{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:52:01.753313Z","repo":{"ref":{"host":"github.com","owner":"google-gemini","name":"glanceboard"},"default_branch":"main","clone_url":"https://github.com/google-gemini/glanceboard.git","html_url":"https://github.com/google-gemini/glanceboard","description":null,"stars":216,"forks":22,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1237,"primary_language":"Python","license_spdx":"Apache-2.0","created_at":"2026-07-23T08:24:31Z","pushed_at":"2026-10-24T06:01:08Z","security_policy_url":"https://github.com/google-gemini/glanceboard/security/policy","distribution":{"owner_created_at":"2024-02-29T23:57:46Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"14db572628b70312025ee19c5de6228cc4ad7c27","profile":{"lines_by_language":{"Python":6036,"JavaScript":2376,"Shell":399},"files_by_category":{"docs":13,"other":10,"source":8,"config":6,"binary":4,"generated":1},"source_lines":8811,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.4,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":28.2,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":35.7,"duplication":10.9,"lint":43.9,"testing":0.0,"docs":80.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 34% of function code in complex or long functions; 37% duplicated lines. Weakest area: testing."},"security":{"score":52.3,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":27.8,"dependencies":23.5,"ci_actions":null,"posture":40.0,"scorecard":null},"summary":"Security posture is weak: 139 known vulnerabilities in 11 dependencies; 32 high-severity SAST findings. Weakest area: dependencies."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":21.0,"checked":21.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":8811.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-07":{"loc":8811,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":0.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":0.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":0.0,"median_loc_per_hour":0.0,"pr_timed_units":0.0,"excluded_import_loc":8811.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["14db572628b70312025ee19c5de6228cc4ad7c27"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":8811.0,"index":14.017,"count:narrated_steps":8.0,"per_kloc:narrated_steps":0.908,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":231.0,"per_kloc:emoji_in_code":26.217,"files:emoji_in_code":5.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: API Key → Next","ref":"web/src/main.js:426","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L426","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Skip","ref":"web/src/main.js:436","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L436","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Calendar/iCal → Next","ref":"web/src/main.js:446","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L446","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Back","ref":"web/src/main.js:451","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L451","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 4: Geocode location","ref":"web/src/main.js:454","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L454","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Next → Summary","ref":"web/src/main.js:486","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L486","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Back","ref":"web/src/main.js:511","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L511","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 5: Finish","ref":"web/src/main.js:514","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L514","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":62.0,"findings_high":32.0,"findings_medium":30.0,"findings_low":0.0,"weighted_findings":32.2,"scanned_lines":8811.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":562,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:562"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `$(\"#latest-image-container\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":562,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:562"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":776,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:776"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tray.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":776,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:776"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":827,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:827"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":827,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:827"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":888,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:888"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `ghost.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":888,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:888"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":943,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:943"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `ghost.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":943,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:943"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1050,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:1050"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1050,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:1050"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1130,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:1130"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1130,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:1130"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1312,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:1312"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `btn.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1312,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:1312"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1356,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:1356"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `card.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1356,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:1356"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1392,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:1392"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `preview.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1392,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:1392"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1407,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:1407"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `$(\"#char-image-preview\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1407,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:1407"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1727,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:1727"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `pill.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1727,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:1727"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1925,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:1925"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tag.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1925,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:1925"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":2149,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:2149"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":2149,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:2149"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":2161,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:2161"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":2161,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:2161"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":2250,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.js:2250"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":2250,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.js:2250"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"pi/display_update.py","line":299,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:pi/display_update.py:299"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"pi/display_update.py","line":419,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:pi/display_update.py:419"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"pi/display_update.py","line":484,"fingerprint":"python.lang.security.insecure-hash-algorithm-md5:pi/display_update.py:484"},{"rule_id":"opengrep/python.django.security.injection.tainted-url-host","severity":"medium","message":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources th [confidence low]","path":"server/app.py","line":2400,"fingerprint":"python.django.security.injection.tainted-url-host:server/app.py:2400"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":273,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:web/src/main.js:273"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":278,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:web/src/main.js:278"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":280,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:web/src/main.js:280"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":363,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:web/src/main.js:363"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":562,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:562"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":778,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:778"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":827,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:827"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":888,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:888"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":943,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:943"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1021,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1021"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1024,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1024"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1035,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1035"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1039,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1039"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1312,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1312"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1356,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1356"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1357,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1357"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1392,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1392"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1407,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1407"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1727,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1727"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1890,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:web/src/main.js:1890"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.js","line":1894,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:web/src/main.js:1894"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":1925,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:1925"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":2149,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:2149"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":2158,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:2158"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":2161,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:2161"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.js","line":2258,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.js:2258"}],"evidence":[],"data":{"rulesets":["python","javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":11.0,"vulnerabilities":139.0,"vulns_critical":12.0,"vulns_high":81.0,"vulns_medium":38.0,"vulns_low":5.0,"vulns_unknown":3.0,"penalty":87.0},"findings":[{"rule_id":"osv/GHSA-5x8w-8jj5-q52h","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-5x8w-8jj5-q52h"},{"rule_id":"osv/GHSA-8g5g-8vmr-9782","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-8g5g-8vmr-9782"},{"rule_id":"osv/GHSA-xvh5-g6gv-559v","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xvh5-g6gv-559v"},{"rule_id":"osv/GHSA-3f63-hfp8-52jq","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-3f63-hfp8-52jq"},{"rule_id":"osv/GHSA-332p-7hrc-92wf","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by GHSA-332p-7hrc-92wf","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-332p-7hrc-92wf"},{"rule_id":"osv/GHSA-w889-685w-c8fh","severity":"critical","message":"pillow@10.0.0 (PyPI) is affected by GHSA-w889-685w-c8fh","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-w889-685w-c8fh"},{"rule_id":"osv/GHSA-5x8w-8jj5-q52h","severity":"critical","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-5x8w-8jj5-q52h"},{"rule_id":"osv/GHSA-8g5g-8vmr-9782","severity":"critical","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-8g5g-8vmr-9782"},{"rule_id":"osv/GHSA-v9pv-5gc8-w2m6","severity":"critical","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-v9pv-5gc8-w2m6"},{"rule_id":"osv/GHSA-xvh5-g6gv-559v","severity":"critical","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-xvh5-g6gv-559v"},{"rule_id":"osv/GHSA-332p-7hrc-92wf","severity":"critical","message":"pillow@11.3.0 (PyPI) is affected by GHSA-332p-7hrc-92wf","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-332p-7hrc-92wf"},{"rule_id":"osv/GHSA-w889-685w-c8fh","severity":"critical","message":"pillow@11.3.0 (PyPI) is affected by GHSA-w889-685w-c8fh","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-w889-685w-c8fh"},{"rule_id":"osv/GHSA-44wm-f244-xhp3","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-1793, GHSA-44wm-f244-xhp3","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-44wm-f244-xhp3"},{"rule_id":"osv/GHSA-j7hp-h8jx-5ppr","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-1794, GHSA-j7hp-h8jx-5ppr","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-j7hp-h8jx-5ppr"},{"rule_id":"osv/GHSA-8v84-f9pq-wr9x","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-8v84-f9pq-wr9x"},{"rule_id":"osv/GHSA-5x94-69rx-g8h2","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-5x94-69rx-g8h2"},{"rule_id":"osv/GHSA-45hq-cxwh-f6vc","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-45hq-cxwh-f6vc"},{"rule_id":"osv/GHSA-phj9-mv4w-65pm","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-phj9-mv4w-65pm"},{"rule_id":"osv/GHSA-6r8x-57c9-28j4","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-6r8x-57c9-28j4"},{"rule_id":"osv/GHSA-9hw9-ch79-4vh6","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-9hw9-ch79-4vh6"},{"rule_id":"osv/GHSA-xj96-63gp-2gmr","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xj96-63gp-2gmr"},{"rule_id":"osv/GHSA-62p4-gmf7-7g93","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-62p4-gmf7-7g93"},{"rule_id":"osv/GHSA-jjj6-mw9f-p565","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-jjj6-mw9f-p565"},{"rule_id":"osv/GHSA-vjc4-5qp5-m44j","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-vjc4-5qp5-m44j"},{"rule_id":"osv/GHSA-27h8-gf7j-v5hc","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-27h8-gf7j-v5hc"},{"rule_id":"osv/GHSA-4558-3h8r-v8xp","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-4558-3h8r-v8xp"},{"rule_id":"osv/GHSA-58r4-6rv3-gfh8","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-58r4-6rv3-gfh8"},{"rule_id":"osv/GHSA-7mwm-ghpf-9vrm","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-7mwm-ghpf-9vrm"},{"rule_id":"osv/GHSA-pchr-8j38-3x4p","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-pchr-8j38-3x4p"},{"rule_id":"osv/GHSA-xgh8-jp6q-p5x8","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xgh8-jp6q-p5x8"},{"rule_id":"osv/GHSA-g842-9rc4-69pw","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-g842-9rc4-69pw"},{"rule_id":"osv/GHSA-3j72-p6qg-6xp7","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-3j72-p6qg-6xp7"},{"rule_id":"osv/GHSA-9v9v-9qvf-h2hj","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-9v9v-9qvf-h2hj"},{"rule_id":"osv/GHSA-22hg-r758-rrw9","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-22hg-r758-rrw9","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-22hg-r758-rrw9"},{"rule_id":"osv/GHSA-5xm2-6676-qcp9","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-5xm2-6676-qcp9","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-5xm2-6676-qcp9"},{"rule_id":"osv/GHSA-65qm-jvmh-6pqg","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-65qm-jvmh-6pqg","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-65qm-jvmh-6pqg"},{"rule_id":"osv/GHSA-c6hw-5grf-ff96","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-c6hw-5grf-ff96","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-c6hw-5grf-ff96"},{"rule_id":"osv/GHSA-f2g6-542v-9j58","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-f2g6-542v-9j58","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-f2g6-542v-9j58"},{"rule_id":"osv/GHSA-g7cr-3p24-7wf7","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-g7cr-3p24-7wf7","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-g7cr-3p24-7wf7"},{"rule_id":"osv/GHSA-gg2r-wvfm-q9rx","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-gg2r-wvfm-q9rx","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-gg2r-wvfm-q9rx"},{"rule_id":"osv/GHSA-j4m9-6w36-pw47","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-j4m9-6w36-pw47","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-j4m9-6w36-pw47"},{"rule_id":"osv/GHSA-jg86-v3jv-hrpm","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-jg86-v3jv-hrpm","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-jg86-v3jv-hrpm"},{"rule_id":"osv/GHSA-mrfp-p49p-3hf2","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-mrfp-p49p-3hf2","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-mrfp-p49p-3hf2"},{"rule_id":"osv/GHSA-p4wg-p73j-c528","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-p4wg-p73j-c528","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-p4wg-p73j-c528"},{"rule_id":"osv/GHSA-q45j-58j2-45rg","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-q45j-58j2-45rg","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-q45j-58j2-45rg"},{"rule_id":"osv/GHSA-xcvg-w56q-r89m","severity":"high","message":"pillow@10.0.0 (PyPI) is affected by GHSA-xcvg-w56q-r89m","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-xcvg-w56q-r89m"},{"rule_id":"osv/GHSA-cfh3-3jmp-rvhc","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2249, GHSA-cfh3-3jmp-rvhc","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-cfh3-3jmp-rvhc"},{"rule_id":"osv/GHSA-whj4-6x5x-4v2j","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2250, GHSA-whj4-6x5x-4v2j","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-whj4-6x5x-4v2j"},{"rule_id":"osv/GHSA-pwv6-vv43-88gr","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2252, GHSA-pwv6-vv43-88gr","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-pwv6-vv43-88gr"},{"rule_id":"osv/GHSA-8v84-f9pq-wr9x","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2253, GHSA-8v84-f9pq-wr9x","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-8v84-f9pq-wr9x"},{"rule_id":"osv/GHSA-5x94-69rx-g8h2","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2254, GHSA-5x94-69rx-g8h2","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-5x94-69rx-g8h2"},{"rule_id":"osv/GHSA-45hq-cxwh-f6vc","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2255, GHSA-45hq-cxwh-f6vc","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-45hq-cxwh-f6vc"},{"rule_id":"osv/GHSA-phj9-mv4w-65pm","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2256, GHSA-phj9-mv4w-65pm","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-phj9-mv4w-65pm"},{"rule_id":"osv/GHSA-6r8x-57c9-28j4","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-3451, GHSA-6r8x-57c9-28j4","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-6r8x-57c9-28j4"},{"rule_id":"osv/GHSA-9hw9-ch79-4vh6","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-3453, GHSA-9hw9-ch79-4vh6","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-9hw9-ch79-4vh6"},{"rule_id":"osv/GHSA-xj96-63gp-2gmr","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-3454, GHSA-xj96-63gp-2gmr","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-xj96-63gp-2gmr"},{"rule_id":"osv/GHSA-62p4-gmf7-7g93","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-3493, GHSA-62p4-gmf7-7g93","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-62p4-gmf7-7g93"},{"rule_id":"osv/GHSA-jjj6-mw9f-p565","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-3495, GHSA-jjj6-mw9f-p565","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-jjj6-mw9f-p565"},{"rule_id":"osv/GHSA-vjc4-5qp5-m44j","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-3496, GHSA-vjc4-5qp5-m44j","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-vjc4-5qp5-m44j"},{"rule_id":"osv/GHSA-27h8-gf7j-v5hc","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-27h8-gf7j-v5hc"},{"rule_id":"osv/GHSA-4558-3h8r-v8xp","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-4558-3h8r-v8xp"},{"rule_id":"osv/GHSA-4rr5-89j8-mwwm","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4328, GHSA-4rr5-89j8-mwwm","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-4rr5-89j8-mwwm"},{"rule_id":"osv/GHSA-58r4-6rv3-gfh8","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-58r4-6rv3-gfh8"},{"rule_id":"osv/GHSA-7mwm-ghpf-9vrm","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-7mwm-ghpf-9vrm"},{"rule_id":"osv/GHSA-pchr-8j38-3x4p","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-pchr-8j38-3x4p"},{"rule_id":"osv/GHSA-xgh8-jp6q-p5x8","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-xgh8-jp6q-p5x8"},{"rule_id":"osv/GHSA-g842-9rc4-69pw","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-g842-9rc4-69pw"},{"rule_id":"osv/GHSA-3j72-p6qg-6xp7","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-3j72-p6qg-6xp7"},{"rule_id":"osv/GHSA-g4qv-2jxx-769h","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4342, GHSA-g4qv-2jxx-769h","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-g4qv-2jxx-769h"},{"rule_id":"osv/GHSA-9v9v-9qvf-h2hj","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-9v9v-9qvf-h2hj"},{"rule_id":"osv/GHSA-22hg-r758-rrw9","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-22hg-r758-rrw9","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-22hg-r758-rrw9"},{"rule_id":"osv/GHSA-5xm2-6676-qcp9","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-5xm2-6676-qcp9","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-5xm2-6676-qcp9"},{"rule_id":"osv/GHSA-65qm-jvmh-6pqg","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-65qm-jvmh-6pqg","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-65qm-jvmh-6pqg"},{"rule_id":"osv/GHSA-78g4-xqwv-q3g8","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-78g4-xqwv-q3g8","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-78g4-xqwv-q3g8"},{"rule_id":"osv/GHSA-c6hw-5grf-ff96","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-c6hw-5grf-ff96","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-c6hw-5grf-ff96"},{"rule_id":"osv/GHSA-f2g6-542v-9j58","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-f2g6-542v-9j58","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-f2g6-542v-9j58"},{"rule_id":"osv/GHSA-g7cr-3p24-7wf7","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-g7cr-3p24-7wf7","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-g7cr-3p24-7wf7"},{"rule_id":"osv/GHSA-gg2r-wvfm-q9rx","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-gg2r-wvfm-q9rx","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-gg2r-wvfm-q9rx"},{"rule_id":"osv/GHSA-j4m9-6w36-pw47","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-j4m9-6w36-pw47","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-j4m9-6w36-pw47"},{"rule_id":"osv/GHSA-jg86-v3jv-hrpm","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-jg86-v3jv-hrpm","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-jg86-v3jv-hrpm"},{"rule_id":"osv/GHSA-mrfp-p49p-3hf2","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-mrfp-p49p-3hf2","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-mrfp-p49p-3hf2"},{"rule_id":"osv/GHSA-p4wg-p73j-c528","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-p4wg-p73j-c528","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-p4wg-p73j-c528"},{"rule_id":"osv/GHSA-q45j-58j2-45rg","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-q45j-58j2-45rg","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-q45j-58j2-45rg"},{"rule_id":"osv/GHSA-xcvg-w56q-r89m","severity":"high","message":"pillow@11.3.0 (PyPI) is affected by GHSA-xcvg-w56q-r89m","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-xcvg-w56q-r89m"},{"rule_id":"osv/GHSA-wp53-j4wj-2cfg","severity":"high","message":"python-multipart@0.0.20 (PyPI) is affected by PYSEC-2026-1852, GHSA-wp53-j4wj-2cfg","path":"server/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.20 (PyPI):GHSA-wp53-j4wj-2cfg"},{"rule_id":"osv/GHSA-5rvq-cxj2-64vf","severity":"high","message":"python-multipart@0.0.20 (PyPI) is affected by PYSEC-2026-3036, GHSA-5rvq-cxj2-64vf","path":"server/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.20 (PyPI):GHSA-5rvq-cxj2-64vf"},{"rule_id":"osv/GHSA-pp6c-gr5w-3c5g","severity":"high","message":"python-multipart@0.0.20 (PyPI) is affected by PYSEC-2026-3039, GHSA-pp6c-gr5w-3c5g","path":"server/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.20 (PyPI):GHSA-pp6c-gr5w-3c5g"},{"rule_id":"osv/GHSA-m9gg-hp2v-232j","severity":"high","message":"@grpc/grpc-js@1.9.16 (npm) is affected by GHSA-m9gg-hp2v-232j","path":"web/package-lock.json","line":null,"fingerprint":"@grpc/grpc-js@1.9.16 (npm):GHSA-m9gg-hp2v-232j"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.15 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"web/package-lock.json","line":null,"fingerprint":"nanoid@3.3.15 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.15 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"web/package-lock.json","line":null,"fingerprint":"nanoid@3.3.15 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.16 (npm) is affected by GHSA-r28c-9q8g-f849","path":"web/package-lock.json","line":null,"fingerprint":"postcss@8.5.16 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"web/package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@6.4.3 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"web/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/PYSEC-2023-175","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2023-175","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):PYSEC-2023-175"},{"rule_id":"osv/GHSA-wjx4-4jcj-g98j","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-wjx4-4jcj-g98j"},{"rule_id":"osv/GHSA-4x4j-2g7c-83w6","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-4x4j-2g7c-83w6"},{"rule_id":"osv/GHSA-r73j-pqj5-w3x7","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-r73j-pqj5-w3x7"},{"rule_id":"osv/GHSA-fj7v-r99m-22gq","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-fj7v-r99m-22gq"},{"rule_id":"osv/GHSA-p8hx-v2p6-rp84","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-p8hx-v2p6-rp84"},{"rule_id":"osv/GHSA-4rm8-3hmm-39fg","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-4rm8-3hmm-39fg"},{"rule_id":"osv/GHSA-24rc-8hj2-v98c","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-24rc-8hj2-v98c","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-24rc-8hj2-v98c"},{"rule_id":"osv/GHSA-254f-3936-288h","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-254f-3936-288h","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-254f-3936-288h"},{"rule_id":"osv/GHSA-462x-pgg6-55fp","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-462x-pgg6-55fp","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-462x-pgg6-55fp"},{"rule_id":"osv/GHSA-74r2-7ff9-mjj2","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-74r2-7ff9-mjj2","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-74r2-7ff9-mjj2"},{"rule_id":"osv/GHSA-fc9g-5qg7-mf45","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-fc9g-5qg7-mf45","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-fc9g-5qg7-mf45"},{"rule_id":"osv/GHSA-rfgq-q3w2-pmv2","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-rfgq-q3w2-pmv2","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-rfgq-q3w2-pmv2"},{"rule_id":"osv/GHSA-vx6w-vv9f-6gvg","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-vx6w-vv9f-6gvg","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-vx6w-vv9f-6gvg"},{"rule_id":"osv/GHSA-wqgw-9xfh-qf2g","severity":"medium","message":"pillow@10.0.0 (PyPI) is affected by GHSA-wqgw-9xfh-qf2g","path":"functions/requirements.txt","line":null,"fingerprint":"pillow@10.0.0 (PyPI):GHSA-wqgw-9xfh-qf2g"},{"rule_id":"osv/GHSA-9hjg-9r4m-mvj7","severity":"medium","message":"requests@2.31.0 (PyPI) is affected by PYSEC-2026-1872, GHSA-9hjg-9r4m-mvj7","path":"functions/requirements.txt","line":null,"fingerprint":"requests@2.31.0 (PyPI):GHSA-9hjg-9r4m-mvj7"},{"rule_id":"osv/GHSA-9wx4-h78v-vm56","severity":"medium","message":"requests@2.31.0 (PyPI) is affected by PYSEC-2026-1873, GHSA-9wx4-h78v-vm56","path":"functions/requirements.txt","line":null,"fingerprint":"requests@2.31.0 (PyPI):GHSA-9wx4-h78v-vm56"},{"rule_id":"osv/GHSA-gc5v-m9x4-r6x2","severity":"medium","message":"requests@2.31.0 (PyPI) is affected by PYSEC-2026-2275, GHSA-gc5v-m9x4-r6x2","path":"functions/requirements.txt","line":null,"fingerprint":"requests@2.31.0 (PyPI):GHSA-gc5v-m9x4-r6x2"},{"rule_id":"osv/GHSA-wjx4-4jcj-g98j","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-165, GHSA-wjx4-4jcj-g98j","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-wjx4-4jcj-g98j"},{"rule_id":"osv/GHSA-5xmw-vc9v-4wf2","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2251, GHSA-5xmw-vc9v-4wf2","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-5xmw-vc9v-4wf2"},{"rule_id":"osv/GHSA-4x4j-2g7c-83w6","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2257, GHSA-4x4j-2g7c-83w6","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-4x4j-2g7c-83w6"},{"rule_id":"osv/GHSA-r73j-pqj5-w3x7","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-2874, GHSA-r73j-pqj5-w3x7","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-r73j-pqj5-w3x7"},{"rule_id":"osv/GHSA-fj7v-r99m-22gq","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-3494, GHSA-fj7v-r99m-22gq","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-fj7v-r99m-22gq"},{"rule_id":"osv/GHSA-654x-cwwv-5j9c","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4336, GHSA-654x-cwwv-5j9c","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-654x-cwwv-5j9c"},{"rule_id":"osv/GHSA-p8hx-v2p6-rp84","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-p8hx-v2p6-rp84"},{"rule_id":"osv/GHSA-4rm8-3hmm-39fg","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-4rm8-3hmm-39fg"},{"rule_id":"osv/GHSA-24rc-8hj2-v98c","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by GHSA-24rc-8hj2-v98c","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-24rc-8hj2-v98c"},{"rule_id":"osv/GHSA-254f-3936-288h","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by GHSA-254f-3936-288h","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-254f-3936-288h"},{"rule_id":"osv/GHSA-462x-pgg6-55fp","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by GHSA-462x-pgg6-55fp","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-462x-pgg6-55fp"},{"rule_id":"osv/GHSA-74r2-7ff9-mjj2","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by GHSA-74r2-7ff9-mjj2","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-74r2-7ff9-mjj2"},{"rule_id":"osv/GHSA-fc9g-5qg7-mf45","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by GHSA-fc9g-5qg7-mf45","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-fc9g-5qg7-mf45"},{"rule_id":"osv/GHSA-rfgq-q3w2-pmv2","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by GHSA-rfgq-q3w2-pmv2","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-rfgq-q3w2-pmv2"},{"rule_id":"osv/GHSA-vx6w-vv9f-6gvg","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by GHSA-vx6w-vv9f-6gvg","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-vx6w-vv9f-6gvg"},{"rule_id":"osv/GHSA-wqgw-9xfh-qf2g","severity":"medium","message":"pillow@11.3.0 (PyPI) is affected by GHSA-wqgw-9xfh-qf2g","path":"server/requirements.txt","line":null,"fingerprint":"pillow@11.3.0 (PyPI):GHSA-wqgw-9xfh-qf2g"},{"rule_id":"osv/GHSA-mj87-hwqh-73pj","severity":"medium","message":"python-multipart@0.0.20 (PyPI) is affected by PYSEC-2026-3038, GHSA-mj87-hwqh-73pj","path":"server/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.20 (PyPI):GHSA-mj87-hwqh-73pj"},{"rule_id":"osv/GHSA-gc5v-m9x4-r6x2","severity":"medium","message":"requests@2.32.5 (PyPI) is affected by PYSEC-2026-2275, GHSA-gc5v-m9x4-r6x2","path":"server/requirements.txt","line":null,"fingerprint":"requests@2.32.5 (PyPI):GHSA-gc5v-m9x4-r6x2"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.16 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"web/package-lock.json","line":null,"fingerprint":"postcss@8.5.16 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-j3f2-48v5-ccww","severity":"medium","message":"protobufjs@7.6.4 (npm) is affected by GHSA-j3f2-48v5-ccww","path":"web/package-lock.json","line":null,"fingerprint":"protobufjs@7.6.4 (npm):GHSA-j3f2-48v5-ccww"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@6.4.3 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"web/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@6.4.3 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"web/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@6.4.3 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"web/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-6jv3-5f52-599m","severity":"low","message":"python-multipart@0.0.20 (PyPI) is affected by PYSEC-2026-3037, GHSA-6jv3-5f52-599m","path":"server/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.20 (PyPI):GHSA-6jv3-5f52-599m"},{"rule_id":"osv/GHSA-v9pg-7xvm-68hf","severity":"low","message":"python-multipart@0.0.20 (PyPI) is affected by PYSEC-2026-3040, GHSA-v9pg-7xvm-68hf","path":"server/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.20 (PyPI):GHSA-v9pg-7xvm-68hf"},{"rule_id":"osv/GHSA-vffw-93wf-4j4q","severity":"low","message":"python-multipart@0.0.20 (PyPI) is affected by PYSEC-2026-3041, GHSA-vffw-93wf-4j4q","path":"server/requirements.txt","line":null,"fingerprint":"python-multipart@0.0.20 (PyPI):GHSA-vffw-93wf-4j4q"},{"rule_id":"osv/GHSA-f596-whhp-79r4","severity":"low","message":"@grpc/grpc-js@1.9.16 (npm) is affected by GHSA-f596-whhp-79r4","path":"web/package-lock.json","line":null,"fingerprint":"@grpc/grpc-js@1.9.16 (npm):GHSA-f596-whhp-79r4"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@6.4.3 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"web/package-lock.json","line":null,"fingerprint":"vite@6.4.3 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["PyPI","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: https://github.com/google-gemini/glanceboard/security/policy","ref":"https://github.com/google-gemini/glanceboard/security/policy","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":308.0,"function_nloc":5535.0,"mean_ccn":5.22,"p90_ccn":13.0,"complex_functions":19.0,"long_functions":5.0,"many_param_functions":3.0,"risky_nloc_share":0.3438},"findings":[],"evidence":[{"kind":"complex-function","description":"build_prompt in server/app.py: complexity 119, 394 lines","ref":"server/app.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/server/app.py#L1457","weight":1.0},{"kind":"complex-function","description":"build_prompt in functions/main.py: complexity 67, 259 lines","ref":"functions/main.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/functions/main.py#L901","weight":1.0},{"kind":"complex-function","description":"_generate_for_device in functions/main.py: complexity 43, 210 lines","ref":"functions/main.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/functions/main.py#L1393","weight":0.7166666666666667},{"kind":"complex-function","description":"loadSettings in web/src/main.js: complexity 39, 84 lines","ref":"web/src/main.js","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L1598","weight":0.65},{"kind":"complex-function","description":"_generate_for_device in server/app.py: complexity 33, 160 lines","ref":"server/app.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/server/app.py#L2116","weight":0.55},{"kind":"complex-function","description":"scheduled_generate in functions/main.py: complexity 31, 106 lines","ref":"functions/main.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/functions/main.py#L2005","weight":0.5166666666666667},{"kind":"complex-function","description":"getDoc in web/src/main.js: complexity 24, 34 lines","ref":"web/src/main.js","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L55","weight":0.4},{"kind":"complex-function","description":"loadDashboard in web/src/main.js: complexity 23, 76 lines","ref":"web/src/main.js","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L549","weight":0.38333333333333336},{"kind":"complex-function","description":"humanize_events_via_gemini in server/app.py: complexity 21, 59 lines","ref":"server/app.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/server/app.py#L1102","weight":0.35},{"kind":"complex-function","description":"buildCapabilities in web/src/main.js: complexity 20, 16 lines","ref":"web/src/main.js","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L674","weight":0.3333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":6817.0,"duplicated_lines":2516.0,"duplicated_share":0.3691,"files":8.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: functions/main.py:1 and pi/display_update.py:2","ref":"functions/main.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/functions/main.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: functions/main.py:9 and server/app.py:9","ref":"functions/main.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/functions/main.py#L9","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: functions/main.py:446 and functions/main.py:539","ref":"functions/main.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/functions/main.py#L446","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: pi/install.sh:1 and pi/setup_pi.sh:1","ref":"pi/install.sh","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/pi/install.sh#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: server/app.py:470 and server/app.py:620","ref":"server/app.py","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/server/app.py#L470","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: web/src/config.example.js:2 and web/src/main.js:2","ref":"web/src/config.example.js","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/config.example.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: web/src/main.js:369 and web/src/main.js:1618","ref":"web/src/main.js","url":"https://github.com/google-gemini/glanceboard/blob/14db572628b70312025ee19c5de6228cc4ad7c27/web/src/main.js#L369","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":24.0,"weighted_findings":29.0,"scanned_lines":8811.0,"category:best-practice":19.0,"category:correctness":5.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pi/display_update.py","line":156,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pi/display_update.py:156"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pi/display_update.py","line":414,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pi/display_update.py:414"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pi/display_update.py","line":435,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pi/display_update.py:435"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"pi/display_update.py","line":514,"fingerprint":"python.lang.best-practice.arbitrary-sleep:pi/display_update.py:514"},{"rule_id":"opengrep/python.requests.best-practice.use-timeout","severity":"medium","message":"Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a timeout for all 'requests'.","path":"functions/main.py","line":1861,"fingerprint":"python.requests.best-practice.use-timeout:functions/main.py:1861"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"pi/display_update.py","line":279,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:pi/display_update.py:279"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"pi/display_update.py","line":287,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:pi/display_update.py:287"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"pi/display_update.py","line":361,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:pi/display_update.py:361"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"server/app.py","line":678,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:server/app.py:678"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"server/app.py","line":1819,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:server/app.py:1819"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"server/app.py","line":2357,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:server/app.py:2357"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"server/app.py","line":2372,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:server/app.py:2372"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"server/app.py","line":2519,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:server/app.py:2519"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"web/src/main.js","line":1140,"fingerprint":"javascript.lang.best-practice.javascript-confirm:web/src/main.js:1140"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"web/src/main.js","line":1420,"fingerprint":"javascript.lang.best-practice.javascript-confirm:web/src/main.js:1420"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"web/src/main.js","line":1556,"fingerprint":"javascript.lang.best-practice.javascript-confirm:web/src/main.js:1556"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"web/src/main.js","line":2031,"fingerprint":"javascript.lang.best-practice.javascript-confirm:web/src/main.js:2031"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"web/src/main.js","line":2069,"fingerprint":"javascript.lang.best-practice.javascript-confirm:web/src/main.js:2069"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"web/src/main.js","line":2080,"fingerprint":"javascript.lang.best-practice.javascript-confirm:web/src/main.js:2080"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-confirm","severity":"medium","message":"found confirm() call; should this be in production code?","path":"web/src/main.js","line":2269,"fingerprint":"javascript.lang.best-practice.javascript-confirm:web/src/main.js:2269"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/src/main.js","line":1472,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/src/main.js:1472"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/src/main.js","line":1472,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/src/main.js:1472"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/src/main.js","line":1503,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/src/main.js:1503"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"web/src/main.js","line":1503,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:web/src/main.js:1503"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":8811.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":1.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":217.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}