{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:04:57.629327Z","repo":{"ref":{"host":"github.com","owner":"danielangelo1","name":"semaninha-lastfm"},"default_branch":"main","clone_url":"https://github.com/danielangelo1/semaninha-lastfm.git","html_url":"https://github.com/danielangelo1/semaninha-lastfm","description":"Site que gera uma colagem com os albuns mais ouvidos em determinado periodo de tempo no LAST FM","stars":26,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1616,"primary_language":"TypeScript","license_spdx":null,"created_at":"2023-04-13T00:04:03Z","pushed_at":"2026-11-13T19:00:46Z","security_policy_url":null,"distribution":{"owner_created_at":"2021-05-12T23:27:54Z","owner_type":"User","release_assets":[]}},"commit_sha":"e54e4aaa8ab001ef80ae33624665a73b960a66ff","profile":{"lines_by_language":{"TypeScript":4533,"JavaScript":155},"files_by_category":{"source":64,"other":21,"test":14,"config":12,"docs":4,"binary":4,"generated":1},"source_lines":3437,"test_lines":1251},"pillars":{"ai_provenance":{"score":13.0,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.1305,"suspected_share":0.0,"estimated_share":0.1305,"ai_artifacts":1.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"Explicit AI attribution on 13% of first-party code added; an estimated 13% including velocity signals."},"quality":{"score":81.6,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":100.0,"duplication":85.5,"lint":64.6,"testing":87.8,"docs":40.0,"type_safety":100.0,"process":null},"summary":"Code quality is strong: test-to-source ratio 0.36, CI runs tests; 0% of function code in complex or long functions; 3% duplicated lines. Weakest area: docs."},"security":{"score":69.9,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":93.6,"sast":75.6,"dependencies":95.1,"ci_actions":9.5,"posture":40.0,"scorecard":null},"summary":"Security posture is weak: 2 known vulnerabilities in 1 dependencies; 11 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":35.0,"checked":35.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":232.0,"attributed_commits":31.0,"attributed_commit_share":0.1336206896551724,"effective_loc":16963.0,"attributed_loc":2213.0,"attributed_loc_share":0.13046041384189117,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 29 attributed commits, 2,212 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 2 attributed commits, 1 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7ebef046cad0171643901471f621762d28a65e89","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/7ebef046cad0171643901471f621762d28a65e89","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a5de0f31edd00ecf1b2d9f4cf5195ccdbf8b64d9","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/a5de0f31edd00ecf1b2d9f4cf5195ccdbf8b64d9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1473c96d37ae4d69b00310cdc069c5ecbcf0eaae","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/1473c96d37ae4d69b00310cdc069c5ecbcf0eaae","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d80aa6bb3bd15051c0abd8177fe6e30875606500","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/d80aa6bb3bd15051c0abd8177fe6e30875606500","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"54c509d1e668ed46d86262a47be0f92f1e8bc5e6","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/54c509d1e668ed46d86262a47be0f92f1e8bc5e6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f92d499af34d3800ff2588bcf9e0202666082d17","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/f92d499af34d3800ff2588bcf9e0202666082d17","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e5a79f406518c1d65dac91924af68b2020acb2c7","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/e5a79f406518c1d65dac91924af68b2020acb2c7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7c25ae6004bbd2c56af33ea64e98e16e87eed489","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/7c25ae6004bbd2c56af33ea64e98e16e87eed489","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"abdf2c3f476b692c072d37a814540c2d001489f8","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/abdf2c3f476b692c072d37a814540c2d001489f8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8b49667301769b3551fa464b0ebe998e2bafec5e","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/8b49667301769b3551fa464b0ebe998e2bafec5e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"fdd94676a47f1657db34b2dfe9311b79da03cc10","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/fdd94676a47f1657db34b2dfe9311b79da03cc10","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"882bf96f2a1fdfa4b2143acc00d78ab8cf8cc269","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/882bf96f2a1fdfa4b2143acc00d78ab8cf8cc269","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"337484c573e94956f398ad2a90c7cb7ff62ee4c4","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/337484c573e94956f398ad2a90c7cb7ff62ee4c4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"14dbad00ab125eb2ddc333509a4e0165575299aa","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/14dbad00ab125eb2ddc333509a4e0165575299aa","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f8c2fc19e93746798d1d371e1539b74b905c83a2","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/f8c2fc19e93746798d1d371e1539b74b905c83a2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (43ae269d1b)","ref":"abe6ee961f1963d6dcd1816ac77015be7cb954b6","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/abe6ee961f1963d6dcd1816ac77015be7cb954b6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (43ae269d1b)","ref":"d55553e985c8bcf5adf77e9faf0052bd7ab938cb","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/d55553e985c8bcf5adf77e9faf0052bd7ab938cb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (43ae269d1b)","ref":"ec03a93df82c4b89cbfe376be47088b144c1919e","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/ec03a93df82c4b89cbfe376be47088b144c1919e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: on merged branch (43ae269d1b)","ref":"0922b54fa9c943c3da89056d1aefbf77658324b0","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/0922b54fa9c943c3da89056d1aefbf77658324b0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3148af8712500dda293d003bcc75a7815aa8868f","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/3148af8712500dda293d003bcc75a7815aa8868f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"38eb7c84470e954b1693b8b915bc9d6de8c8144f","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/38eb7c84470e954b1693b8b915bc9d6de8c8144f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a2682259f3a76b62899f0aec294c5e0fc9d12dc4","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/a2682259f3a76b62899f0aec294c5e0fc9d12dc4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"9e9fe437c923cd4253f1bebfddeb07efac842fbf","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/9e9fe437c923cd4253f1bebfddeb07efac842fbf","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"66cff8317e9ee620bdd33511575239bb0d72adef","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/66cff8317e9ee620bdd33511575239bb0d72adef","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"522393fbb8de4b6d9ac12c75445d2657cd15e3f2","url":"https://github.com/danielangelo1/semaninha-lastfm/commit/522393fbb8de4b6d9ac12c75445d2657cd15e3f2","weight":0.9}],"data":{"attributed_loc_by_commit":{"5ed34dc0f1ec9311662ba54386a2e7a7c441d4ab":1,"5358496b3056bc25bd74ccc580b9e2f53ffa21d9":0,"d408599fe6c4f3e014f1fcabe52f41f76a218f02":0,"c28ea9999ec7da83c0e8479f796d03a4132e1db7":0,"aa318521148c893ae32bd1262228f2e3522dc7e8":0,"d94fc1075d6001816a159355e8615b6ee4252c96":0,"522393fbb8de4b6d9ac12c75445d2657cd15e3f2":221,"66cff8317e9ee620bdd33511575239bb0d72adef":0,"9e9fe437c923cd4253f1bebfddeb07efac842fbf":220,"a2682259f3a76b62899f0aec294c5e0fc9d12dc4":62,"38eb7c84470e954b1693b8b915bc9d6de8c8144f":44,"3148af8712500dda293d003bcc75a7815aa8868f":131,"0922b54fa9c943c3da89056d1aefbf77658324b0":225,"ec03a93df82c4b89cbfe376be47088b144c1919e":67,"d55553e985c8bcf5adf77e9faf0052bd7ab938cb":40,"abe6ee961f1963d6dcd1816ac77015be7cb954b6":48,"f8c2fc19e93746798d1d371e1539b74b905c83a2":1,"14dbad00ab125eb2ddc333509a4e0165575299aa":202,"337484c573e94956f398ad2a90c7cb7ff62ee4c4":122,"882bf96f2a1fdfa4b2143acc00d78ab8cf8cc269":254,"fdd94676a47f1657db34b2dfe9311b79da03cc10":46,"8b49667301769b3551fa464b0ebe998e2bafec5e":101,"abdf2c3f476b692c072d37a814540c2d001489f8":23,"7c25ae6004bbd2c56af33ea64e98e16e87eed489":16,"e5a79f406518c1d65dac91924af68b2020acb2c7":7,"f92d499af34d3800ff2588bcf9e0202666082d17":63,"54c509d1e668ed46d86262a47be0f92f1e8bc5e6":133,"d80aa6bb3bd15051c0abd8177fe6e30875606500":0,"1473c96d37ae4d69b00310cdc069c5ecbcf0eaae":183,"a5de0f31edd00ecf1b2d9f4cf5195ccdbf8b64d9":3,"7ebef046cad0171643901471f621762d28a65e89":0},"tools":{"github-copilot":{"name":"GitHub Copilot coding agent","commits":2,"loc":1,"first_seen":1763659415,"last_seen":1782172819},"claude-code":{"name":"Claude Code","commits":29,"loc":2212,"first_seen":1791652449,"last_seen":1794590347}},"monthly":{"2023-04":{"loc":8382,"attributed_loc":0},"2023-05":{"loc":38,"attributed_loc":0},"2023-06":{"loc":3,"attributed_loc":0},"2023-09":{"loc":58,"attributed_loc":0},"2023-10":{"loc":999,"attributed_loc":0},"2023-11":{"loc":47,"attributed_loc":0},"2023-12":{"loc":0,"attributed_loc":0},"2024-03":{"loc":0,"attributed_loc":0},"2024-04":{"loc":9,"attributed_loc":0},"2024-10":{"loc":1447,"attributed_loc":0},"2025-03":{"loc":60,"attributed_loc":0},"2025-04":{"loc":0,"attributed_loc":0},"2025-07":{"loc":0,"attributed_loc":0},"2025-08":{"loc":1187,"attributed_loc":0},"2025-09":{"loc":6,"attributed_loc":0},"2025-10":{"loc":0,"attributed_loc":0},"2025-11":{"loc":1444,"attributed_loc":1},"2026-01":{"loc":50,"attributed_loc":0},"2026-02":{"loc":89,"attributed_loc":0},"2026-03":{"loc":0,"attributed_loc":0},"2026-04":{"loc":0,"attributed_loc":0},"2026-06":{"loc":519,"attributed_loc":0},"2026-07":{"loc":0,"attributed_loc":0},"2026-08":{"loc":0,"attributed_loc":0},"2026-09":{"loc":107,"attributed_loc":0},"2026-10":{"loc":527,"attributed_loc":221},"2026-11":{"loc":1991,"attributed_loc":1991}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1788613612.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".github/copilot-instructions.md (github-copilot configuration)","ref":".github/copilot-instructions.md","url":"https://github.com/danielangelo1/semaninha-lastfm/blob/e54e4aaa8ab001ef80ae33624665a73b960a66ff/.github/copilot-instructions.md","weight":0.5}],"data":{"artifacts":[{"tool":"github-copilot","path":".github/copilot-instructions.md","added_at":1788613612}],"workflows":[],"tools":["github-copilot"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":44.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":8125.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":307.2035463612856,"median_loc_per_hour":74.75,"pr_timed_units":0.0,"excluded_import_loc":7989.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["1887e22650c2e0c99d390b489beb24302f37b2fd"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":3.0,"flagged_releases":0.0,"max_loc_per_day":17.1},"findings":[],"evidence":[],"data":{"releases":[{"from":"2.0.0","to":"v2.1.0","loc":1559,"days":298.44,"loc_per_day":5.2,"flagged":false},{"from":"v2.1.0","to":"v.2.2.0","loc":1687,"days":98.6,"loc_per_day":17.1,"flagged":false},{"from":"v.2.2.0","to":"2.3.0","loc":795,"days":214.27,"loc_per_day":3.7,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":3437.0,"index":0.291,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":2.0,"per_kloc:emoji_in_code":0.582,"files:emoji_in_code":2.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":2.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"src/constants/index.ts","line":79,"fingerprint":"src/constants/index.ts:generic-api-key:79"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"src/hooks/useNotification.ts","line":3,"fingerprint":"src/hooks/useNotification.ts:generic-api-key:3"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":11.0,"findings_high":0.0,"findings_medium":11.0,"findings_low":0.0,"weighted_findings":2.75,"scanned_lines":3437.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `attribute` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-contr [confidence low]","path":"scripts/prerender.js","line":65,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/prerender.js:65"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"scripts/prerender.js","line":65,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/prerender.js:65"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/prerender.js","line":65,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/prerender.js:65"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/prerender.js","line":74,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/prerender.js:74"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/prerender.js","line":82,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/prerender.js:82"},{"rule_id":"opengrep/javascript.browser.security.raw-html-join","severity":"medium","message":"User controlled data in a HTML string may result in XSS [confidence low]","path":"scripts/prerender.js","line":86,"fingerprint":"javascript.browser.security.raw-html-join:scripts/prerender.js:86"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/prerender.js","line":87,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/prerender.js:87"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/prerender.js","line":88,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/prerender.js:88"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/prerender.js","line":90,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/prerender.js:90"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/prerender.js","line":100,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/prerender.js:100"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/prerender.js","line":104,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/prerender.js:104"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":1.0,"vulnerabilities":2.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":2.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":3.0},"findings":[{"rule_id":"osv/GHSA-337j-9hxr-rhxg","severity":"medium","message":"react-router@6.30.6 (npm) is affected by GHSA-337j-9hxr-rhxg","path":"package-lock.json","line":null,"fingerprint":"react-router@6.30.6 (npm):GHSA-337j-9hxr-rhxg"},{"rule_id":"osv/GHSA-wrjc-x8rr-h8h6","severity":"medium","message":"react-router@6.30.6 (npm) is affected by GHSA-wrjc-x8rr-h8h6","path":"package-lock.json","line":null,"fingerprint":"react-router@6.30.6 (npm):GHSA-wrjc-x8rr-h8h6"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":18.0,"findings_high":11.0,"findings_medium":2.0,"findings_low":5.0,"penalty":141.5},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":52,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":55,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:55"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":67,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:67"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/test.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/test.yml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":49,"fingerprint":"unpinned-uses:.github/workflows/test.yml:49"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":52,"fingerprint":"unpinned-uses:.github/workflows/test.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":82,"fingerprint":"unpinned-uses:.github/workflows/test.yml:82"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":85,"fingerprint":"unpinned-uses:.github/workflows/test.yml:85"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":3,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:3"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":18,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:18"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":21,"fingerprint":"artipacked:.github/workflows/ci.yml:21"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":51,"fingerprint":"artipacked:.github/workflows/ci.yml:51"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":21,"fingerprint":"artipacked:.github/workflows/test.yml:21"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":48,"fingerprint":"artipacked:.github/workflows/test.yml:48"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":81,"fingerprint":"artipacked:.github/workflows/test.yml:81"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":1.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.15,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Dependency updates: .github/dependabot.yml","ref":".github/dependabot.yml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":222.0,"function_nloc":1927.0,"mean_ccn":1.78,"p90_ccn":4.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":2369.0,"duplicated_lines":62.0,"duplicated_share":0.0262,"files":64.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/hooks/useLocalStorage.tsx:48 and src/hooks/useLocalStorage.tsx:69","ref":"src/hooks/useLocalStorage.tsx","url":"https://github.com/danielangelo1/semaninha-lastfm/blob/e54e4aaa8ab001ef80ae33624665a73b960a66ff/src/hooks/useLocalStorage.tsx#L48","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/schemas/lastfmResponse.schema.ts:21 and src/schemas/lastfmResponse.schema.ts:30","ref":"src/schemas/lastfmResponse.schema.ts","url":"https://github.com/danielangelo1/semaninha-lastfm/blob/e54e4aaa8ab001ef80ae33624665a73b960a66ff/src/schemas/lastfmResponse.schema.ts#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/services/LastFMService.ts:4 and src/types/apiResponse.ts:2","ref":"src/services/LastFMService.ts","url":"https://github.com/danielangelo1/semaninha-lastfm/blob/e54e4aaa8ab001ef80ae33624665a73b960a66ff/src/services/LastFMService.ts#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/utils/generateCanvas.ts:42 and src/utils/generateCanvas.ts:66","ref":"src/utils/generateCanvas.ts","url":"https://github.com/danielangelo1/semaninha-lastfm/blob/e54e4aaa8ab001ef80ae33624665a73b960a66ff/src/utils/generateCanvas.ts#L42","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":6.0,"weighted_findings":6.0,"scanned_lines":3437.0,"category:best-practice":6.0},"findings":[{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/UserInput/UserInput.tsx","line":87,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/UserInput/UserInput.tsx:87"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/UserInput/UserInput.tsx","line":96,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/UserInput/UserInput.tsx:96"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/UserInput/UserInput.tsx","line":110,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/UserInput/UserInput.tsx:110"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/UserInput/UserInput.tsx","line":124,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/UserInput/UserInput.tsx:124"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/UserInput/UserInput.tsx","line":136,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/UserInput/UserInput.tsx:136"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/UserInput/UserInput.tsx","line":143,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/UserInput/UserInput.tsx:143"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.728,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":0.4604,"test_lines":1251.0,"source_lines":3437.0,"test_ratio":0.364,"ci_files":2.0,"cochange_share":0.1151,"cochange_commits":139.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm run test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (eslint, tsc --noEmit)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm run test"],"lint_commands":["eslint","tsc --noEmit"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":43.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: config/tsconfig.app.json","ref":"config/tsconfig.app.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":1512.0,"other_lines":1925.0,"files_blamed":64.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":6.0,"quality:other_per_kloc":3.117,"quality:ratio":0.0,"security:ai_findings":12.0,"security:ai_per_kloc":7.937,"security:other_findings":1.0,"security:other_per_kloc":0.519,"security:ratio":15.29},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}