{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:44:14.509234Z","repo":{"ref":{"host":"github.com","owner":"mitsuhiko","name":"mini-presenter"},"default_branch":"main","clone_url":"https://github.com/mitsuhiko/mini-presenter.git","html_url":"https://github.com/mitsuhiko/mini-presenter","description":null,"stars":78,"forks":4,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2590,"primary_language":"TypeScript","license_spdx":"Apache-2.0","created_at":"2026-01-27T15:10:50Z","pushed_at":"2026-11-08T22:20:47Z","security_policy_url":null,"distribution":{"owner_created_at":"2008-04-15T10:03:57Z","owner_type":"User","release_assets":[]}},"commit_sha":"8dd9a896e44d6aa5357bb293f841efb0e770b829","profile":{"lines_by_language":{"TypeScript":8729,"JavaScript":17},"files_by_category":{"source":51,"other":9,"config":8,"docs":8,"test":5,"binary":2,"oversized":1,"generated":1},"source_lines":8128,"test_lines":618},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.61,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.0766,"estimated_share":0.0,"ai_artifacts":1.0,"flagged_work_units":1.0,"flagged_releases":0.0},"summary":"Weak signals consistent with AI-assisted development."},"quality":{"score":79.6,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":73.6,"duplication":100.0,"lint":88.4,"testing":60.8,"docs":85.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.08, CI runs tests; 10% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing."},"security":{"score":69.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":72.2,"dependencies":87.5,"ci_actions":39.1,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 2 known vulnerabilities in 1 dependencies; 2 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":10.0,"checked":10.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":86.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":20276.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-01":{"loc":8197,"attributed_loc":0},"2026-03":{"loc":3225,"attributed_loc":0},"2026-04":{"loc":106,"attributed_loc":0},"2026-11":{"loc":8748,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1794036961.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/mitsuhiko/mini-presenter/blob/8dd9a896e44d6aa5357bb293f841efb0e770b829/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"generic-agent","path":"AGENTS.md","added_at":1794036961}],"workflows":[],"tools":["generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":23.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":11648.0,"flagged_loc":1553.0,"flagged_loc_share":0.1333276098901099,"max_loc_per_hour":1098.8207547169811,"median_loc_per_hour":153.35340465056692,"pr_timed_units":0.0,"excluded_import_loc":8628.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,553 lines of first-party code in ~1.4h (1,099 lines/hour, 3 commit session)","ref":"72c577f5ee7829c398db0c4b007e8b0a3b6e6bf7","url":"https://github.com/mitsuhiko/mini-presenter/commit/72c577f5ee7829c398db0c4b007e8b0a3b6e6bf7","weight":0.3296462264150943}],"data":{"flagged_loc_by_commit":{"945a7df510d66f7e1534d1220fd71c9ea6dd345e":883,"32b73e3a7b85e8f1d6c86c87b339e30fdc77156d":371,"72c577f5ee7829c398db0c4b007e8b0a3b6e6bf7":299},"excluded_import_commits":["7077d6a990fec4cfcb5111c47fc7adef7ee8f346"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":6.0,"flagged_releases":0.0,"max_loc_per_day":3352.8},"findings":[],"evidence":[],"data":{"releases":[{"from":"0.1.0","to":"0.2.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"0.2.0","to":"0.3.0","loc":165,"days":0.05,"loc_per_day":3352.8,"flagged":false},{"from":"0.3.0","to":"0.4.0","loc":5627,"days":40.12,"loc_per_day":140.3,"flagged":false},{"from":"0.4.0","to":"0.5.0","loc":2848,"days":22.47,"loc_per_day":126.8,"flagged":false},{"from":"0.5.0","to":"0.5.1","loc":1,"days":1.54,"loc_per_day":0.7,"flagged":false},{"from":"0.5.1","to":"0.6.0","loc":225,"days":220.4,"loc_per_day":1.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":8128.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":22.0,"findings_high":2.0,"findings_medium":20.0,"findings_low":0.0,"weighted_findings":7.55,"scanned_lines":8128.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/client/display/overlay.ts","line":88,"fingerprint":"javascript.browser.security.insecure-document-method:src/client/display/overlay.ts:88"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `shadow.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/client/display/overlay.ts","line":88,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/client/display/overlay.ts:88"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/client/display/overlay.ts","line":65,"fingerprint":"javascript.lang.security.html-in-template-string:src/client/display/overlay.ts:65"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/client/display/overlay.ts","line":88,"fingerprint":"javascript.lang.security.html-in-template-string:src/client/display/overlay.ts:88"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/client/display/overlay.ts","line":107,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/client/display/overlay.ts:107"},{"rule_id":"opengrep/javascript.browser.security.wildcard-postmessage-configuration","severity":"medium","message":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium]","path":"src/client/display/preview.ts","line":54,"fingerprint":"javascript.browser.security.wildcard-postmessage-configuration:src/client/display/preview.ts:54"},{"rule_id":"opengrep/javascript.browser.security.wildcard-postmessage-configuration","severity":"medium","message":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium]","path":"src/client/presenter/components/PreviewFrame.tsx","line":69,"fingerprint":"javascript.browser.security.wildcard-postmessage-configuration:src/client/presenter/components/PreviewFrame.tsx:69"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/client/presenter/index.tsx","line":35,"fingerprint":"javascript.lang.security.html-in-template-string:src/client/presenter/index.tsx:35"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/client/presenter/index.tsx","line":37,"fingerprint":"javascript.lang.security.html-in-template-string:src/client/presenter/index.tsx:37"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/client/standalone.ts","line":74,"fingerprint":"javascript.lang.security.html-in-template-string:src/client/standalone.ts:74"},{"rule_id":"opengrep/javascript.browser.security.raw-html-concat","severity":"medium","message":"User controlled data in a HTML string may result in XSS [confidence medium]","path":"src/client/standalone.ts","line":74,"fingerprint":"javascript.browser.security.raw-html-concat:src/client/standalone.ts:74"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/client/standalone.ts","line":75,"fingerprint":"javascript.lang.security.html-in-template-string:src/client/standalone.ts:75"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/client/standalone.ts","line":76,"fingerprint":"javascript.lang.security.html-in-template-string:src/client/standalone.ts:76"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/client/standalone.ts","line":84,"fingerprint":"javascript.lang.security.html-in-template-string:src/client/standalone.ts:84"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/client/standalone.ts","line":85,"fingerprint":"javascript.lang.security.html-in-template-string:src/client/standalone.ts:85"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/client/ui/icons.tsx","line":121,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/client/ui/icons.tsx:121"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/server/inject.ts","line":3,"fingerprint":"javascript.lang.security.html-in-template-string:src/server/inject.ts:3"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/server/inject.ts","line":19,"fingerprint":"javascript.lang.security.html-in-template-string:src/server/inject.ts:19"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/server/inject.ts","line":20,"fingerprint":"javascript.lang.security.html-in-template-string:src/server/inject.ts:20"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/server/qr.ts","line":42,"fingerprint":"javascript.lang.security.html-in-template-string:src/server/qr.ts:42"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/server/qr.ts","line":43,"fingerprint":"javascript.lang.security.html-in-template-string:src/server/qr.ts:43"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^\\s*([-*_])(\\s*\\1){2,}\\s*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"src/shared/notes.ts","line":158,"fingerprint":"javascript.lang.security.audit.detect-redos:src/shared/notes.ts:158"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":1.0,"vulnerabilities":2.0,"vulns_critical":0.0,"vulns_high":1.0,"vulns_medium":1.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":8.0},"findings":[{"rule_id":"osv/GHSA-96hv-2xvq-fx4p","severity":"high","message":"ws@8.19.0 (npm) is affected by GHSA-96hv-2xvq-fx4p","path":"package-lock.json","line":null,"fingerprint":"ws@8.19.0 (npm):GHSA-96hv-2xvq-fx4p"},{"rule_id":"osv/GHSA-58qx-3vcg-4xpx","severity":"medium","message":"ws@8.19.0 (npm) is affected by GHSA-58qx-3vcg-4xpx","path":"package-lock.json","line":null,"fingerprint":"ws@8.19.0 (npm):GHSA-58qx-3vcg-4xpx"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":8.0,"findings_high":5.0,"findings_medium":3.0,"findings_low":0.0,"penalty":56.4},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":15,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:15"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":15,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:15"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:18"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/publish.yml","line":18,"fingerprint":"cache-poisoning:.github/workflows/publish.yml:18"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":15,"fingerprint":"artipacked:.github/workflows/ci.yml:15"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:9"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":15,"fingerprint":"artipacked:.github/workflows/publish.yml:15"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0116,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":805.0,"function_nloc":6271.0,"mean_ccn":2.63,"p90_ccn":6.0,"complex_functions":5.0,"long_functions":3.0,"many_param_functions":0.0,"risky_nloc_share":0.1024},"findings":[],"evidence":[{"kind":"complex-function","description":"compute in src/client/presenter/timer.ts: complexity 35, 65 lines","ref":"src/client/presenter/timer.ts","url":"https://github.com/mitsuhiko/mini-presenter/blob/8dd9a896e44d6aa5357bb293f841efb0e770b829/src/client/presenter/timer.ts#L184","weight":0.5833333333333334},{"kind":"complex-function","description":"SettingsDialog in src/client/presenter/components/SettingsDialog.tsx: complexity 19, 211 lines","ref":"src/client/presenter/components/SettingsDialog.tsx","url":"https://github.com/mitsuhiko/mini-presenter/blob/8dd9a896e44d6aa5357bb293f841efb0e770b829/src/client/presenter/components/SettingsDialog.tsx#L150","weight":0.31666666666666665},{"kind":"complex-function","description":"onKeyDown in src/client/presenter/index.tsx: complexity 18, 40 lines","ref":"src/client/presenter/index.tsx","url":"https://github.com/mitsuhiko/mini-presenter/blob/8dd9a896e44d6aa5357bb293f841efb0e770b829/src/client/presenter/index.tsx#L72","weight":0.3},{"kind":"complex-function","description":"captureAll in src/export/export.ts: complexity 17, 48 lines","ref":"src/export/export.ts","url":"https://github.com/mitsuhiko/mini-presenter/blob/8dd9a896e44d6aa5357bb293f841efb0e770b829/src/export/export.ts#L157","weight":0.2833333333333333},{"kind":"complex-function","description":"runExport in src/cli.ts: complexity 16, 53 lines","ref":"src/cli.ts","url":"https://github.com/mitsuhiko/mini-presenter/blob/8dd9a896e44d6aa5357bb293f841efb0e770b829/src/cli.ts#L205","weight":0.26666666666666666},{"kind":"complex-function","description":"startServer in src/server/index.ts: complexity 15, 111 lines","ref":"src/server/index.ts","url":"https://github.com/mitsuhiko/mini-presenter/blob/8dd9a896e44d6aa5357bb293f841efb0e770b829/src/server/index.ts#L75","weight":0.25},{"kind":"complex-function","description":"createPresenterModel in src/client/presenter/model.ts: complexity 3, 114 lines","ref":"src/client/presenter/model.ts","url":"https://github.com/mitsuhiko/mini-presenter/blob/8dd9a896e44d6aa5357bb293f841efb0e770b829/src/client/presenter/model.ts#L68","weight":0.05}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5928.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":51.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":10.0,"weighted_findings":4.0,"scanned_lines":8128.0,"category:best-practice":2.0,"category:correctness":8.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/server/qr.ts","line":18,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/server/qr.ts:18"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/server/qr.ts","line":19,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/server/qr.ts:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/client/display/overlay.ts","line":6,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/client/display/overlay.ts:6"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/client/display/overlay.ts","line":6,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/client/display/overlay.ts:6"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/client/presenter/components/Controls.tsx","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/client/presenter/components/Controls.tsx:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/client/presenter/components/Controls.tsx","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/client/presenter/components/Controls.tsx:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/client/presenter/components/Header.tsx","line":110,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/client/presenter/components/Header.tsx:110"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/client/presenter/components/Header.tsx","line":110,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/client/presenter/components/Header.tsx:110"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/export/export.ts","line":258,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/export/export.ts:258"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/export/export.ts","line":258,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/export/export.ts:258"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1521,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.2,"test_lines":618.0,"source_lines":8128.0,"test_ratio":0.076,"ci_files":2.0,"cochange_share":0.05,"cochange_commits":60.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/publish.yml","ref":".github/workflows/publish.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":297.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.base.json","ref":"tsconfig.base.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}