{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:40:26.608738Z","repo":{"ref":{"host":"github.com","owner":"gomatcha","name":"matcha"},"default_branch":"master","clone_url":"https://github.com/gomatcha/matcha.git","html_url":"https://github.com/gomatcha/matcha","description":"Build native mobile apps in Go.","stars":3483,"forks":158,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":8025,"primary_language":"Go","license_spdx":"Apache-2.0","created_at":"2017-08-01T00:46:03Z","pushed_at":"2018-09-13T22:07:28Z","security_policy_url":null,"distribution":{"owner_created_at":"2017-04-25T17:18:08Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a","profile":{"lines_by_language":{"Objective-C":65924,"C":17179,"Go":16555,"Java":3570,"Python":1201,"Shell":767,"Swift":460},"files_by_category":{"source":296,"generated":104,"other":102,"binary":82,"config":56,"test":13,"docs":7,"vendored":5,"oversized":2},"source_lines":104990,"test_lines":666},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":42.7,"confidence":0.78,"coverage":0.83,"label":"poor","breakdown":{"complexity":null,"duplication":14.3,"lint":91.6,"testing":21.9,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.01, no CI test run detected; 32% duplicated lines. Weakest area: duplication."},"security":{"score":81.4,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":98.9,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: no high-impact findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":365.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":209082.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2017-08":{"loc":158984,"attributed_loc":0},"2017-09":{"loc":39252,"attributed_loc":0},"2017-10":{"loc":10538,"attributed_loc":0},"2017-11":{"loc":308,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":190.0,"flagged_units":0.0,"pre_ai_era_bursts":3.0,"pre_ai_era_measured_loc":85498.0,"pre_ai_era_burst_loc":57777.0,"measured_loc":85498.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":11397.946963216426,"median_loc_per_hour":59.8355836541033,"pr_timed_units":0.0,"excluded_import_loc":103348.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["515e5a78665672334fca7f4dfd627f2e321ff488"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":1.0,"flagged_releases":0.0,"max_loc_per_day":1562.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.1.0","to":"v0.2.0","loc":89497,"days":57.29,"loc_per_day":1562.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":91363.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":5.0,"findings_high":0.0,"findings_medium":5.0,"findings_low":0.0,"weighted_findings":1.25,"scanned_lines":39066.0,"parse_errors":95.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"bridge/go-go.go","line":198,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:bridge/go-go.go:198"},{"rule_id":"opengrep/c.lang.security.insecure-use-string-copy-fn","severity":"medium","message":"Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker [confidence low]","path":"bridge/java-foreign.c","line":202,"fingerprint":"c.lang.security.insecure-use-string-copy-fn:bridge/java-foreign.c:202"},{"rule_id":"opengrep/c.lang.security.insecure-use-string-copy-fn","severity":"medium","message":"Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker [confidence low]","path":"bridge/java-foreign.c","line":214,"fingerprint":"c.lang.security.insecure-use-string-copy-fn:bridge/java-foreign.c:214"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"bridge/java-log.go","line":49,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:bridge/java-log.go:49"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"bridge/java-log.go","line":64,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:bridge/java-log.go:64"}],"evidence":[],"data":{"rulesets":["c","go","java","python","bash","swift"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"failed","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"/app/.venv/bin/python3 timed out after 900s"},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":76638.0,"duplicated_lines":24834.0,"duplicated_share":0.324,"files":296.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaGestureRecognizer.java:137 and android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaGestureRecognizer.java:179","ref":"android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaGestureRecognizer.java","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaGestureRecognizer.java#L137","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaSwitchView.java:28 and examples/customview/android/CustomViewLib/customview/src/main/java/io/gomatcha/customview/CustomView.java:31","ref":"android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaSwitchView.java","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaSwitchView.java#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaViewNode.java:184 and android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaViewNode.java:194","ref":"android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaViewNode.java","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/MatchaViewNode.java#L184","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/SlidingTabLayout.java:2 and android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/SlidingTabStrip.java:2","ref":"android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/SlidingTabLayout.java","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/android/MatchaLib/matcha/src/main/java/io/gomatcha/matcha/SlidingTabLayout.java#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: bridge/go-foreign.go:41 and bridge/go-foreign.go:63","ref":"bridge/go-foreign.go","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/bridge/go-foreign.go#L41","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: bridge/objc-foreign.m:498 and bridge/objc-foreign.m:518","ref":"bridge/objc-foreign.m","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/bridge/objc-foreign.m#L498","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: bridge/objc-go.h:12 and ios/MatchaBridge/MatchaBridge/matchago.h:7","ref":"bridge/objc-go.h","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/bridge/objc-go.h#L12","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/android.go:9 and cmd/commands.go:9","ref":"cmd/android.go","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/cmd/android.go#L9","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/bind.go:1 and cmd/matcha.go:1","ref":"cmd/bind.go","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/cmd/bind.go#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cmd/matcha/main.go:42 and cmd/matcha/main.go:77","ref":"cmd/matcha/main.go","url":"https://github.com/gomatcha/matcha/blob/d2dd1c5db1f5c1a7c0de70ead920a999e1e2bc9a/cmd/matcha/main.go#L42","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":19.0,"weighted_findings":13.75,"scanned_lines":39066.0,"category:best-practice":6.0,"category:correctness":12.0,"category:maintainability":1.0},"findings":[{"rule_id":"opengrep/go.lang.maintainability.useless-if-body","severity":"medium","message":"Detected identical statements in the if body and the else body of an if-statement. This will lead to the same code being executed no matter what the if-expression evaluates to. Instead, remove the if statement.","path":"application/app.go","line":64,"fingerprint":"go.lang.maintainability.useless-if-body:application/app.go:64"},{"rule_id":"opengrep/go.lang.best-practice.hidden-goroutine","severity":"medium","message":"Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.","path":"bridge/go-foreign.go","line":93,"fingerprint":"go.lang.best-practice.hidden-goroutine:bridge/go-foreign.go:93"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd/commands.go","line":240,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd/commands.go:240"},{"rule_id":"opengrep/bash.lang.best-practice.useless-cat","severity":"medium","message":"Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file.","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/check_version_stamps.sh","line":27,"fingerprint":"bash.lang.best-practice.useless-cat:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/check_version_stamps.sh:27"},{"rule_id":"opengrep/bash.lang.best-practice.useless-cat","severity":"medium","message":"Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file.","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/check_version_stamps.sh","line":36,"fingerprint":"bash.lang.best-practice.useless-cat:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/check_version_stamps.sh:36"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm.py","line":658,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm.py:658"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm.py","line":660,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm.py:660"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm.py","line":673,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm.py:673"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm_tests.py","line":334,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm_tests.py:334"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm_tests.py","line":338,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm_tests.py:338"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm_tests.py","line":342,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm_tests.py:342"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm_tests.py","line":346,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/pddm_tests.py:346"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/check_version_stamps.sh","line":11,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/check_version_stamps.sh:11"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/full_mac_build.sh","line":9,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/full_mac_build.sh:9"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/full_mac_build.sh","line":65,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/full_mac_build.sh:65"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/full_mac_build.sh","line":69,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ios/Protobuf/Protobuf/protobuf/objectivec/DevTools/full_mac_build.sh:69"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ios/Protobuf/Protobuf/protobuf/objectivec/Tests/CocoaPods/run_tests.sh","line":7,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ios/Protobuf/Protobuf/protobuf/objectivec/Tests/CocoaPods/run_tests.sh:7"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ios/Protobuf/Protobuf/protobuf/objectivec/generate_well_known_types.sh","line":12,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ios/Protobuf/Protobuf/protobuf/objectivec/generate_well_known_types.sh:12"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"ios/Protobuf/Protobuf/protobuf/objectivec/generate_well_known_types.sh","line":42,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:ios/Protobuf/Protobuf/protobuf/objectivec/generate_well_known_types.sh:42"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0127,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.1583,"test_lines":666.0,"source_lines":104990.0,"test_ratio":0.0063,"ci_files":0.0,"cochange_share":0.0396,"cochange_commits":278.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":116.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":1.0,"escapes_per_kloc":0.833},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}