-m8rv-5g2x-5cg5"},{"rule_id":"osv/GHSA-p88m-4jfj-68fv","severity":"medium","message":"undici@5.29.0 (npm) is affected by GHSA-p88m-4jfj-68fv; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-p88m-4jfj-68fv"},{"rule_id":"osv/GHSA-v3r7-h72x-cjcm","severity":"medium","message":"undici@5.29.0 (npm) is affected by GHSA-v3r7-h72x-cjcm; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-v3r7-h72x-cjcm"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.16.0 (npm) is affected by GHSA-6prh-2h8m-c8cw","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.16.0 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.16.0 (npm) is affected by GHSA-rvq5-wwqv-78pq","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.16.0 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"bun.lock","line":null,"fingerprint":"ajv@6.12.6 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-wqch-xfxh-vrr4","severity":"medium","message":"body-parser@2.2.0 (npm) is affected by GHSA-wqch-xfxh-vrr4","path":"bun.lock","line":null,"fingerprint":"body-parser@2.2.0 (npm):GHSA-wqch-xfxh-vrr4"},{"rule_id":"osv/GHSA-27v5-c462-wpq7","severity":"medium","message":"path-to-regexp@8.2.0 (npm) is affected by GHSA-27v5-c462-wpq7","path":"bun.lock","line":null,"fingerprint":"path-to-regexp@8.2.0 (npm):GHSA-27v5-c462-wpq7"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"bun.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"bun.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-6rw7-vpxm-498p","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-6rw7-vpxm-498p","path":"bun.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-6rw7-vpxm-498p"},{"rule_id":"osv/GHSA-q8mj-m7cp-5q26","severity":"medium","message":"qs@6.14.0 (npm) is affected by GHSA-q8mj-m7cp-5q26","path":"bun.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-q8mj-m7cp-5q26"},{"rule_id":"osv/GHSA-v422-hmwv-36x6","severity":"low","message":"body-parser@2.2.2 (npm) is affected by GHSA-v422-hmwv-36x6","path":"base-action/bun.lock","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-v422-hmwv-36x6"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-333x-w4r6-6crp","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"base-action/bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-3gg2-335m-rxc6","severity":"low","message":"hono@4.12.9 (npm) is affected by GHSA-3gg2-335m-rxc6","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-3gg2-335m-rxc6"},{"rule_id":"osv/GHSA-79qm-7rj5-m7r9","severity":"low","message":"hono@4.12.9 (npm) is affected by GHSA-79qm-7rj5-m7r9","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-79qm-7rj5-m7r9"},{"rule_id":"osv/GHSA-hm8q-7f3q-5f36","severity":"low","message":"hono@4.12.9 (npm) is affected by GHSA-hm8q-7f3q-5f36","path":"base-action/bun.lock","line":null,"fingerprint":"hono@4.12.9 (npm):GHSA-hm8q-7f3q-5f36"},{"rule_id":"osv/GHSA-35p6-xmwp-9g52","severity":"low","message":"undici@5.29.0 (npm) is affected by GHSA-35p6-xmwp-9g52; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-35p6-xmwp-9g52"},{"rule_id":"osv/GHSA-g8m3-5g58-fq7m","severity":"low","message":"undici@5.29.0 (npm) is affected by GHSA-g8m3-5g58-fq7m; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-g8m3-5g58-fq7m"},{"rule_id":"osv/GHSA-r53p-7pc4-xj5r","severity":"low","message":"undici@5.29.0 (npm) is affected by GHSA-r53p-7pc4-xj5r; also in base-action/package-lock.json; also in bun.lock","path":"base-action/bun.lock","line":null,"fingerprint":"undici@5.29.0 (npm):GHSA-r53p-7pc4-xj5r"},{"rule_id":"osv/GHSA-v422-hmwv-36x6","severity":"low","message":"body-parser@2.2.0 (npm) is affected by GHSA-v422-hmwv-36x6","path":"bun.lock","line":null,"fingerprint":"body-parser@2.2.0 (npm):GHSA-v422-hmwv-36x6"},{"rule_id":"osv/GHSA-w7fw-mjwx-w883","severity":"low","message":"qs@6.14.0 (npm) is affected by GHSA-w7fw-mjwx-w883","path":"bun.lock","line":null,"fingerprint":"qs@6.14.0 (npm):GHSA-w7fw-mjwx-w883"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":14.0,"findings":85.0,"findings_high":23.0,"findings_medium":18.0,"findings_low":44.0,"penalty":276.2},"findings":[{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/ci-all.yml","line":16,"fingerprint":"excessive-permissions:.github/workflows/ci-all.yml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":14,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:14"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":16,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":31,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:31"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":44,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:44"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":46,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:46"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-review.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/claude-review.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-review.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/claude-review.yml:25"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/claude.yml","line":4,"fingerprint":"dangerous-triggers:.github/workflows/claude.yml:4"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude.yml","line":31,"fingerprint":"unpinned-uses:.github/workflows/claude.yml:31"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude.yml","line":37,"fingerprint":"unpinned-uses:.github/workflows/claude.yml:37"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/issue-triage.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/issue-triage.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/issue-triage.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/issue-triage.yml:27"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/release.yml","line":11,"fingerprint":"dangerous-triggers:.github/workflows/release.yml:11"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/test-base-action.yml","line":18,"fingerprint":"excessive-permissions:.github/workflows/test-base-action.yml:18"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/test-mcp-servers.yml","line":13,"fingerprint":"excessive-permissions:.github/workflows/test-mcp-servers.yml:13"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/test-settings.yml","line":13,"fingerprint":"excessive-permissions:.github/workflows/test-settings.yml:13"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/test-structured-output.yml","line":13,"fingerprint":"excessive-permissions:.github/workflows/test-structured-output.yml:13"},{"rule_id":"zizmor/github-env","severity":"high","message":"dangerous use of environment file [confidence low]","path":"action.yml","line":217,"fingerprint":"github-env:action.yml:217"},{"rule_id":"zizmor/github-env","severity":"high","message":"dangerous use of environment file [confidence low]","path":"base-action/action.yml","line":132,"fingerprint":"github-env:base-action/action.yml:132"},{"rule_id":"zizmor/github-env","severity":"high","message":"dangerous use of environment file [confidence low]","path":"base-action/action.yml","line":148,"fingerprint":"github-env:base-action/action.yml:148"},{"rule_id":"zizmor/github-env","severity":"high","message":"dangerous use of environment file [confidence low]","path":"base-action/action.yml","line":148,"fingerprint":"github-env:base-action/action.yml:148"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":34,"fingerprint":"artipacked:.github/workflows/release.yml:34"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":131,"fingerprint":"artipacked:.github/workflows/release.yml:131"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/sync-base-action.yml","line":21,"fingerprint":"artipacked:.github/workflows/sync-base-action.yml:21"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-base-action.yml","line":31,"fingerprint":"artipacked:.github/workflows/test-base-action.yml:31"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-base-action.yml","line":84,"fingerprint":"artipacked:.github/workflows/test-base-action.yml:84"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-custom-executables.yml","line":26,"fingerprint":"artipacked:.github/workflows/test-custom-executables.yml:26"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-mcp-servers.yml","line":26,"fingerprint":"artipacked:.github/workflows/test-mcp-servers.yml:26"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-mcp-servers.yml","line":108,"fingerprint":"artipacked:.github/workflows/test-mcp-servers.yml:108"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-settings.yml","line":26,"fingerprint":"artipacked:.github/workflows/test-settings.yml:26"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-settings.yml","line":80,"fingerprint":"artipacked:.github/workflows/test-settings.yml:80"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-settings.yml","line":117,"fingerprint":"artipacked:.github/workflows/test-settings.yml:117"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-settings.yml","line":176,"fingerprint":"artipacked:.github/workflows/test-settings.yml:176"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-structured-output.yml","line":27,"fingerprint":"artipacked:.github/workflows/test-structured-output.yml:27"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-structured-output.yml","line":90,"fingerprint":"artipacked:.github/workflows/test-structured-output.yml:90"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-structured-output.yml","line":145,"fingerprint":"artipacked:.github/workflows/test-structured-output.yml:145"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-structured-output.yml","line":208,"fingerprint":"artipacked:.github/workflows/test-structured-output.yml:208"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test-structured-output.yml","line":252,"fingerprint":"artipacked:.github/workflows/test-structured-output.yml:252"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/workflow-hardening.yml","line":19,"fingerprint":"artipacked:.github/workflows/workflow-hardening.yml:19"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/ci-all.yml","line":20,"fingerprint":"self-repository:.github/workflows/ci-all.yml:20"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/ci-all.yml","line":23,"fingerprint":"self-repository:.github/workflows/ci-all.yml:23"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/ci-all.yml","line":26,"fingerprint":"self-repository:.github/workflows/ci-all.yml:26"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/ci-all.yml","line":29,"fingerprint":"self-repository:.github/workflows/ci-all.yml:29"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/ci-all.yml","line":32,"fingerprint":"self-repository:.github/workflows/ci-all.yml:32"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/ci-all.yml","line":35,"fingerprint":"self-repository:.github/workflows/ci-all.yml:35"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":14,"fingerprint":"artipacked:.github/workflows/ci.yml:14"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":29,"fingerprint":"artipacked:.github/workflows/ci.yml:29"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":44,"fingerprint":"artipacked:.github/workflows/ci.yml:44"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/claude-review.yml","line":19,"fingerprint":"artipacked:.github/workflows/claude-review.yml:19"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/claude.yml","line":30,"fingerprint":"artipacked:.github/workflows/claude.yml:30"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/issue-triage.yml","line":21,"fingerprint":"artipacked:.github/workflows/issue-triage.yml:21"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-base-action.yml","line":35,"fingerprint":"self-repository:.github/workflows/test-base-action.yml:35"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-base-action.yml","line":96,"fingerprint":"self-repository:.github/workflows/test-base-action.yml:96"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-custom-executables.yml","line":60,"fingerprint":"self-repository:.github/workflows/test-custom-executables.yml:60"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-mcp-servers.yml","line":39,"fingerprint":"self-repository:.github/workflows/test-mcp-servers.yml:39"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-mcp-servers.yml","line":133,"fingerprint":"self-repository:.github/workflows/test-mcp-servers.yml:133"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-settings.yml","line":30,"fingerprint":"self-repository:.github/workflows/test-settings.yml:30"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-settings.yml","line":84,"fingerprint":"self-repository:.github/workflows/test-settings.yml:84"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-settings.yml","line":131,"fingerprint":"self-repository:.github/workflows/test-settings.yml:131"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-settings.yml","line":190,"fingerprint":"self-repository:.github/workflows/test-settings.yml:190"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-structured-output.yml","line":32,"fingerprint":"self-repository:.github/workflows/test-structured-output.yml:32"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-structured-output.yml","line":95,"fingerprint":"self-repository:.github/workflows/test-structured-output.yml:95"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-structured-output.yml","line":150,"fingerprint":"self-repository:.github/workflows/test-structured-output.yml:150"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-structured-output.yml","line":213,"fingerprint":"self-repository:.github/workflows/test-structured-output.yml:213"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/test-structured-output.yml","line":257,"fingerprint":"self-repository:.github/workflows/test-structured-output.yml:257"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":60,"fingerprint":"template-injection:.github/workflows/release.yml:60"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":79,"fingerprint":"template-injection:.github/workflows/release.yml:79"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":81,"fingerprint":"template-injection:.github/workflows/release.yml:81"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":86,"fingerprint":"template-injection:.github/workflows/release.yml:86"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":145,"fingerprint":"template-injection:.github/workflows/release.yml:145"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-base-action.yml","line":45,"fingerprint":"template-injection:.github/workflows/test-base-action.yml:45"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-base-action.yml","line":46,"fingerprint":"template-injection:.github/workflows/test-base-action.yml:46"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-base-action.yml","line":106,"fingerprint":"template-injection:.github/workflows/test-base-action.yml:106"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-base-action.yml","line":107,"fingerprint":"template-injection:.github/workflows/test-base-action.yml:107"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-custom-executables.yml","line":73,"fingerprint":"template-injection:.github/workflows/test-custom-executables.yml:73"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-custom-executables.yml","line":74,"fingerprint":"template-injection:.github/workflows/test-custom-executables.yml:74"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-settings.yml","line":47,"fingerprint":"template-injection:.github/workflows/test-settings.yml:47"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-settings.yml","line":48,"fingerprint":"template-injection:.github/workflows/test-settings.yml:48"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-settings.yml","line":101,"fingerprint":"template-injection:.github/workflows/test-settings.yml:101"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-settings.yml","line":143,"fingerprint":"template-injection:.github/workflows/test-settings.yml:143"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-settings.yml","line":144,"fingerprint":"template-injection:.github/workflows/test-settings.yml:144"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-settings.yml","line":202,"fingerprint":"template-injection:.github/workflows/test-settings.yml:202"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/test-structured-output.yml","line":270,"fingerprint":"template-injection:.github/workflows/test-structured-output.yml:270"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.41,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"Security policy: docs/security.md","ref":"docs/security.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":493.0,"function_nloc":9439.0,"mean_ccn":4.82,"p90_ccn":10.0,"complex_functions":31.0,"long_functions":20.0,"many_param_functions":0.0,"risky_nloc_share":0.4101},"findings":[],"evidence":[{"kind":"complex-function","description":"fetch_pr_data in agent-approval-check/agent_approval_check.py: complexity 63, 149 lines","ref":"agent-approval-check/agent_approval_check.py","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/agent-approval-check/agent_approval_check.py#L1254","weight":1.0},{"kind":"complex-function","description":"prepareContext in src/create-prompt/index.ts: complexity 55, 215 lines","ref":"src/create-prompt/index.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/create-prompt/index.ts#L108","weight":0.9166666666666666},{"kind":"complex-function","description":"generateDefaultPrompt in src/create-prompt/index.ts: complexity 52, 250 lines","ref":"src/create-prompt/index.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/create-prompt/index.ts#L627","weight":0.8666666666666667},{"kind":"complex-function","description":"run in src/entrypoints/run.ts: complexity 43, 214 lines","ref":"src/entrypoints/run.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/entrypoints/run.ts#L164","weight":0.7166666666666667},{"kind":"complex-function","description":"checkContainsTrigger in src/github/validation/trigger.ts: complexity 39, 126 lines","ref":"src/github/validation/trigger.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/github/validation/trigger.ts#L15","weight":0.65},{"kind":"complex-function","description":"runClaudeWithSdk in base-action/src/run-claude-sdk.ts: complexity 36, 136 lines","ref":"base-action/src/run-claude-sdk.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/base-action/src/run-claude-sdk.ts#L181","weight":0.6},{"kind":"complex-function","description":"groupTurnsNaturally in src/entrypoints/format-turns.ts: complexity 34, 92 lines","ref":"src/entrypoints/format-turns.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/entrypoints/format-turns.ts#L250","weight":0.5666666666666667},{"kind":"complex-function","description":"permission_mode_problem in .github/scripts/check_workflow_hardening.py: complexity 32, 75 lines","ref":".github/scripts/check_workflow_hardening.py","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/.github/scripts/check_workflow_hardening.py#L109","weight":0.5333333333333333},{"kind":"complex-function","description":"formatGroupedContent in src/entrypoints/format-turns.ts: complexity 31, 58 lines","ref":"src/entrypoints/format-turns.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/entrypoints/format-turns.ts#L358","weight":0.5166666666666667},{"kind":"complex-function","description":"updateCommentLink in src/entrypoints/update-comment-link.ts: complexity 29, 172 lines","ref":"src/entrypoints/update-comment-link.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/entrypoints/update-comment-link.ts#L42","weight":0.48333333333333334}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":10914.0,"duplicated_lines":600.0,"duplicated_share":0.055,"files":81.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: agent-approval-check/agent_approval_check.py:202 and agent-approval-check/agent_approval_check.py:236","ref":"agent-approval-check/agent_approval_check.py","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/agent-approval-check/agent_approval_check.py#L202","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/git-add.sh:10 and scripts/git-rm.sh:9","ref":"scripts/git-add.sh","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/scripts/git-add.sh#L10","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/create-prompt/index.ts:203 and src/create-prompt/index.ts:228","ref":"src/create-prompt/index.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/create-prompt/index.ts#L203","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/entrypoints/prepare.ts:50 and src/entrypoints/run.ts:217","ref":"src/entrypoints/prepare.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/entrypoints/prepare.ts#L50","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/entrypoints/update-comment-link.ts:143 and src/github/operations/branch-cleanup.ts:76","ref":"src/entrypoints/update-comment-link.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/entrypoints/update-comment-link.ts#L143","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/entrypoints/update-comment-link.ts:232 and src/github/operations/comments/update-with-branch.ts:42","ref":"src/entrypoints/update-comment-link.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/entrypoints/update-comment-link.ts#L232","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/github/api/queries/github.ts:55 and src/github/api/queries/github.ts:127","ref":"src/github/api/queries/github.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/github/api/queries/github.ts#L55","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/github/context.ts:17 and src/github/context.ts:32","ref":"src/github/context.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/github/context.ts#L17","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/github/operations/branch.ts:307 and src/github/operations/branch.ts:325","ref":"src/github/operations/branch.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/github/operations/branch.ts#L307","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/github/utils/image-downloader.ts:126 and src/github/utils/image-downloader.ts:207","ref":"src/github/utils/image-downloader.ts","url":"https://github.com/anthropics/claude-code-action/blob/9fa68854da5fadef4ed3dce240325a0dfe251880/src/github/utils/image-downloader.ts#L126","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":12.0,"weighted_findings":8.25,"scanned_lines":15229.0,"category:best-practice":1.0,"category:correctness":11.0},"findings":[{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":".github/scripts/check_workflow_hardening.py","line":280,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:.github/scripts/check_workflow_hardening.py:280"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":".github/scripts/check_workflow_hardening.py","line":286,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:.github/scripts/check_workflow_hardening.py:286"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"agent-approval-check/agent_approval_check.py","line":832,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:agent-approval-check/agent_approval_check.py:832"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/entrypoints/post-buffered-inline-comments.ts","line":92,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/entrypoints/post-buffered-inline-comments.ts:92"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/github/operations/git-config.ts","line":135,"fingerprint":"javascript.lang.correctness.no-replaceall:src/github/operations/git-config.ts:135"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/github/operations/git-config.ts","line":135,"fingerprint":"javascript.lang.correctness.no-replaceall:src/github/operations/git-config.ts:135"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/github/operations/tool-config.ts","line":175,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/github/operations/tool-config.ts:175"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/create-prompt/index.ts","line":828,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/create-prompt/index.ts:828"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/create-prompt/index.ts","line":830,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/create-prompt/index.ts:830"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/create-prompt/index.ts","line":830,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/create-prompt/index.ts:830"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/github/operations/tool-config.ts","line":127,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/github/operations/tool-config.ts:127"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/github/operations/tool-config.ts","line":127,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/github/operations/tool-config.ts:127"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":22290.0,"source_lines":15229.0,"test_ratio":1.4637,"ci_files":14.0,"cochange_share":0.2792,"cochange_commits":265.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci-all.yml","ref":".github/workflows/ci-all.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/claude-review.yml","ref":".github/workflows/claude-review.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/claude.yml","ref":".github/workflows/claude.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/issue-triage.yml","ref":".github/workflows/issue-triage.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/non-write-users-check.yml","ref":".github/workflows/non-write-users-check.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/sync-base-action.yml","ref":".github/workflows/sync-base-action.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test-base-action.yml","ref":".github/workflows/test-base-action.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test-custom-executables.yml","ref":".github/workflows/test-custom-executables.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (bun test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (prettier)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["bun test"],"lint_commands":["prettier"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":50.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.852,"check:low_escape_density":1.0,"escapes":24.0,"escapes_per_kloc":1.639},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: base-action/tsconfig.json","ref":"base-action/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":8514.0,"other_lines":6715.0,"files_blamed":81.0,"blame_failures":0.0,"quality:ai_findings":11.0,"quality:ai_per_kloc":1.292,"quality:other_findings":1.0,"quality:other_per_kloc":0.149,"quality:ratio":8.67,"security:ai_findings":58.0,"security:ai_per_kloc":6.812,"security:other_findings":46.0,"security:other_per_kloc":6.85,"security:ratio":0.99},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}