{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:48:38.318954Z","repo":{"ref":{"host":"github.com","owner":"fedorananin","name":"serverus"},"default_branch":"main","clone_url":"https://github.com/fedorananin/serverus.git","html_url":"https://github.com/fedorananin/serverus","description":"SSH/SFTP/FTP/S3 connection manager for macOS/Windows/Linux — terminal, dual-pane file manager and tunnels in one window, behind a single encrypted vault unlocked with Touch ID or Windows Hello.","stars":10,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3937,"primary_language":"Rust","license_spdx":"MIT","created_at":"2026-07-13T11:48:22Z","pushed_at":"2026-10-31T08:42:19Z","security_policy_url":null,"distribution":{"owner_created_at":"2025-08-10T18:54:22Z","owner_type":"User","release_assets":[{"name":"Serverus-1.8.0-1.aarch64.rpm","size":11200595,"download_count":1,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus-1.8.0-1.aarch64.rpm"},{"name":"Serverus-1.8.0-1.x86_64.rpm","size":11646968,"download_count":1,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus-1.8.0-1.x86_64.rpm"},{"name":"Serverus_1.8.0_aarch64.AppImage","size":86678024,"download_count":1,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_aarch64.AppImage"},{"name":"Serverus_1.8.0_aarch64.dmg","size":10228907,"download_count":13,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_aarch64.dmg"},{"name":"Serverus_1.8.0_amd64.AppImage","size":88861176,"download_count":3,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_amd64.AppImage"},{"name":"Serverus_1.8.0_amd64.deb","size":11645376,"download_count":4,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_amd64.deb"},{"name":"Serverus_1.8.0_arm64.deb","size":11198392,"download_count":2,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_arm64.deb"},{"name":"Serverus_1.8.0_x64-setup.exe","size":8377735,"download_count":2,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_x64-setup.exe"},{"name":"Serverus_1.8.0_x64_en-US.msi","size":12075008,"download_count":1,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":10003703,"download_count":1,"release_tag":"v1.8.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_aarch64.app.tar.gz"},{"name":"Serverus-1.7.0-1.aarch64.rpm","size":11161960,"download_count":1,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus-1.7.0-1.aarch64.rpm"},{"name":"Serverus-1.7.0-1.x86_64.rpm","size":11613094,"download_count":1,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus-1.7.0-1.x86_64.rpm"},{"name":"Serverus_1.7.0_aarch64.AppImage","size":86600200,"download_count":2,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus_1.7.0_aarch64.AppImage"},{"name":"Serverus_1.7.0_aarch64.dmg","size":10192968,"download_count":6,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus_1.7.0_aarch64.dmg"},{"name":"Serverus_1.7.0_amd64.AppImage","size":88869368,"download_count":2,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus_1.7.0_amd64.AppImage"},{"name":"Serverus_1.7.0_amd64.deb","size":11612736,"download_count":1,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus_1.7.0_amd64.deb"},{"name":"Serverus_1.7.0_arm64.deb","size":11160746,"download_count":2,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus_1.7.0_arm64.deb"},{"name":"Serverus_1.7.0_x64-setup.exe","size":8350378,"download_count":1,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus_1.7.0_x64-setup.exe"},{"name":"Serverus_1.7.0_x64_en-US.msi","size":12025856,"download_count":1,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus_1.7.0_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":9971540,"download_count":1,"release_tag":"v1.7.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.7.0/Serverus_aarch64.app.tar.gz"},{"name":"Serverus-1.6.4-1.x86_64.rpm","size":11601190,"download_count":1,"release_tag":"v1.6.4","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.4/Serverus-1.6.4-1.x86_64.rpm"},{"name":"Serverus_1.6.4_aarch64.dmg","size":10182995,"download_count":3,"release_tag":"v1.6.4","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.4/Serverus_1.6.4_aarch64.dmg"},{"name":"Serverus_1.6.4_amd64.AppImage","size":88832504,"download_count":2,"release_tag":"v1.6.4","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.4/Serverus_1.6.4_amd64.AppImage"},{"name":"Serverus_1.6.4_amd64.deb","size":11601050,"download_count":1,"release_tag":"v1.6.4","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.4/Serverus_1.6.4_amd64.deb"},{"name":"Serverus_1.6.4_x64-setup.exe","size":8343012,"download_count":1,"release_tag":"v1.6.4","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.4/Serverus_1.6.4_x64-setup.exe"},{"name":"Serverus_1.6.4_x64_en-US.msi","size":12013568,"download_count":1,"release_tag":"v1.6.4","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.4/Serverus_1.6.4_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":9959852,"download_count":1,"release_tag":"v1.6.4","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.4/Serverus_aarch64.app.tar.gz"},{"name":"Serverus-1.6.3-1.x86_64.rpm","size":11603765,"download_count":1,"release_tag":"v1.6.3","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.3/Serverus-1.6.3-1.x86_64.rpm"},{"name":"Serverus_1.6.3_aarch64.dmg","size":10184883,"download_count":2,"release_tag":"v1.6.3","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.3/Serverus_1.6.3_aarch64.dmg"},{"name":"Serverus_1.6.3_amd64.AppImage","size":88840696,"download_count":3,"release_tag":"v1.6.3","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.3/Serverus_1.6.3_amd64.AppImage"},{"name":"Serverus_1.6.3_amd64.deb","size":11603160,"download_count":1,"release_tag":"v1.6.3","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.3/Serverus_1.6.3_amd64.deb"},{"name":"Serverus_1.6.3_x64-setup.exe","size":8343852,"download_count":1,"release_tag":"v1.6.3","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.3/Serverus_1.6.3_x64-setup.exe"},{"name":"Serverus_1.6.3_x64_en-US.msi","size":12009472,"download_count":1,"release_tag":"v1.6.3","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.3/Serverus_1.6.3_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":9959966,"download_count":2,"release_tag":"v1.6.3","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.3/Serverus_aarch64.app.tar.gz"},{"name":"Serverus-1.6.2-1.x86_64.rpm","size":11600069,"download_count":1,"release_tag":"v1.6.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.2/Serverus-1.6.2-1.x86_64.rpm"},{"name":"Serverus_1.6.2_aarch64.dmg","size":10286865,"download_count":4,"release_tag":"v1.6.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.2/Serverus_1.6.2_aarch64.dmg"},{"name":"Serverus_1.6.2_amd64.AppImage","size":88832504,"download_count":2,"release_tag":"v1.6.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.2/Serverus_1.6.2_amd64.AppImage"},{"name":"Serverus_1.6.2_amd64.deb","size":11597104,"download_count":1,"release_tag":"v1.6.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.2/Serverus_1.6.2_amd64.deb"},{"name":"Serverus_1.6.2_x64-setup.exe","size":8344289,"download_count":1,"release_tag":"v1.6.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.2/Serverus_1.6.2_x64-setup.exe"},{"name":"Serverus_1.6.2_x64_en-US.msi","size":12013568,"download_count":1,"release_tag":"v1.6.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.2/Serverus_1.6.2_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":10063814,"download_count":2,"release_tag":"v1.6.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.2/Serverus_aarch64.app.tar.gz"},{"name":"Serverus-1.6.1-1.x86_64.rpm","size":11579305,"download_count":1,"release_tag":"v1.6.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.1/Serverus-1.6.1-1.x86_64.rpm"},{"name":"Serverus_1.6.1_aarch64.dmg","size":10265167,"download_count":2,"release_tag":"v1.6.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.1/Serverus_1.6.1_aarch64.dmg"},{"name":"Serverus_1.6.1_amd64.AppImage","size":88869368,"download_count":2,"release_tag":"v1.6.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.1/Serverus_1.6.1_amd64.AppImage"},{"name":"Serverus_1.6.1_amd64.deb","size":11577150,"download_count":1,"release_tag":"v1.6.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.1/Serverus_1.6.1_amd64.deb"},{"name":"Serverus_1.6.1_x64-setup.exe","size":8332447,"download_count":1,"release_tag":"v1.6.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.1/Serverus_1.6.1_x64-setup.exe"},{"name":"Serverus_1.6.1_x64_en-US.msi","size":11997184,"download_count":1,"release_tag":"v1.6.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.1/Serverus_1.6.1_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":10037783,"download_count":2,"release_tag":"v1.6.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.1/Serverus_aarch64.app.tar.gz"},{"name":"Serverus-1.6.0-1.x86_64.rpm","size":11578045,"download_count":1,"release_tag":"v1.6.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.0/Serverus-1.6.0-1.x86_64.rpm"},{"name":"Serverus_1.6.0_aarch64.dmg","size":10285233,"download_count":4,"release_tag":"v1.6.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.0/Serverus_1.6.0_aarch64.dmg"},{"name":"Serverus_1.6.0_amd64.AppImage","size":88828408,"download_count":3,"release_tag":"v1.6.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.0/Serverus_1.6.0_amd64.AppImage"},{"name":"Serverus_1.6.0_amd64.deb","size":11577876,"download_count":1,"release_tag":"v1.6.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.0/Serverus_1.6.0_amd64.deb"},{"name":"Serverus_1.6.0_x64-setup.exe","size":8312601,"download_count":2,"release_tag":"v1.6.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.0/Serverus_1.6.0_x64-setup.exe"},{"name":"Serverus_1.6.0_x64_en-US.msi","size":11976704,"download_count":1,"release_tag":"v1.6.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.0/Serverus_1.6.0_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":10059411,"download_count":1,"release_tag":"v1.6.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.6.0/Serverus_aarch64.app.tar.gz"},{"name":"Serverus-1.5.1-1.x86_64.rpm","size":11093400,"download_count":1,"release_tag":"v1.5.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.1/Serverus-1.5.1-1.x86_64.rpm"},{"name":"Serverus_1.5.1_aarch64.dmg","size":9834414,"download_count":3,"release_tag":"v1.5.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.1/Serverus_1.5.1_aarch64.dmg"},{"name":"Serverus_1.5.1_amd64.AppImage","size":88418808,"download_count":2,"release_tag":"v1.5.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.1/Serverus_1.5.1_amd64.AppImage"},{"name":"Serverus_1.5.1_amd64.deb","size":11093252,"download_count":1,"release_tag":"v1.5.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.1/Serverus_1.5.1_amd64.deb"},{"name":"Serverus_1.5.1_x64-setup.exe","size":8248697,"download_count":1,"release_tag":"v1.5.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.1/Serverus_1.5.1_x64-setup.exe"},{"name":"Serverus_1.5.1_x64_en-US.msi","size":11857920,"download_count":1,"release_tag":"v1.5.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.1/Serverus_1.5.1_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":9619213,"download_count":1,"release_tag":"v1.5.1","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.1/Serverus_aarch64.app.tar.gz"},{"name":"Serverus-1.5.0-1.x86_64.rpm","size":11093801,"download_count":5,"release_tag":"v1.5.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.0/Serverus-1.5.0-1.x86_64.rpm"},{"name":"Serverus_1.5.0_aarch64.dmg","size":9835996,"download_count":5,"release_tag":"v1.5.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.0/Serverus_1.5.0_aarch64.dmg"},{"name":"Serverus_1.5.0_amd64.AppImage","size":88414712,"download_count":5,"release_tag":"v1.5.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.0/Serverus_1.5.0_amd64.AppImage"},{"name":"Serverus_1.5.0_amd64.deb","size":11093658,"download_count":4,"release_tag":"v1.5.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.0/Serverus_1.5.0_amd64.deb"},{"name":"Serverus_1.5.0_x64-setup.exe","size":8244786,"download_count":4,"release_tag":"v1.5.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.0/Serverus_1.5.0_x64-setup.exe"},{"name":"Serverus_1.5.0_x64_en-US.msi","size":11857920,"download_count":4,"release_tag":"v1.5.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.0/Serverus_1.5.0_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":9620288,"download_count":10,"release_tag":"v1.5.0","url":"https://github.com/fedorananin/serverus/releases/download/v1.5.0/Serverus_aarch64.app.tar.gz"},{"name":"Serverus-1.4.2-1.x86_64.rpm","size":11009707,"download_count":2,"release_tag":"v1.4.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.4.2/Serverus-1.4.2-1.x86_64.rpm"},{"name":"Serverus_1.4.2_aarch64.dmg","size":9773865,"download_count":4,"release_tag":"v1.4.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.4.2/Serverus_1.4.2_aarch64.dmg"},{"name":"Serverus_1.4.2_amd64.AppImage","size":87718392,"download_count":3,"release_tag":"v1.4.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.4.2/Serverus_1.4.2_amd64.AppImage"},{"name":"Serverus_1.4.2_amd64.deb","size":11009468,"download_count":2,"release_tag":"v1.4.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.4.2/Serverus_1.4.2_amd64.deb"},{"name":"Serverus_1.4.2_x64-setup.exe","size":8186112,"download_count":7,"release_tag":"v1.4.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.4.2/Serverus_1.4.2_x64-setup.exe"},{"name":"Serverus_1.4.2_x64_en-US.msi","size":11763712,"download_count":2,"release_tag":"v1.4.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.4.2/Serverus_1.4.2_x64_en-US.msi"},{"name":"Serverus_aarch64.app.tar.gz","size":9551584,"download_count":2,"release_tag":"v1.4.2","url":"https://github.com/fedorananin/serverus/releases/download/v1.4.2/Serverus_aarch64.app.tar.gz"}]}},"commit_sha":"bd63ae972529dd35d4c70178b5ba8c868dceceb5","profile":{"lines_by_language":{"Rust":40258,"TypeScript":14992,"Svelte":8036,"JavaScript":1103},"files_by_category":{"source":406,"test":170,"binary":52,"docs":26,"config":22,"other":5,"generated":2},"source_lines":45901,"test_lines":18488},"pillars":{"ai_provenance":{"score":5.4,"confidence":0.92,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0537,"suspected_share":0.1335,"estimated_share":0.0537,"ai_artifacts":2.0,"flagged_work_units":4.0,"flagged_releases":1.0},"summary":"Explicit AI attribution on 5% of first-party code added; an estimated 5% including velocity signals."},"quality":{"score":85.1,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":79.3,"duplication":78.5,"lint":91.3,"testing":95.1,"docs":65.0,"type_safety":100.0,"process":null},"summary":"Code quality is strong: test-to-source ratio 0.40, CI runs tests; 8% of function code in complex or long functions; 4% duplicated lines. Weakest area: docs."},"security":{"score":49.8,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":100.0,"sast":94.3,"dependencies":1.9,"ci_actions":3.8,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 137 known vulnerabilities in 48 dependencies; 1 high-severity SAST findings; 18 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":75.0,"checked":75.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":89.0,"attributed_commits":19.0,"attributed_commit_share":0.21348314606741572,"effective_loc":77349.0,"attributed_loc":4152.0,"attributed_loc_share":0.05367878059186285,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"OpenAI Codex: 12 attributed commits, 3,123 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 7 attributed commits, 1,029 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"28032c50af0481d61da66fcdb7ea5dcbf24f36fe","url":"https://github.com/fedorananin/serverus/commit/28032c50af0481d61da66fcdb7ea5dcbf24f36fe","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"40af17b139f7fe09bb9bb059a8d3e44556ed40f1","url":"https://github.com/fedorananin/serverus/commit/40af17b139f7fe09bb9bb059a8d3e44556ed40f1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e5a4fc732d6225159262c38ff141d3ff5845799c","url":"https://github.com/fedorananin/serverus/commit/e5a4fc732d6225159262c38ff141d3ff5845799c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5fb78e948923fa15858f06ac8e39b954fec12752","url":"https://github.com/fedorananin/serverus/commit/5fb78e948923fa15858f06ac8e39b954fec12752","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"af7f2ab5d8d9aa862ca41e001387e61a44900505","url":"https://github.com/fedorananin/serverus/commit/af7f2ab5d8d9aa862ca41e001387e61a44900505","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"28e6bf94e42b59f45795d77ba4a5292c4db21dc1","url":"https://github.com/fedorananin/serverus/commit/28e6bf94e42b59f45795d77ba4a5292c4db21dc1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e515a5330a62888985d41d80199903be4b9f49cd","url":"https://github.com/fedorananin/serverus/commit/e515a5330a62888985d41d80199903be4b9f49cd","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (3e36c1f650)","ref":"3abdb25d5ae931b2701cb1eb69917fad338f671e","url":"https://github.com/fedorananin/serverus/commit/3abdb25d5ae931b2701cb1eb69917fad338f671e","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (301a8a6d38)","ref":"011c2e53750a8dedec96fd0471c754e96c8d23fc","url":"https://github.com/fedorananin/serverus/commit/011c2e53750a8dedec96fd0471c754e96c8d23fc","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (8d28e43d01)","ref":"746b0b2a228bf86677f698df0ff6468f9a73eb61","url":"https://github.com/fedorananin/serverus/commit/746b0b2a228bf86677f698df0ff6468f9a73eb61","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (46101373b5)","ref":"7d69c16cfc9ccee9aff96608dd954271955598b3","url":"https://github.com/fedorananin/serverus/commit/7d69c16cfc9ccee9aff96608dd954271955598b3","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (1347400ddc)","ref":"35961f91851e81df74535f9240c718c8ab52020d","url":"https://github.com/fedorananin/serverus/commit/35961f91851e81df74535f9240c718c8ab52020d","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (ed1e25e040)","ref":"d747a2c957b7af2f0aff900e65674f37d84c57ff","url":"https://github.com/fedorananin/serverus/commit/d747a2c957b7af2f0aff900e65674f37d84c57ff","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (3d1b353be5)","ref":"d5c87539483c11465a99d9dd415a4ff0d4a5f4ef","url":"https://github.com/fedorananin/serverus/commit/d5c87539483c11465a99d9dd415a4ff0d4a5f4ef","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (60ffc77a6b)","ref":"906558364ca1d4e25a094c345977de1f1913bd43","url":"https://github.com/fedorananin/serverus/commit/906558364ca1d4e25a094c345977de1f1913bd43","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (cf5e673c68)","ref":"3bd0a1a9ebcac6faac0b009545775eb0ddb07a82","url":"https://github.com/fedorananin/serverus/commit/3bd0a1a9ebcac6faac0b009545775eb0ddb07a82","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (95800b9f81)","ref":"987684a21ed2a86243f3c3f0c526a665971877ab","url":"https://github.com/fedorananin/serverus/commit/987684a21ed2a86243f3c3f0c526a665971877ab","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (eba8c8f793)","ref":"c61accd6b838c343cb5c7fdfd42297743b83a6d3","url":"https://github.com/fedorananin/serverus/commit/c61accd6b838c343cb5c7fdfd42297743b83a6d3","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (4f371b6957)","ref":"ef5d8dbaf3d06baa19900847b7d32d00f04f1ddd","url":"https://github.com/fedorananin/serverus/commit/ef5d8dbaf3d06baa19900847b7d32d00f04f1ddd","weight":0.9}],"data":{"attributed_loc_by_commit":{"ef5d8dbaf3d06baa19900847b7d32d00f04f1ddd":141,"c61accd6b838c343cb5c7fdfd42297743b83a6d3":196,"987684a21ed2a86243f3c3f0c526a665971877ab":230,"3bd0a1a9ebcac6faac0b009545775eb0ddb07a82":464,"906558364ca1d4e25a094c345977de1f1913bd43":139,"d5c87539483c11465a99d9dd415a4ff0d4a5f4ef":732,"d747a2c957b7af2f0aff900e65674f37d84c57ff":319,"35961f91851e81df74535f9240c718c8ab52020d":272,"7d69c16cfc9ccee9aff96608dd954271955598b3":95,"746b0b2a228bf86677f698df0ff6468f9a73eb61":146,"011c2e53750a8dedec96fd0471c754e96c8d23fc":249,"3abdb25d5ae931b2701cb1eb69917fad338f671e":140,"e515a5330a62888985d41d80199903be4b9f49cd":549,"28e6bf94e42b59f45795d77ba4a5292c4db21dc1":0,"af7f2ab5d8d9aa862ca41e001387e61a44900505":194,"5fb78e948923fa15858f06ac8e39b954fec12752":0,"e5a4fc732d6225159262c38ff141d3ff5845799c":11,"40af17b139f7fe09bb9bb059a8d3e44556ed40f1":275,"28032c50af0481d61da66fcdb7ea5dcbf24f36fe":0},"tools":{"openai-codex":{"name":"OpenAI Codex","commits":12,"loc":3123,"first_seen":1784039563,"last_seen":1784047261},"claude-code":{"name":"Claude Code","commits":7,"loc":1029,"first_seen":1784060882,"last_seen":1790197451}},"monthly":{"2026-07":{"loc":58018,"attributed_loc":3877},"2026-08":{"loc":1918,"attributed_loc":0},"2026-09":{"loc":13796,"attributed_loc":275},"2026-10":{"loc":3617,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1783944264.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1783944264},{"tool":"generic-agent","path":"AGENTS.md","added_at":1784136077}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":30.0,"flagged_units":4.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":25391.0,"flagged_loc":11547.0,"flagged_loc_share":0.45476743728092633,"max_loc_per_hour":1341.952309985097,"median_loc_per_hour":241.75824175824178,"pr_timed_units":0.0,"excluded_import_loc":51958.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"4,002 lines of first-party code in ~3.0h (1,342 lines/hour, 6 commit session)","ref":"ad5dadaea61aa57c0e8adac808f899e511fb438c","url":"https://github.com/fedorananin/serverus/commit/ad5dadaea61aa57c0e8adac808f899e511fb438c","weight":0.4025856929955291},{"kind":"velocity-burst","description":"3,849 lines of first-party code in ~4.5h (855 lines/hour, 4 commit session)","ref":"69be4d79b764f59f3ae56ffb7ee48a57c80005f9","url":"https://github.com/fedorananin/serverus/commit/69be4d79b764f59f3ae56ffb7ee48a57c80005f9","weight":0.2565683248981607},{"kind":"velocity-burst","description":"1,221 lines of first-party code in ~1.9h (638 lines/hour, 6 commit session)","ref":"3abdb25d5ae931b2701cb1eb69917fad338f671e","url":"https://github.com/fedorananin/serverus/commit/3abdb25d5ae931b2701cb1eb69917fad338f671e","weight":0.19139042089985486},{"kind":"velocity-burst","description":"2,475 lines of first-party code in ~4.3h (573 lines/hour, 2 commit session)","ref":"d021143a119aa0b4c528ad0ba5824c5a3292ff39","url":"https://github.com/fedorananin/serverus/commit/d021143a119aa0b4c528ad0ba5824c5a3292ff39","weight":0.17184185149469622}],"data":{"flagged_loc_by_commit":{"5c36f505f8fd5f92a6f973f84daa53b773f0bcd5":2472,"d021143a119aa0b4c528ad0ba5824c5a3292ff39":3,"d747a2c957b7af2f0aff900e65674f37d84c57ff":319,"35961f91851e81df74535f9240c718c8ab52020d":272,"7d69c16cfc9ccee9aff96608dd954271955598b3":95,"746b0b2a228bf86677f698df0ff6468f9a73eb61":146,"011c2e53750a8dedec96fd0471c754e96c8d23fc":249,"3abdb25d5ae931b2701cb1eb69917fad338f671e":140,"cacd5741701b1d0aefe906bc6fa12aae17fcbd50":2844,"dcc923918d1c85fcc7e1709c9303df2ca0c6d6c9":980,"fda7aa6b24d8c0575e69255178d1d0360c0d1ee4":17,"69be4d79b764f59f3ae56ffb7ee48a57c80005f9":8,"86a1aade10e058604521ad12f87bac6c659efd65":1862,"c8657ecfcaf63cda3cc68a472bb5ce200d57f129":1161,"21c2aac0e283fdbcc4ae5e587ab4c69a561dfe49":71,"4956128ca3aed3e10a8204dad4b2edf324e44296":1,"9ddc48a00d9524d5b86a0489ff1bfc88ffff82d6":898,"ad5dadaea61aa57c0e8adac808f899e511fb438c":9},"excluded_import_commits":["24eaa1046f213ed6a33186382e34d54ac09eb141","75180b61e2f1a341dc5abd086bdb5126bb4d7628","c933dd05bdd7aa33cc0da6841a99b5b12ac38e19","e674f144090a6ba4a033412b3e4eafe1b54f58a0","f3ae72749f85b742091c8c91974a5ce4bbc71877"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":21.0,"flagged_releases":1.0,"max_loc_per_day":10685.0},"findings":[],"evidence":[{"kind":"release-burst","description":"v1.1.2 → v1.2.0: 8,691 lines in 0.81 days (10,685.0 lines/day)","ref":"v1.1.2...v1.2.0","url":"https://github.com/fedorananin/serverus/compare/v1.1.2...v1.2.0","weight":0.4}],"data":{"releases":[{"from":"v1.0.0","to":"v1.1.0","loc":1312,"days":0.34,"loc_per_day":3803.3,"flagged":false},{"from":"v1.1.0","to":"v1.1.1","loc":3672,"days":1.02,"loc_per_day":3611.8,"flagged":false},{"from":"v1.1.1","to":"v1.1.2","loc":205,"days":0.62,"loc_per_day":329.8,"flagged":false},{"from":"v1.1.2","to":"v1.2.0","loc":8691,"days":0.81,"loc_per_day":10685.0,"flagged":true},{"from":"v1.2.0","to":"v1.2.1","loc":827,"days":0.11,"loc_per_day":7501.6,"flagged":false},{"from":"v1.2.1","to":"v1.2.2","loc":181,"days":0.08,"loc_per_day":2348.1,"flagged":false},{"from":"v1.2.2","to":"v1.2.3","loc":208,"days":0.43,"loc_per_day":487.8,"flagged":false},{"from":"v1.2.3","to":"v1.2.4","loc":421,"days":2.04,"loc_per_day":206.4,"flagged":false},{"from":"v1.2.4","to":"v1.3.0","loc":1534,"days":7.91,"loc_per_day":193.9,"flagged":false},{"from":"v1.3.0","to":"v1.4.0","loc":1776,"days":9.64,"loc_per_day":184.3,"flagged":false},{"from":"v1.4.0","to":"v1.4.1","loc":136,"days":6.22,"loc_per_day":21.9,"flagged":false},{"from":"v1.4.1","to":"v1.4.2","loc":6,"days":18.17,"loc_per_day":0.3,"flagged":false},{"from":"v1.4.2","to":"v1.5.0","loc":2472,"days":24.92,"loc_per_day":99.2,"flagged":false},{"from":"v1.5.0","to":"v1.5.1","loc":278,"days":0.06,"loc_per_day":4371.9,"flagged":false},{"from":"v1.5.1","to":"v1.6.0","loc":55,"days":5.61,"loc_per_day":9.8,"flagged":false},{"from":"v1.6.0","to":"v1.6.1","loc":5,"days":22.29,"loc_per_day":0.2,"flagged":false},{"from":"v1.6.1","to":"v1.6.2","loc":92,"days":0.14,"loc_per_day":648.1,"flagged":false},{"from":"v1.6.2","to":"v1.6.3","loc":0,"days":1.59,"loc_per_day":0.0,"flagged":false},{"from":"v1.6.3","to":"v1.6.4","loc":324,"days":0.43,"loc_per_day":757.6,"flagged":false},{"from":"v1.6.4","to":"v1.7.0","loc":578,"days":1.53,"loc_per_day":376.7,"flagged":false},{"from":"v1.7.0","to":"v1.8.0","loc":2617,"days":5.87,"loc_per_day":445.6,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":45901.0,"index":0.272,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":25.0,"per_kloc:emoji_in_code":0.545,"files:emoji_in_code":17.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":29.0,"findings_high":1.0,"findings_medium":14.0,"findings_low":14.0,"weighted_findings":7.75,"scanned_lines":45901.0,"parse_errors":4.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.spawn-shell-true","severity":"high","message":"Found '$SPAWN' with '{shell: process.platform === 'win32'}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]","path":"scripts/with-signing-env.mjs","line":38,"fingerprint":"javascript.lang.security.audit.spawn-shell-true:scripts/with-signing-env.mjs:38"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts","line":12,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts:12"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts","line":12,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts:12"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts","line":54,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts:54"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts","line":54,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts:54"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts","line":60,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/scenarios/transfer-resilience/transfer-resilience.support.ts:60"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^@[a-z0-9]+(?:-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library  [confidence low]","path":"e2e-scenarios/src/scenario-reporter.ts","line":38,"fingerprint":"javascript.lang.security.audit.detect-redos:e2e-scenarios/src/scenario-reporter.ts:38"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/support/connections.ts","line":89,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/support/connections.ts:89"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/support/connections.ts","line":93,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/support/connections.ts:93"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/support/files.ts","line":5,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/support/files.ts:5"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/support/files.ts","line":5,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/support/files.ts:5"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/support/files.ts","line":29,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/support/files.ts:29"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/support/files.ts","line":29,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/support/files.ts:29"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/support/files.ts","line":30,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/support/files.ts:30"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"e2e-scenarios/support/files.ts","line":39,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:e2e-scenarios/support/files.ts:39"},{"rule_id":"opengrep/rust.lang.security.args-os","severity":"low","message":"args_os should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"crates/serverus-e2e-fixtures/src/main.rs","line":13,"fingerprint":"rust.lang.security.args-os:crates/serverus-e2e-fixtures/src/main.rs:13"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"crates/serverus-e2e-fixtures/src/main.rs","line":17,"fingerprint":"rust.lang.security.current-exe:crates/serverus-e2e-fixtures/src/main.rs:17"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"src-tauri/src/agent/hub.rs","line":103,"fingerprint":"rust.lang.security.current-exe:src-tauri/src/agent/hub.rs:103"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"src-tauri/src/agent/shim.rs","line":93,"fingerprint":"rust.lang.security.current-exe:src-tauri/src/agent/shim.rs:93"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"src-tauri/src/agent/tools/queue.rs","line":38,"fingerprint":"rust.lang.security.temp-dir:src-tauri/src/agent/tools/queue.rs:38"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src-tauri/src/app_config.rs","line":116,"fingerprint":"rust.lang.security.unsafe-usage:src-tauri/src/app_config.rs:116"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"src-tauri/src/commands/local_copy.rs","line":11,"fingerprint":"rust.lang.security.temp-dir:src-tauri/src/commands/local_copy.rs:11"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"src-tauri/src/main.rs","line":7,"fingerprint":"rust.lang.security.args:src-tauri/src/main.rs:7"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src-tauri/src/vault/quick_unlock.rs","line":85,"fingerprint":"rust.lang.security.unsafe-usage:src-tauri/src/vault/quick_unlock.rs:85"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src-tauri/src/vault/quick_unlock.rs","line":86,"fingerprint":"rust.lang.security.unsafe-usage:src-tauri/src/vault/quick_unlock.rs:86"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src-tauri/src/vault/quick_unlock.rs","line":96,"fingerprint":"rust.lang.security.unsafe-usage:src-tauri/src/vault/quick_unlock.rs:96"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src-tauri/src/vault/quick_unlock.rs","line":101,"fingerprint":"rust.lang.security.unsafe-usage:src-tauri/src/vault/quick_unlock.rs:101"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src-tauri/src/vault/quick_unlock.rs","line":108,"fingerprint":"rust.lang.security.unsafe-usage:src-tauri/src/vault/quick_unlock.rs:108"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"src-tauri/src/watcher/cache.rs","line":6,"fingerprint":"rust.lang.security.temp-dir:src-tauri/src/watcher/cache.rs:6"}],"evidence":[],"data":{"rulesets":["rust","javascript","typescript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":48.0,"vulnerabilities":137.0,"vulns_critical":1.0,"vulns_high":38.0,"vulns_medium":59.0,"vulns_low":20.0,"vulns_unknown":19.0,"penalty":239.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0482","severity":"critical","message":"cap-primitives@4.0.2 (crates.io) is affected by RUSTSEC-2026-0482","path":"Cargo.lock","line":null,"fingerprint":"cap-primitives@4.0.2 (crates.io):RUSTSEC-2026-0482"},{"rule_id":"osv/GHSA-47hw-gvq5-r2gm","severity":"high","message":"russh@0.62.2 (crates.io) is affected by RUSTSEC-2026-0492, GHSA-47hw-gvq5-r2gm","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-47hw-gvq5-r2gm"},{"rule_id":"osv/GHSA-vp5q-ff62-jwqv","severity":"high","message":"russh@0.62.2 (crates.io) is affected by RUSTSEC-2026-0495, GHSA-vp5q-ff62-jwqv","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-vp5q-ff62-jwqv"},{"rule_id":"osv/GHSA-82j2-j2ch-gfr8","severity":"high","message":"rustls-webpki@0.101.7 (crates.io) is affected by RUSTSEC-2026-0104, GHSA-82j2-j2ch-gfr8","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.101.7 (crates.io):GHSA-82j2-j2ch-gfr8"},{"rule_id":"osv/GHSA-c475-qrg2-pj4r","severity":"high","message":"basic-ftp@5.3.1 (npm) is affected by GHSA-c475-qrg2-pj4r","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.3.1 (npm):GHSA-c475-qrg2-pj4r"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-ggr8-5vv4-36mx","severity":"high","message":"deepmerge-ts@7.1.5 (npm) is affected by GHSA-ggr8-5vv4-36mx","path":"package-lock.json","line":null,"fingerprint":"deepmerge-ts@7.1.5 (npm):GHSA-ggr8-5vv4-36mx"},{"rule_id":"osv/GHSA-j22f-vq7h-c4qm","severity":"high","message":"devalue@5.8.1 (npm) is affected by GHSA-j22f-vq7h-c4qm","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-j22f-vq7h-c4qm"},{"rule_id":"osv/GHSA-mcm9-63f2-9j32","severity":"high","message":"devalue@5.8.1 (npm) is affected by GHSA-mcm9-63f2-9j32","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-mcm9-63f2-9j32"},{"rule_id":"osv/GHSA-r9w8-h9r3-54w4","severity":"high","message":"devalue@5.8.1 (npm) is affected by GHSA-r9w8-h9r3-54w4","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-r9w8-h9r3-54w4"},{"rule_id":"osv/GHSA-x5rw-q4pp-hg5g","severity":"high","message":"devalue@5.8.1 (npm) is affected by GHSA-x5rw-q4pp-hg5g","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-x5rw-q4pp-hg5g"},{"rule_id":"osv/GHSA-7pqw-9j4j-h8q3","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-7pqw-9j4j-h8q3","path":"package-lock.json","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-7pqw-9j4j-h8q3"},{"rule_id":"osv/GHSA-jmr9-qjv8-65gv","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-jmr9-qjv8-65gv","path":"package-lock.json","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-jmr9-qjv8-65gv"},{"rule_id":"osv/GHSA-8r6m-32jq-jx6q","severity":"high","message":"fast-xml-parser@5.10.0 (npm) is affected by GHSA-8r6m-32jq-jx6q","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@5.10.0 (npm):GHSA-8r6m-32jq-jx6q"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@10.2.0 (npm) is affected by GHSA-mwp4-54f8-5fhr","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.3.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.3.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.3.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.3.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.16 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.16 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-7w5x-hrqm-74c2","severity":"high","message":"smol-toml@1.7.0 (npm) is affected by GHSA-7w5x-hrqm-74c2","path":"package-lock.json","line":null,"fingerprint":"smol-toml@1.7.0 (npm):GHSA-7w5x-hrqm-74c2"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@6.27.0 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@6.27.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-rfgv-xxqx-mfg5","severity":"high","message":"undici@6.27.0 (npm) is affected by GHSA-rfgv-xxqx-mfg5","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-rfgv-xxqx-mfg5"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@6.27.0 (npm) is affected by GHSA-xjj6-f33q-929c","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4cwx-7wf7-3272","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-4cwx-7wf7-3272","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-4cwx-7wf7-3272"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-rfgv-xxqx-mfg5","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-rfgv-xxqx-mfg5","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-rfgv-xxqx-mfg5"},{"rule_id":"osv/GHSA-w293-vg96-wgc3","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-w293-vg96-wgc3","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-w293-vg96-wgc3"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-xjj6-f33q-929c","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@6.4.3 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/RUSTSEC-2026-0387","severity":"medium","message":"crypto-bigint@0.7.5 (crates.io) is affected by RUSTSEC-2026-0387","path":"Cargo.lock","line":null,"fingerprint":"crypto-bigint@0.7.5 (crates.io):RUSTSEC-2026-0387"},{"rule_id":"osv/RUSTSEC-2026-0385","severity":"medium","message":"ctutils@0.4.2 (crates.io) is affected by RUSTSEC-2026-0385","path":"Cargo.lock","line":null,"fingerprint":"ctutils@0.4.2 (crates.io):RUSTSEC-2026-0385"},{"rule_id":"osv/GHSA-wrw7-89jp-8q8g","severity":"medium","message":"glib@0.18.5 (crates.io) is affected by RUSTSEC-2024-0429, GHSA-wrw7-89jp-8q8g","path":"Cargo.lock","line":null,"fingerprint":"glib@0.18.5 (crates.io):GHSA-wrw7-89jp-8q8g"},{"rule_id":"osv/RUSTSEC-2026-0258","severity":"medium","message":"h2@0.3.27 (crates.io) is affected by RUSTSEC-2026-0258","path":"Cargo.lock","line":null,"fingerprint":"h2@0.3.27 (crates.io):RUSTSEC-2026-0258"},{"rule_id":"osv/RUSTSEC-2026-0258","severity":"medium","message":"h2@0.4.15 (crates.io) is affected by RUSTSEC-2026-0258","path":"Cargo.lock","line":null,"fingerprint":"h2@0.4.15 (crates.io):RUSTSEC-2026-0258"},{"rule_id":"osv/RUSTSEC-2026-0253","severity":"medium","message":"lru@0.16.4 (crates.io) is affected by RUSTSEC-2026-0253","path":"Cargo.lock","line":null,"fingerprint":"lru@0.16.4 (crates.io):RUSTSEC-2026-0253"},{"rule_id":"osv/GHSA-g4mp-vgx3-xrvm","severity":"medium","message":"pageant@0.2.1 (crates.io) is affected by GHSA-g4mp-vgx3-xrvm","path":"Cargo.lock","line":null,"fingerprint":"pageant@0.2.1 (crates.io):GHSA-g4mp-vgx3-xrvm"},{"rule_id":"osv/RUSTSEC-2024-0436","severity":"medium","message":"paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436","path":"Cargo.lock","line":null,"fingerprint":"paste@1.0.15 (crates.io):RUSTSEC-2024-0436"},{"rule_id":"osv/RUSTSEC-2026-0441","severity":"medium","message":"pin-utils@0.1.0 (crates.io) is affected by RUSTSEC-2026-0441","path":"Cargo.lock","line":null,"fingerprint":"pin-utils@0.1.0 (crates.io):RUSTSEC-2026-0441"},{"rule_id":"osv/RUSTSEC-2024-0370","severity":"medium","message":"proc-macro-error@1.0.4 (crates.io) is affected by RUSTSEC-2024-0370","path":"Cargo.lock","line":null,"fingerprint":"proc-macro-error@1.0.4 (crates.io):RUSTSEC-2024-0370"},{"rule_id":"osv/RUSTSEC-2023-0071","severity":"medium","message":"rsa@0.10.0-rc.18 (crates.io) is affected by RUSTSEC-2023-0071","path":"Cargo.lock","line":null,"fingerprint":"rsa@0.10.0-rc.18 (crates.io):RUSTSEC-2023-0071"},{"rule_id":"osv/GHSA-35g8-35p8-c8fw","severity":"medium","message":"russh@0.62.2 (crates.io) is affected by GHSA-35g8-35p8-c8fw","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-35g8-35p8-c8fw"},{"rule_id":"osv/GHSA-4p9f-7p9m-5vfg","severity":"medium","message":"russh@0.62.2 (crates.io) is affected by GHSA-4p9f-7p9m-5vfg","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-4p9f-7p9m-5vfg"},{"rule_id":"osv/GHSA-4wc5-f2rc-q74m","severity":"medium","message":"russh@0.62.2 (crates.io) is affected by GHSA-4wc5-f2rc-q74m","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-4wc5-f2rc-q74m"},{"rule_id":"osv/GHSA-5xvq-cp9x-6p6r","severity":"medium","message":"russh@0.62.2 (crates.io) is affected by GHSA-5xvq-cp9x-6p6r","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-5xvq-cp9x-6p6r"},{"rule_id":"osv/GHSA-cqjc-rmpq-xprq","severity":"medium","message":"russh@0.62.2 (crates.io) is affected by GHSA-cqjc-rmpq-xprq","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-cqjc-rmpq-xprq"},{"rule_id":"osv/GHSA-fw5c-8223-6h42","severity":"medium","message":"russh@0.62.2 (crates.io) is affected by GHSA-fw5c-8223-6h42","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-fw5c-8223-6h42"},{"rule_id":"osv/GHSA-g9hv-x236-4qp3","severity":"medium","message":"russh@0.62.2 (crates.io) is affected by GHSA-g9hv-x236-4qp3","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-g9hv-x236-4qp3"},{"rule_id":"osv/GHSA-m65r-rprj-r5rg","severity":"medium","message":"russh@0.62.2 (crates.io) is affected by GHSA-m65r-rprj-r5rg","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-m65r-rprj-r5rg"},{"rule_id":"osv/GHSA-w3jg-pjxf-73p4","severity":"medium","message":"russh@0.62.2 (crates.io) is affected by GHSA-w3jg-pjxf-73p4","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-w3jg-pjxf-73p4"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.4 (crates.io) is affected by RUSTSEC-2026-0486","path":"Cargo.lock","line":null,"fingerprint":"rustix@1.1.4 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.21.12 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.21.12 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.41 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.41 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.41 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.41 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.101.7 (crates.io) is affected by RUSTSEC-2026-0382","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.101.7 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.13 (crates.io) is affected by RUSTSEC-2026-0382","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.13 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0271","severity":"medium","message":"suppaftp@10.0.0 (crates.io) is affected by RUSTSEC-2026-0271","path":"Cargo.lock","line":null,"fingerprint":"suppaftp@10.0.0 (crates.io):RUSTSEC-2026-0271"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.52.3 (crates.io) is affected by RUSTSEC-2026-0386","path":"Cargo.lock","line":null,"fingerprint":"tokio@1.52.3 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2025-0081","severity":"medium","message":"unic-char-property@0.9.0 (crates.io) is affected by RUSTSEC-2025-0081","path":"Cargo.lock","line":null,"fingerprint":"unic-char-property@0.9.0 (crates.io):RUSTSEC-2025-0081"},{"rule_id":"osv/RUSTSEC-2025-0075","severity":"medium","message":"unic-char-range@0.9.0 (crates.io) is affected by RUSTSEC-2025-0075","path":"Cargo.lock","line":null,"fingerprint":"unic-char-range@0.9.0 (crates.io):RUSTSEC-2025-0075"},{"rule_id":"osv/RUSTSEC-2025-0080","severity":"medium","message":"unic-common@0.9.0 (crates.io) is affected by RUSTSEC-2025-0080","path":"Cargo.lock","line":null,"fingerprint":"unic-common@0.9.0 (crates.io):RUSTSEC-2025-0080"},{"rule_id":"osv/RUSTSEC-2025-0100","severity":"medium","message":"unic-ucd-ident@0.9.0 (crates.io) is affected by RUSTSEC-2025-0100","path":"Cargo.lock","line":null,"fingerprint":"unic-ucd-ident@0.9.0 (crates.io):RUSTSEC-2025-0100"},{"rule_id":"osv/RUSTSEC-2025-0098","severity":"medium","message":"unic-ucd-version@0.9.0 (crates.io) is affected by RUSTSEC-2025-0098","path":"Cargo.lock","line":null,"fingerprint":"unic-ucd-version@0.9.0 (crates.io):RUSTSEC-2025-0098"},{"rule_id":"osv/RUSTSEC-2026-0381","severity":"medium","message":"webpki-roots@1.0.8 (crates.io) is affected by RUSTSEC-2026-0381","path":"Cargo.lock","line":null,"fingerprint":"webpki-roots@1.0.8 (crates.io):RUSTSEC-2026-0381"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@4.1.10 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.10 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@4.1.10 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.10 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-5pm8-86m8-9m6r","severity":"medium","message":"basic-ftp@5.3.1 (npm) is affected by GHSA-5pm8-86m8-9m6r","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.3.1 (npm):GHSA-5pm8-86m8-9m6r"},{"rule_id":"osv/GHSA-r4jh-29pc-gfqr","severity":"medium","message":"basic-ftp@5.3.1 (npm) is affected by GHSA-r4jh-29pc-gfqr","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.3.1 (npm):GHSA-r4jh-29pc-gfqr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.1.2 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.1.2 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"package-lock.json","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-4q55-j62x-fr9h","severity":"medium","message":"devalue@5.8.1 (npm) is affected by GHSA-4q55-j62x-fr9h","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-4q55-j62x-fr9h"},{"rule_id":"osv/GHSA-9rgm-9g3h-6x36","severity":"medium","message":"devalue@5.8.1 (npm) is affected by GHSA-9rgm-9g3h-6x36","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-9rgm-9g3h-6x36"},{"rule_id":"osv/GHSA-hx4r-w6wj-j8fg","severity":"medium","message":"devalue@5.8.1 (npm) is affected by GHSA-hx4r-w6wj-j8fg","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-hx4r-w6wj-j8fg"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@10.5.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@10.5.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-22jq-vg5j-6vgg","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-22jq-vg5j-6vgg","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-22jq-vg5j-6vgg"},{"rule_id":"osv/GHSA-2vr4-cq9g-pvrc","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-2vr4-cq9g-pvrc","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-2vr4-cq9g-pvrc"},{"rule_id":"osv/GHSA-4xrf-jv44-h6hh","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-4xrf-jv44-h6hh","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-4xrf-jv44-h6hh"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.2.0 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.2.0 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.9 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.18 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.18 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-r4xh-jqrq-34v2","severity":"medium","message":"smol-toml@1.7.0 (npm) is affected by GHSA-r4xh-jqrq-34v2","path":"package-lock.json","line":null,"fingerprint":"smol-toml@1.7.0 (npm):GHSA-r4xh-jqrq-34v2"},{"rule_id":"osv/GHSA-3wwx-pv8p-q78v","severity":"medium","message":"undici@6.27.0 (npm) is affected by GHSA-3wwx-pv8p-q78v","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-3wwx-pv8p-q78v"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@6.27.0 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-8xcm-r25x-g524","severity":"medium","message":"undici@6.27.0 (npm) is affected by GHSA-8xcm-r25x-g524","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-8xcm-r25x-g524"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@6.27.0 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-m8rv-5g2x-5cg5","severity":"medium","message":"undici@6.27.0 (npm) is affected by GHSA-m8rv-5g2x-5cg5","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-m8rv-5g2x-5cg5"},{"rule_id":"osv/GHSA-v3r7-h72x-cjcm","severity":"medium","message":"undici@6.27.0 (npm) is affected by GHSA-v3r7-h72x-cjcm","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-v3r7-h72x-cjcm"},{"rule_id":"osv/GHSA-2jfj-6hjv-fm6j","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-2jfj-6hjv-fm6j","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-2jfj-6hjv-fm6j"},{"rule_id":"osv/GHSA-3wwx-pv8p-q78v","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-3wwx-pv8p-q78v","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-3wwx-pv8p-q78v"},{"rule_id":"osv/GHSA-3xpg-4rpp-hhhm","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-3xpg-4rpp-hhhm","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-3xpg-4rpp-hhhm"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-8xcm-r25x-g524","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-8xcm-r25x-g524","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-8xcm-r25x-g524"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-f72v-6w45-q472","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-jr45-8vmc-qm54","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-jr45-8vmc-qm54","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-jr45-8vmc-qm54"},{"rule_id":"osv/GHSA-m8rv-5g2x-5cg5","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-m8rv-5g2x-5cg5","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-m8rv-5g2x-5cg5"},{"rule_id":"osv/GHSA-pmjh-fq2x-6v4x","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-pmjh-fq2x-6v4x","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-pmjh-fq2x-6v4x"},{"rule_id":"osv/GHSA-rx4f-c7p8-82vq","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-rx4f-c7p8-82vq","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-rx4f-c7p8-82vq"},{"rule_id":"osv/GHSA-v3r7-h72x-cjcm","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-v3r7-h72x-cjcm","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-v3r7-h72x-cjcm"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@6.4.3 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@6.4.3 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@6.4.3 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@4.1.10 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"vitest@4.1.10 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-662x-8wvj-2276","severity":"low","message":"pageant@0.2.1 (crates.io) is affected by GHSA-662x-8wvj-2276","path":"Cargo.lock","line":null,"fingerprint":"pageant@0.2.1 (crates.io):GHSA-662x-8wvj-2276"},{"rule_id":"osv/GHSA-9264-jvgf-6w2f","severity":"low","message":"russh@0.62.2 (crates.io) is affected by GHSA-9264-jvgf-6w2f","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-9264-jvgf-6w2f"},{"rule_id":"osv/GHSA-9wfm-jcj8-jfv9","severity":"low","message":"russh@0.62.2 (crates.io) is affected by GHSA-9wfm-jcj8-jfv9","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-9wfm-jcj8-jfv9"},{"rule_id":"osv/GHSA-g6xm-f9xp-qq35","severity":"low","message":"russh@0.62.2 (crates.io) is affected by GHSA-g6xm-f9xp-qq35","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-g6xm-f9xp-qq35"},{"rule_id":"osv/GHSA-j7h2-66j4-ghjf","severity":"low","message":"russh@0.62.2 (crates.io) is affected by GHSA-j7h2-66j4-ghjf","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-j7h2-66j4-ghjf"},{"rule_id":"osv/GHSA-p8qx-h547-fjw9","severity":"low","message":"russh@0.62.2 (crates.io) is affected by GHSA-p8qx-h547-fjw9","path":"Cargo.lock","line":null,"fingerprint":"russh@0.62.2 (crates.io):GHSA-p8qx-h547-fjw9"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.21.12 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.21.12 (crates.io):GHSA-w44r-93j7-qv28"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.21.12 (crates.io) is affected by GHSA-h2v8-394m-p7vv","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.21.12 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.41 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.41 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.41 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.41 (crates.io):GHSA-w44r-93j7-qv28"},{"rule_id":"osv/GHSA-965h-392x-2mh5","severity":"low","message":"rustls-webpki@0.101.7 (crates.io) is affected by RUSTSEC-2026-0098, GHSA-965h-392x-2mh5","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.101.7 (crates.io):GHSA-965h-392x-2mh5"},{"rule_id":"osv/GHSA-xgp8-3hg3-c2mh","severity":"low","message":"rustls-webpki@0.101.7 (crates.io) is affected by RUSTSEC-2026-0099, GHSA-xgp8-3hg3-c2mh","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.101.7 (crates.io):GHSA-xgp8-3hg3-c2mh"},{"rule_id":"osv/GHSA-wf3x-273g-mvxv","severity":"low","message":"devalue@5.8.1 (npm) is affected by GHSA-wf3x-273g-mvxv","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-wf3x-273g-mvxv"},{"rule_id":"osv/GHSA-474x-hrwr-fgx4","severity":"low","message":"fast-xml-parser@5.10.0 (npm) is affected by GHSA-474x-hrwr-fgx4","path":"package-lock.json","line":null,"fingerprint":"fast-xml-parser@5.10.0 (npm):GHSA-474x-hrwr-fgx4"},{"rule_id":"osv/GHSA-m5mm-p8h7-m29v","severity":"low","message":"serialize-javascript@7.0.7 (npm) is affected by GHSA-m5mm-p8h7-m29v","path":"package-lock.json","line":null,"fingerprint":"serialize-javascript@7.0.7 (npm):GHSA-m5mm-p8h7-m29v"},{"rule_id":"osv/GHSA-r53p-7pc4-xj5r","severity":"low","message":"undici@6.27.0 (npm) is affected by GHSA-r53p-7pc4-xj5r","path":"package-lock.json","line":null,"fingerprint":"undici@6.27.0 (npm):GHSA-r53p-7pc4-xj5r"},{"rule_id":"osv/GHSA-2gqq-gqf2-x968","severity":"low","message":"undici@7.28.0 (npm) is affected by GHSA-2gqq-gqf2-x968","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-2gqq-gqf2-x968"},{"rule_id":"osv/GHSA-8436-99hf-9mmv","severity":"low","message":"undici@7.28.0 (npm) is affected by GHSA-8436-99hf-9mmv","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-8436-99hf-9mmv"},{"rule_id":"osv/GHSA-r53p-7pc4-xj5r","severity":"low","message":"undici@7.28.0 (npm) is affected by GHSA-r53p-7pc4-xj5r","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-r53p-7pc4-xj5r"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@6.4.3 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["crates.io","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":22.0,"findings_high":18.0,"findings_medium":4.0,"findings_low":0.0,"penalty":196.8},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":37,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:37"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":41,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:41"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":93,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:93"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/release.yml","line":19,"fingerprint":"excessive-permissions:.github/workflows/release.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/release.yml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":38,"fingerprint":"unpinned-uses:.github/workflows/release.yml:38"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/release.yml:43"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":45,"fingerprint":"unpinned-uses:.github/workflows/release.yml:45"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":71,"fingerprint":"unpinned-uses:.github/workflows/release.yml:71"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":94,"fingerprint":"unpinned-uses:.github/workflows/release.yml:94"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":96,"fingerprint":"unpinned-uses:.github/workflows/release.yml:96"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":101,"fingerprint":"unpinned-uses:.github/workflows/release.yml:101"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":118,"fingerprint":"unpinned-uses:.github/workflows/release.yml:118"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":38,"fingerprint":"cache-poisoning:.github/workflows/release.yml:38"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":45,"fingerprint":"cache-poisoning:.github/workflows/release.yml:45"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":96,"fingerprint":"cache-poisoning:.github/workflows/release.yml:96"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":30,"fingerprint":"artipacked:.github/workflows/ci.yml:30"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:9"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":36,"fingerprint":"artipacked:.github/workflows/release.yml:36"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":94,"fingerprint":"artipacked:.github/workflows/release.yml:94"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":7.0},"findings":[],"evidence":[{"kind":"posture","description":"crates/serverus-adapters/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/serverus-adapters/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/serverus-application/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/serverus-application/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/serverus-domain/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/serverus-domain/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/serverus-e2e-fixtures/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/serverus-e2e-fixtures/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/serverus-runtime/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/serverus-runtime/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"crates/serverus-testkit/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"crates/serverus-testkit/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"src-tauri/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"src-tauri/Cargo.toml","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":2.0,"binary_assets":76.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v1.8.0 ships Serverus-1.8.0-1.aarch64.rpm (1 downloads)","ref":"Serverus-1.8.0-1.aarch64.rpm","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus-1.8.0-1.aarch64.rpm","weight":0.0},{"kind":"binary-release-asset","description":"release v1.8.0 ships Serverus-1.8.0-1.x86_64.rpm (1 downloads)","ref":"Serverus-1.8.0-1.x86_64.rpm","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus-1.8.0-1.x86_64.rpm","weight":0.0},{"kind":"binary-release-asset","description":"release v1.8.0 ships Serverus_1.8.0_aarch64.AppImage (1 downloads)","ref":"Serverus_1.8.0_aarch64.AppImage","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_aarch64.AppImage","weight":0.0},{"kind":"binary-release-asset","description":"release v1.8.0 ships Serverus_1.8.0_aarch64.dmg (13 downloads)","ref":"Serverus_1.8.0_aarch64.dmg","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_aarch64.dmg","weight":0.0},{"kind":"binary-release-asset","description":"release v1.8.0 ships Serverus_1.8.0_amd64.AppImage (3 downloads)","ref":"Serverus_1.8.0_amd64.AppImage","url":"https://github.com/fedorananin/serverus/releases/download/v1.8.0/Serverus_1.8.0_amd64.AppImage","weight":0.0},{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["binary-release-assets","readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2199.0,"function_nloc":24702.0,"mean_ccn":2.59,"p90_ccn":6.0,"complex_functions":23.0,"long_functions":6.0,"many_param_functions":5.0,"risky_nloc_share":0.0774},"findings":[],"evidence":[{"kind":"complex-function","description":"run_single in src-tauri/src/transfer/single_transfer.rs: complexity 59, 211 lines","ref":"src-tauri/src/transfer/single_transfer.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/transfer/single_transfer.rs#L30","weight":0.9833333333333333},{"kind":"complex-function","description":"visit in e2e-scenarios/src/scenario-input-gate.ts: complexity 37, 60 lines","ref":"e2e-scenarios/src/scenario-input-gate.ts","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/e2e-scenarios/src/scenario-input-gate.ts#L184","weight":0.6166666666666667},{"kind":"complex-function","description":"copy_recursive_inner in src-tauri/src/commands/local_copy.rs: complexity 27, 101 lines","ref":"src-tauri/src/commands/local_copy.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/commands/local_copy.rs#L100","weight":0.45},{"kind":"complex-function","description":"enqueue_download_inner in src-tauri/src/transfer/enqueue_download.rs: complexity 26, 146 lines","ref":"src-tauri/src/transfer/enqueue_download.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/transfer/enqueue_download.rs#L128","weight":0.43333333333333335},{"kind":"complex-function","description":"compare_subtree in src-tauri/src/session/compare.rs: complexity 23, 76 lines","ref":"src-tauri/src/session/compare.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/session/compare.rs#L164","weight":0.38333333333333336},{"kind":"complex-function","description":"unpack_confined in src-tauri/src/transfer/tar_stream/archive.rs: complexity 23, 57 lines","ref":"src-tauri/src/transfer/tar_stream/archive.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/transfer/tar_stream/archive.rs#L49","weight":0.38333333333333336},{"kind":"complex-function","description":"feed in crates/serverus-domain/src/agent/terminal_text.rs: complexity 22, 46 lines","ref":"crates/serverus-domain/src/agent/terminal_text.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/crates/serverus-domain/src/agent/terminal_text.rs#L124","weight":0.36666666666666664},{"kind":"complex-function","description":"code in src-tauri/src/error.rs: complexity 21, 25 lines","ref":"src-tauri/src/error.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/error.rs#L60","weight":0.35},{"kind":"complex-function","description":"download in src-tauri/src/transfer/tar_stream.rs: complexity 21, 87 lines","ref":"src-tauri/src/transfer/tar_stream.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/transfer/tar_stream.rs#L56","weight":0.35},{"kind":"complex-function","description":"read_file in src-tauri/src/agent/tools/files.rs: complexity 20, 68 lines","ref":"src-tauri/src/agent/tools/files.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/agent/tools/files.rs#L115","weight":0.3333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":33149.0,"duplicated_lines":1335.0,"duplicated_share":0.0403,"files":406.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: crates/serverus-domain/src/transfers/aggregate.rs:140 and crates/serverus-domain/src/transfers/aggregate.rs:172","ref":"crates/serverus-domain/src/transfers/aggregate.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/crates/serverus-domain/src/transfers/aggregate.rs#L140","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: crates/serverus-e2e-fixtures/src/s3/tests.rs:40 and crates/serverus-e2e-fixtures/src/s3/tests.rs:68","ref":"crates/serverus-e2e-fixtures/src/s3/tests.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/crates/serverus-e2e-fixtures/src/s3/tests.rs#L40","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: e2e-scenarios/src/scenario-input-gate.ts:26 and e2e-scenarios/src/scenario-keyboard-action-gate.ts:6","ref":"e2e-scenarios/src/scenario-input-gate.ts","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/e2e-scenarios/src/scenario-input-gate.ts#L26","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: e2e-scenarios/src/scenario-supplements.ts:23 and e2e-scenarios/src/scenario-supplements.ts:36","ref":"e2e-scenarios/src/scenario-supplements.ts","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/e2e-scenarios/src/scenario-supplements.ts#L23","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/architecture/frontend-checks.mjs:12 and scripts/architecture/size-checks.mjs:25","ref":"scripts/architecture/frontend-checks.mjs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/scripts/architecture/frontend-checks.mjs#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/architecture/frontend-checks.mjs:21 and scripts/architecture/rust-checks.mjs:37","ref":"scripts/architecture/frontend-checks.mjs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/scripts/architecture/frontend-checks.mjs#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src-tauri/src/agent/tools/files.rs:197 and src-tauri/src/agent/tools/files.rs:258","ref":"src-tauri/src/agent/tools/files.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/agent/tools/files.rs#L197","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src-tauri/src/agent/tools/files.rs:265 and src-tauri/src/agent/tools/queue/transfers.rs:39","ref":"src-tauri/src/agent/tools/files.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/agent/tools/files.rs#L265","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src-tauri/src/agent/tools/queue/tree.rs:41 and src-tauri/src/agent/tools/queue/tree.rs:122","ref":"src-tauri/src/agent/tools/queue/tree.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/agent/tools/queue/tree.rs#L41","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src-tauri/src/agent/tools/terminal.rs:101 and src-tauri/src/agent/tools/terminal/read.rs:136","ref":"src-tauri/src/agent/tools/terminal.rs","url":"https://github.com/fedorananin/serverus/blob/bd63ae972529dd35d4c70178b5ba8c868dceceb5/src-tauri/src/agent/tools/terminal.rs#L101","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":47.0,"weighted_findings":16.75,"scanned_lines":45901.0,"category:correctness":47.0},"findings":[{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how node.type === \"folder\" is evaluated, this expression returns node.id. This is probably a copy-paste error.","path":"src/lib/tree.ts","line":7,"fingerprint":"typescript.lang.correctness.useless-ternary:src/lib/tree.ts:7"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"e2e-scenarios/scenarios/session-lifecycle/session-lifecycle-lock.support.ts","line":20,"fingerprint":"javascript.lang.correctness.no-replaceall:e2e-scenarios/scenarios/session-lifecycle/session-lifecycle-lock.support.ts:20"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"e2e-scenarios/src/runtime-fingerprint.ts","line":71,"fingerprint":"javascript.lang.correctness.no-replaceall:e2e-scenarios/src/runtime-fingerprint.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/check-bindings.mjs","line":9,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/check-bindings.mjs:9"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"e2e-scenarios/src/acceptance-coverage.ts","line":200,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:e2e-scenarios/src/acceptance-coverage.ts:200"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"e2e-scenarios/src/acceptance-coverage.ts","line":200,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:e2e-scenarios/src/acceptance-coverage.ts:200"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"e2e-scenarios/src/acceptance-coverage.ts","line":200,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:e2e-scenarios/src/acceptance-coverage.ts:200"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"e2e-scenarios/src/acceptance-coverage.ts","line":200,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:e2e-scenarios/src/acceptance-coverage.ts:200"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"e2e-scenarios/src/acceptance-coverage.ts","line":200,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:e2e-scenarios/src/acceptance-coverage.ts:200"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":61,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:61"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":61,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:61"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":62,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:62"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":62,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:62"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":68,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:68"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":68,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:68"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":75,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:75"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":75,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:75"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":84,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:84"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":84,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:84"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":94,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:94"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":94,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:94"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":99,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:99"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":99,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:99"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":104,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:104"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":104,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:104"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":109,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:109"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":109,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:109"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":114,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:114"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":114,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:114"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":120,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:120"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":120,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:120"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":125,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:125"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":125,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:125"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":130,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:130"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":130,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:130"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":187,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:187"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":187,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:187"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":204,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:204"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":204,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:204"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":259,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:259"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":259,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:259"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":274,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:274"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":274,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:274"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":289,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:289"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-architecture.self-test.mjs","line":289,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-architecture.self-test.mjs:289"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.8056,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":18488.0,"source_lines":45901.0,"test_ratio":0.4028,"ci_files":2.0,"cochange_share":0.6515,"cochange_commits":66.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm run test, go test, cargo test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (clippy, rustfmt, cargo fmt)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm run test","go test","cargo test"],"lint_commands":["clippy","rustfmt","cargo fmt"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":300.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":3.0,"escapes_per_kloc":0.4},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: e2e-scenarios/tsconfig.json","ref":"e2e-scenarios/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":623.0,"other_lines":45278.0,"files_blamed":406.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":47.0,"quality:other_per_kloc":1.038,"quality:ratio":0.0,"security:ai_findings":1.0,"security:ai_per_kloc":1.605,"security:other_findings":28.0,"security:other_per_kloc":0.618,"security:ratio":2.6},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}