{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:26:07.508557Z","repo":{"ref":{"host":"github.com","owner":"ha","name":"doozerd"},"default_branch":"master","clone_url":"https://github.com/ha/doozerd.git","html_url":"https://github.com/ha/doozerd","description":"A consistent distributed data store.","stars":3246,"forks":263,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3678,"primary_language":"Go","license_spdx":"MIT","created_at":"2011-04-19T03:35:05Z","pushed_at":"2016-03-16T04:01:32Z","security_policy_url":null,"distribution":{"owner_created_at":"2011-04-12T00:46:53Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"8adec5411b39dbcc94c02b3669ee06379ec83ead","profile":{"lines_by_language":{"Go":6854,"JavaScript":136,"Shell":38},"files_by_category":{"source":33,"test":26,"other":14,"docs":9,"binary":3,"config":2,"generated":2},"source_lines":3139,"test_lines":3889},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":76.8,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":84.0,"duplication":81.3,"lint":81.9,"testing":70.0,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 1.24, no CI test run detected; 6% of function code in complex or long functions; 3% duplicated lines. Weakest area: docs."},"security":{"score":69.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":65.1,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 2 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1612.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":42632.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2010-07":{"loc":190,"attributed_loc":0},"2010-08":{"loc":10028,"attributed_loc":0},"2010-09":{"loc":7223,"attributed_loc":0},"2010-10":{"loc":2887,"attributed_loc":0},"2010-11":{"loc":3769,"attributed_loc":0},"2010-12":{"loc":2339,"attributed_loc":0},"2011-01":{"loc":3697,"attributed_loc":0},"2011-02":{"loc":4725,"attributed_loc":0},"2011-03":{"loc":2791,"attributed_loc":0},"2011-04":{"loc":1256,"attributed_loc":0},"2011-05":{"loc":2311,"attributed_loc":0},"2011-06":{"loc":804,"attributed_loc":0},"2011-09":{"loc":29,"attributed_loc":0},"2011-12":{"loc":251,"attributed_loc":0},"2012-01":{"loc":174,"attributed_loc":0},"2012-02":{"loc":35,"attributed_loc":0},"2012-03":{"loc":14,"attributed_loc":0},"2012-05":{"loc":0,"attributed_loc":0},"2013-02":{"loc":0,"attributed_loc":0},"2013-03":{"loc":60,"attributed_loc":0},"2013-04":{"loc":0,"attributed_loc":0},"2013-05":{"loc":49,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":536.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":42632.0,"pre_ai_era_burst_loc":0.0,"measured_loc":42632.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":272.1556886227545,"median_loc_per_hour":58.574167678788314,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":10.0,"flagged_releases":0.0,"max_loc_per_day":239.5},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0","to":"works","loc":25522,"days":138.95,"loc_per_day":183.7,"flagged":false},{"from":"works","to":"v0.1","loc":3873,"days":36.05,"loc_per_day":107.4,"flagged":false},{"from":"v0.1","to":"v0.2","loc":485,"days":6.95,"loc_per_day":69.8,"flagged":false},{"from":"v0.2","to":"v0.3","loc":80,"days":0.33,"loc_per_day":239.5,"flagged":false},{"from":"v0.3","to":"v0.3.1","loc":736,"days":14.79,"loc_per_day":49.8,"flagged":false},{"from":"v0.3.1","to":"v0.4","loc":6911,"days":40.84,"loc_per_day":169.2,"flagged":false},{"from":"v0.4","to":"v0.5","loc":173,"days":20.97,"loc_per_day":8.3,"flagged":false},{"from":"v0.5","to":"v0.6","loc":1118,"days":14.08,"loc_per_day":79.4,"flagged":false},{"from":"v0.6","to":"v0.7","loc":1085,"days":9.16,"loc_per_day":118.4,"flagged":false},{"from":"v0.7","to":"v0.8","loc":1945,"days":37.8,"loc_per_day":51.5,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":3139.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":7.0,"findings_high":2.0,"findings_medium":5.0,"findings_low":0.0,"weighted_findings":3.85,"scanned_lines":3139.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"web/main.js","line":90,"fingerprint":"javascript.lang.security.detect-insecure-websocket:web/main.js:90"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"web/main.js.go","line":5,"fingerprint":"javascript.lang.security.detect-insecure-websocket:web/main.js.go:5"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"consensus/run.go","line":8,"fingerprint":"go.lang.security.audit.crypto.math-random-used:consensus/run.go:8"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"doozerd.go","line":154,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:doozerd.go:154"},{"rule_id":"opengrep/javascript.express.security.audit.xss.mustache.var-in-script-tag","severity":"medium","message":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of  [confidence low]","path":"web/main.html","line":26,"fingerprint":"javascript.express.security.audit.xss.mustache.var-in-script-tag:web/main.html:26"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"web/web.go","line":13,"fingerprint":"go.lang.security.audit.xss.import-text-template:web/web.go:13"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-io-writestring-to-responsewriter","severity":"medium","message":"Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low]","path":"web/web.go","line":36,"fingerprint":"go.lang.security.audit.xss.no-io-writestring-to-responsewriter:web/web.go:36"}],"evidence":[],"data":{"rulesets":["go","javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":179.0,"function_nloc":2111.0,"mean_ccn":3.1,"p90_ccn":6.0,"complex_functions":2.0,"long_functions":0.0,"many_param_functions":1.0,"risky_nloc_share":0.0583},"findings":[],"evidence":[{"kind":"complex-function","description":"process in store/store.go: complexity 22, 59 lines","ref":"store/store.go","url":"https://github.com/ha/doozerd/blob/8adec5411b39dbcc94c02b3669ee06379ec83ead/store/store.go#L207","weight":0.36666666666666664},{"kind":"complex-function","description":"main in doozerd.go: complexity 19, 64 lines","ref":"doozerd.go","url":"https://github.com/ha/doozerd/blob/8adec5411b39dbcc94c02b3669ee06379ec83ead/doozerd.go#L64","weight":0.31666666666666665}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":2086.0,"duplicated_lines":72.0,"duplicated_share":0.0345,"files":33.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: server/txn.go:57 and server/txn.go:190","ref":"server/txn.go","url":"https://github.com/ha/doozerd/blob/8adec5411b39dbcc94c02b3669ee06379ec83ead/server/txn.go#L57","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":10.0,"weighted_findings":2.5,"scanned_lines":3139.0,"category:correctness":10.0},"findings":[{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"dist.sh","line":3,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:dist.sh:3"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dist.sh","line":7,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dist.sh:7"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dist.sh","line":9,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dist.sh:9"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dist.sh","line":10,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dist.sh:10"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dist.sh","line":11,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dist.sh:11"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dist.sh","line":12,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dist.sh:12"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"dist.sh","line":13,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:dist.sh:13"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"make.sh","line":15,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:make.sh:15"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"make.sh","line":16,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:make.sh:16"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"make.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:make.sh:17"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":3889.0,"source_lines":3139.0,"test_ratio":1.2389,"ci_files":1.0,"cochange_share":0.4842,"cochange_commits":190.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":92.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}