{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:13:51.839076Z","repo":{"ref":{"host":"github.com","owner":"romainsimon","name":"paperasse"},"default_branch":"master","clone_url":"https://github.com/romainsimon/paperasse.git","html_url":"https://github.com/romainsimon/paperasse","description":"🇫🇷  Skills pour agents IA spécialisés dans la bureaucratie française : Comptable, Notaire, ...","stars":2597,"forks":199,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1533,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-02-05T17:51:26Z","pushed_at":"2026-11-12T15:12:52Z","security_policy_url":null,"distribution":{"owner_created_at":"2012-05-12T22:48:30Z","owner_type":"User","release_assets":[]}},"commit_sha":"6fd0981cf677ae8304589f09ab4601b6c1c3eddd","profile":{"lines_by_language":{"JavaScript":14121,"Python":6848},"files_by_category":{"config":154,"docs":129,"source":49,"other":13,"test":8,"binary":2,"generated":1},"source_lines":19624,"test_lines":1345},"pillars":{"ai_provenance":{"score":79.5,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.7953,"suspected_share":0.0,"estimated_share":0.7953,"ai_artifacts":0.0,"flagged_work_units":1.0,"flagged_releases":null},"summary":"Explicit AI attribution on 80% of first-party code added; an estimated 80% including velocity signals."},"quality":{"score":46.9,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":46.5,"duplication":0.8,"lint":57.5,"testing":64.7,"docs":80.0,"type_safety":0.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.07, CI runs tests; 25% of function code in complex or long functions; 80% duplicated lines. Weakest area: type safety."},"security":{"score":51.0,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":54.3,"dependencies":42.7,"ci_actions":2.1,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 26 known vulnerabilities in 7 dependencies; 1 high-severity SAST findings; 19 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":5.0,"checked":5.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":157.0,"attributed_commits":93.0,"attributed_commit_share":0.5923566878980892,"effective_loc":21695.0,"attributed_loc":17254.0,"attributed_loc_share":0.7952984558654068,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 92 attributed commits, 17,254 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 1 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/bilan-depreciations-169'","ref":"6fd0981cf677ae8304589f09ab4601b6c1c3eddd","url":"https://github.com/romainsimon/paperasse/commit/6fd0981cf677ae8304589f09ab4601b6c1c3eddd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/syndic-plan-comptable-copro'","ref":"1dbeaaec5841c6cb66fa06a0117b53ec86f94de8","url":"https://github.com/romainsimon/paperasse/commit/1dbeaaec5841c6cb66fa06a0117b53ec86f94de8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ea7e07b6498160b7e0eb79f9cbc4ce76c04f3223","url":"https://github.com/romainsimon/paperasse/commit/ea7e07b6498160b7e0eb79f9cbc4ce76c04f3223","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c561fab096a6e4709c9e140935b6f11987b88b38","url":"https://github.com/romainsimon/paperasse/commit/c561fab096a6e4709c9e140935b6f11987b88b38","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a3345ab00ef0e393cb99999f4f3010952a52bfd1","url":"https://github.com/romainsimon/paperasse/commit/a3345ab00ef0e393cb99999f4f3010952a52bfd1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"efbb4a8d51be0de3b1d4aa1182ffbe7c6457939d","url":"https://github.com/romainsimon/paperasse/commit/efbb4a8d51be0de3b1d4aa1182ffbe7c6457939d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/directory-real-files'","ref":"72dd17e4459f379e6ef4abdbc1b43d948e6aac6a","url":"https://github.com/romainsimon/paperasse/commit/72dd17e4459f379e6ef4abdbc1b43d948e6aac6a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/directory-plugin-manifest'","ref":"d49a2142fb60816bd9e9ece864f8b25e4867be90","url":"https://github.com/romainsimon/paperasse/commit/d49a2142fb60816bd9e9ece864f8b25e4867be90","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"bc019ea8e8c60fe1c0fbc7a063c7bc3255acff3a","url":"https://github.com/romainsimon/paperasse/commit/bc019ea8e8c60fe1c0fbc7a063c7bc3255acff3a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/conservation-10-ans'","ref":"5f8c41df8382c5ea768af59ed4aa346852444f2c","url":"https://github.com/romainsimon/paperasse/commit/5f8c41df8382c5ea768af59ed4aa346852444f2c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"23e2663f6e6061a651da905d036f884c273e45b2","url":"https://github.com/romainsimon/paperasse/commit/23e2663f6e6061a651da905d036f884c273e45b2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/fiscaliste-description-1024'","ref":"482d6033c39dafc752faa10400b50a334bdadc2a","url":"https://github.com/romainsimon/paperasse/commit/482d6033c39dafc752faa10400b50a334bdadc2a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/square-logo'","ref":"c2461162e278c9e17c69597f473b1bea0595f062","url":"https://github.com/romainsimon/paperasse/commit/c2461162e278c9e17c69597f473b1bea0595f062","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/readme-agents-grok-bot'","ref":"f7bdac2e86bfcbef8a34eb85526552acacf3709c","url":"https://github.com/romainsimon/paperasse/commit/f7bdac2e86bfcbef8a34eb85526552acacf3709c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/comptable-parse-einvoice-doc'","ref":"1db6fe9fdb428087687e10bade5f44dfc5d3f949","url":"https://github.com/romainsimon/paperasse/commit/1db6fe9fdb428087687e10bade5f44dfc5d3f949","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"9b7c09fce56e8210ce3d254239c642a74b7f548a","url":"https://github.com/romainsimon/paperasse/commit/9b7c09fce56e8210ce3d254239c642a74b7f548a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/eval-controleur-fiscal-bash'","ref":"75430283210a91d59cedfb7c87c86a706321a6d2","url":"https://github.com/romainsimon/paperasse/commit/75430283210a91d59cedfb7c87c86a706321a6d2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/controleur-fiscal-notaire'","ref":"e38a4e36aee3f61413293dfde41243f6d3c5f0b9","url":"https://github.com/romainsimon/paperasse/commit/e38a4e36aee3f61413293dfde41243f6d3c5f0b9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/readme-evals-2026-11'","ref":"54e38d56ad58e7f9c18cdc3ba7f46e83256028fd","url":"https://github.com/romainsimon/paperasse/commit/54e38d56ad58e7f9c18cdc3ba7f46e83256028fd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/skill-routing-per'","ref":"4ccd245ea63d7640a83443bc1ebcc0393e475504","url":"https://github.com/romainsimon/paperasse/commit/4ccd245ea63d7640a83443bc1ebcc0393e475504","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/restore-invoices-index'","ref":"0f2005480d1a58737034b93e50aeec7a303a50ca","url":"https://github.com/romainsimon/paperasse/commit/0f2005480d1a58737034b93e50aeec7a303a50ca","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/ci-calc-tests'","ref":"0f8432563d46b31a7a3d7697622c1788178b8ec0","url":"https://github.com/romainsimon/paperasse/commit/0f8432563d46b31a7a3d7697622c1788178b8ec0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/maintainer-fixes-2026-11'","ref":"b90b5c1d368418e8559ee683e615ec008215fdd7","url":"https://github.com/romainsimon/paperasse/commit/b90b5c1d368418e8559ee683e615ec008215fdd7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"7517301494e1314a498b84a73f093e7f134be8cb","url":"https://github.com/romainsimon/paperasse/commit/7517301494e1314a498b84a73f093e7f134be8cb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"8a263f00bfbb3b98508a5a927ed337a337cd1294","url":"https://github.com/romainsimon/paperasse/commit/8a263f00bfbb3b98508a5a927ed337a337cd1294","weight":0.9}],"data":{"attributed_loc_by_commit":{"243bade3911e5f4d63b643d3d04ad1151bdd0461":0,"483c55692c181d37f05c1dd271542b17cdbc00d3":412,"9c2afab7f152de583943673a6949ebbc46d923e5":395,"569ad0073568e4af7fa3ba9bf4019f2f2e55c783":0,"af5f1d3af4ac08f98f83434acf2b265967164171":0,"79f876f12a3dcdf113a9b605b451c6bc73c88610":0,"31af4b1a67aae63beb4c607091286ab30a0caf9e":1205,"2265892beeb2ffbab84d339125533a16bb12632f":0,"1c713615f0112d315aac900ba8c05038a2da9bbe":0,"dfc3e71bf0fa56b99c600f6ec6637c746d71eae4":0,"1d4d38ccb58efa450899a3a1d48a0def61b2779e":347,"303ff618e7d7967c16c9a62c8b3e3a2189593fd7":417,"f48fcd8cc55a16187417bffbad709ed7756f3ab5":526,"9b3e412d96fc28d062620fc9877cffcb0a527aa7":0,"ab03f3913c993b4aeaf1ed1ad2f8f07501c6a649":25,"11316322c10a071e6b4e76a6017208a4f03a3b21":84,"68bd0490faea35ebd209a645b87d92fb1b79028f":0,"4c55af62db92e3a424b89dbcb313e8cacf83ef1f":0,"a5a31e6d8d40c702130969139295bb309cb44e38":0,"dcc682b87e0c96139f9d81f83b58036837cd82ee":0,"1bfedfad2153029cbab3fcbba143eff2d5a28aaa":0,"6ba954c0ea93b21cefa5201c363fdc27fc9d7eb1":0,"c838695ecb3ad2300ac0c2edab189726c0aa5686":0,"d9257230e1ad7a9f9f7b87f7ad2ab201d4b45b1a":0,"8dc34370ea3f9d73d45df580d7a264a4c8646496":0,"5d21a230dc90ddd2174a73edb198ac7d2900be83":0,"45b8eaef0486a1fd578f37e919877724f2bb7b8c":0,"77e2df0316f661657cf8e526dfe5f1b770e86e6f":0,"3d99fca8077d42f6cffdc775d7e811299dcb6374":0,"f169241a3ad30c54477c3a70108a60cea4e3ff90":0,"d883d96bb5b1fccfa4c542413da818d180ab5074":0,"c195eaf28c3597d315d7903f4774f98cd0fe1fe0":0,"ce6cd2d7b911eb0fb523d4355b9eb51958510233":0,"dc7a2735da1d44fa8f640c7f1ba8142c907a3a3a":0,"f77aa876e869b46c5ef94d2f33c73aeb9718bf11":0,"77e7faa92a5fd52dff2e8a3ed9e543ae0df3b102":0,"322cd2c1c5b13a9a6473542234b01cb400a4c329":0,"dc814f5c1806e63dea851bfffac835d38687378a":0,"f35537a62cddaa7ae00d0a8284c8f86c8edce0ac":0,"4489ca290c0693c0688bbde31eb97d6024180fd9":0,"0b1be0ccdabc70df63b717957b3c9a7c8eddfb86":0,"c6cb5d26132cf8bfff221b12d0bd10150b9fb751":0,"13b594c1dd5716968925254751aebe0d45d40195":0,"dc165d9e097ffab6c3a6cc4619ffa2c8029e3381":0,"7d13c5b44d068ea9571404784dfd273f0c61c5dd":0,"af3a0f39cd7001b599ad6838fc76945c0df984f1":0,"c8b7debded2fe95bacde9deae3c0abe64f3c3228":0,"06aa5623083a99ce58ad0b3bdcc34b21fa84cffa":1516,"a8aa10f8334de3e7925d6ae349aac6905b50de55":2,"b146e7950103d09ca5e59c5d81ec074996e37e73":1693,"2fa0a1ed39f13cc79165e347c3657c3859dcfc44":1,"bb54a0386a7eea1cbef754a1457d38f292e184dd":607,"9c26dac31a443e964aa357916d1c019d79e3e99a":0,"6edebd60084e9db5385db5bb732e60f90a871bb7":0,"242efe120056a4f852172f95f9ef51b1f2358540":0,"bb7a3afd99de6fcd4c3d14fa8c8e19b3ff392361":0,"6a20ce7a90cce7ba6dd441d0445b1c3040759e85":0,"145cfca4ed1a72dfe1035ad41214d80ed4ac5469":0,"9ae45cdda8ca5686495f4649671f2b44d4a86516":0,"2a4294f157fef6cb66a5689f50dc67d2b0e56f69":0,"2e24f8129b2e5b78b1698b3924ccb3acb32215b4":14,"ca6ee7773ed7cbf148d5a3be46da8280aedc5d61":0,"fa4d3596cace418cf2502455c22ec86c8abf7295":0,"1280232d0334f82ced5244ae5422163ecc9ac05e":0,"68637d032c679248a7d3de99693255da349c682c":0,"212b5312bb5b1f9c4bd7848948dae5d35b3ca044":0,"c2a2ce3cba53d865ae26003eaaaff4a5ae7eec6c":0,"180556ee97c42da4b03e1e694ef158b84f52ae21":0,"8a263f00bfbb3b98508a5a927ed337a337cd1294":0,"7517301494e1314a498b84a73f093e7f134be8cb":122,"b90b5c1d368418e8559ee683e615ec008215fdd7":2,"0f8432563d46b31a7a3d7697622c1788178b8ec0":0,"0f2005480d1a58737034b93e50aeec7a303a50ca":0,"4ccd245ea63d7640a83443bc1ebcc0393e475504":0,"54e38d56ad58e7f9c18cdc3ba7f46e83256028fd":0,"e38a4e36aee3f61413293dfde41243f6d3c5f0b9":273,"75430283210a91d59cedfb7c87c86a706321a6d2":13,"9b7c09fce56e8210ce3d254239c642a74b7f548a":0,"1db6fe9fdb428087687e10bade5f44dfc5d3f949":0,"f7bdac2e86bfcbef8a34eb85526552acacf3709c":0,"c2461162e278c9e17c69597f473b1bea0595f062":0,"482d6033c39dafc752faa10400b50a334bdadc2a":63,"23e2663f6e6061a651da905d036f884c273e45b2":0,"5f8c41df8382c5ea768af59ed4aa346852444f2c":0,"bc019ea8e8c60fe1c0fbc7a063c7bc3255acff3a":133,"d49a2142fb60816bd9e9ece864f8b25e4867be90":0,"72dd17e4459f379e6ef4abdbc1b43d948e6aac6a":8884,"efbb4a8d51be0de3b1d4aa1182ffbe7c6457939d":0,"a3345ab00ef0e393cb99999f4f3010952a52bfd1":0,"c561fab096a6e4709c9e140935b6f11987b88b38":0,"ea7e07b6498160b7e0eb79f9cbc4ce76c04f3223":0,"1dbeaaec5841c6cb66fa06a0117b53ec86f94de8":182,"6fd0981cf677ae8304589f09ab4601b6c1c3eddd":338},"tools":{"claude-code":{"name":"Claude Code","commits":92,"loc":17254,"first_seen":1770314734,"last_seen":1794496365},"openai-codex":{"name":"OpenAI Codex","commits":1,"loc":0,"first_seen":1783765158,"last_seen":1783765158}},"monthly":{"2026-02":{"loc":412,"attributed_loc":412},"2026-03":{"loc":4515,"attributed_loc":4515},"2026-04":{"loc":3401,"attributed_loc":2303},"2026-05":{"loc":0,"attributed_loc":0},"2026-07":{"loc":222,"attributed_loc":14},"2026-08":{"loc":0,"attributed_loc":0},"2026-11":{"loc":13145,"attributed_loc":10010}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":34.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":21695.0,"flagged_loc":8884.0,"flagged_loc_share":0.40949527540908043,"max_loc_per_hour":2506.2612647911606,"median_loc_per_hour":32.205113721641574,"pr_timed_units":28.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"8,884 lines of first-party code in ~3.5h (2,506 lines/hour, PR #133)","ref":"72dd17e4459f379e6ef4abdbc1b43d948e6aac6a","url":"https://github.com/romainsimon/paperasse/commit/72dd17e4459f379e6ef4abdbc1b43d948e6aac6a","weight":0.6}],"data":{"flagged_loc_by_commit":{"72dd17e4459f379e6ef4abdbc1b43d948e6aac6a":8884},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":19624.0,"index":2.14,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":84.0,"per_kloc:emoji_in_code":4.28,"files:emoji_in_code":16.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"README.md","line":376,"fingerprint":"README.md:generic-api-key:376"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":135.0,"findings_high":1.0,"findings_medium":134.0,"findings_low":0.0,"weighted_findings":34.25,"scanned_lines":19624.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"evals/run_evals.py","line":497,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:evals/run_evals.py:497"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `companyPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/integrations/pennylane/fetch.js","line":184,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/integrations/pennylane/fetch.js:184"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `companyPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/integrations/pennylane/fetch.js","line":185,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/integrations/pennylane/fetch.js:185"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputFile` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/integrations/pennylane/fetch.js","line":191,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/integrations/pennylane/fetch.js:191"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputFile` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/integrations/pennylane/fetch.js","line":192,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/integrations/pennylane/fetch.js:192"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"comptable/scripts/calc.js","line":294,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:comptable/scripts/calc.js:294"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/calc.js","line":295,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/calc.js:295"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/calc.js","line":296,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/calc.js:296"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/check-skill-descriptions.js","line":15,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/check-skill-descriptions.js:15"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/check-skill-descriptions.js","line":41,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/check-skill-descriptions.js:41"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"comptable/scripts/check-skill-descriptions.js","line":41,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:comptable/scripts/check-skill-descriptions.js:41"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"comptable/scripts/fetch_company.py","line":27,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:comptable/scripts/fetch_company.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"comptable/scripts/fetch_company.py","line":44,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:comptable/scripts/fetch_company.py:44"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"comptable/scripts/fetch_notaire_data.py","line":64,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:comptable/scripts/fetch_notaire_data.py:64"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/generate-facturx.js","line":66,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/generate-facturx.js:66"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `invoicePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/generate-facturx.js","line":76,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/generate-facturx.js:76"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `invoicePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/generate-facturx.js","line":80,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/generate-facturx.js:80"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":212,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:212"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":266,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:266"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":286,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:286"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":293,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:293"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":300,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:300"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":310,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:310"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":320,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:320"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":425,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:425"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":481,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:481"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `pdfPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/generate-facturx.js","line":539,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/generate-facturx.js:539"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `pdfPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/generate-facturx.js","line":575,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/generate-facturx.js:575"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-facturx.js","line":582,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-facturx.js:582"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/generate-pdfs.js","line":239,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/generate-pdfs.js:239"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `inputDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/generate-pdfs.js","line":250,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/generate-pdfs.js:250"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `inputDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/generate-pdfs.js","line":252,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/generate-pdfs.js:252"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/import-stripe-invoices.js","line":38,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/import-stripe-invoices.js:38"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `indexPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/import-stripe-invoices.js","line":56,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/import-stripe-invoices.js:56"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `indexPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/import-stripe-invoices.js","line":57,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/import-stripe-invoices.js:57"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `indexPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/import-stripe-invoices.js","line":64,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/import-stripe-invoices.js:64"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `indexPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/import-stripe-invoices.js","line":65,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/import-stripe-invoices.js:65"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"comptable/scripts/parse-einvoice.js","line":103,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:comptable/scripts/parse-einvoice.js:103"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"comptable/scripts/parse-einvoice.js","line":114,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:comptable/scripts/parse-einvoice.js:114"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"comptable/scripts/parse-einvoice.js","line":137,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:comptable/scripts/parse-einvoice.js:137"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"comptable/scripts/parse-einvoice.js","line":141,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:comptable/scripts/parse-einvoice.js:141"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/parse-einvoice.js","line":763,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/parse-einvoice.js:763"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/parse-einvoice.js","line":780,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/parse-einvoice.js:780"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/parse-einvoice.js","line":785,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/parse-einvoice.js:785"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":86,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:comptable/scripts/test-parse-einvoice.js:86"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":87,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/test-parse-einvoice.js:87"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":96,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:comptable/scripts/test-parse-einvoice.js:96"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `invoice` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":97,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/test-parse-einvoice.js:97"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":103,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:comptable/scripts/test-parse-einvoice.js:103"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":581,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/test-parse-einvoice.js:581"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":613,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/test-parse-einvoice.js:613"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":634,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/test-parse-einvoice.js:634"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":649,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/test-parse-einvoice.js:649"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":688,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/test-parse-einvoice.js:688"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/test-parse-einvoice.js","line":748,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/test-parse-einvoice.js:748"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"comptable/scripts/update_data.py","line":200,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:comptable/scripts/update_data.py:200"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"comptable/scripts/update_data.py","line":232,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:comptable/scripts/update_data.py:232"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"comptable/scripts/update_data.py","line":267,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:comptable/scripts/update_data.py:267"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"comptable/scripts/update_data.py","line":301,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:comptable/scripts/update_data.py:301"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/upload-qonto-attachments.js","line":44,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/upload-qonto-attachments.js:44"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `pdfPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/upload-qonto-attachments.js","line":105,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/upload-qonto-attachments.js:105"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/upload-qonto-attachments.js","line":130,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/upload-qonto-attachments.js:130"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"comptable/scripts/upload-qonto-attachments.js","line":133,"fingerprint":"javascript.lang.security.html-in-template-string:comptable/scripts/upload-qonto-attachments.js:133"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/validate-facture.js","line":34,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/validate-facture.js:34"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"comptable/scripts/validate-facture.js","line":307,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:comptable/scripts/validate-facture.js:307"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `chemin` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"controleur-fiscal/scripts/analyse-fec.js","line":62,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:controleur-fiscal/scripts/analyse-fec.js:62"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `chemin` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"controleur-fiscal/scripts/analyse-fec.js","line":63,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:controleur-fiscal/scripts/analyse-fec.js:63"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"fiscaliste/scripts/dgfip_oracle.py","line":71,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:fiscaliste/scripts/dgfip_oracle.py:71"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `companyPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"integrations/pennylane/fetch.js","line":184,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:integrations/pennylane/fetch.js:184"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `companyPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"integrations/pennylane/fetch.js","line":185,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:integrations/pennylane/fetch.js:185"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputFile` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"integrations/pennylane/fetch.js","line":191,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:integrations/pennylane/fetch.js:191"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `outputFile` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"integrations/pennylane/fetch.js","line":192,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:integrations/pennylane/fetch.js:192"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"notaire/scripts/fetch_notaire_data.py","line":64,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:notaire/scripts/fetch_notaire_data.py:64"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/calc.js","line":294,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/calc.js:294"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/calc.js","line":295,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/calc.js:295"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/calc.js","line":296,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/calc.js:296"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/check-skill-descriptions.js","line":15,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/check-skill-descriptions.js:15"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/check-skill-descriptions.js","line":41,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/check-skill-descriptions.js:41"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/check-skill-descriptions.js","line":41,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/check-skill-descriptions.js:41"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/fetch_company.py","line":27,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/fetch_company.py:27"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/fetch_company.py","line":44,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/fetch_company.py:44"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/fetch_notaire_data.py","line":64,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/fetch_notaire_data.py:64"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/generate-facturx.js","line":66,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/generate-facturx.js:66"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `invoicePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/generate-facturx.js","line":76,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/generate-facturx.js:76"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `invoicePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/generate-facturx.js","line":80,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/generate-facturx.js:80"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":212,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:212"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":266,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:266"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":286,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:286"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":293,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:293"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":300,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:300"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":310,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:310"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":320,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:320"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":425,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:425"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":481,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:481"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `pdfPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/generate-facturx.js","line":539,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/generate-facturx.js:539"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `pdfPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/generate-facturx.js","line":575,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/generate-facturx.js:575"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-facturx.js","line":582,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-facturx.js:582"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-pdfs.js","line":239,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-pdfs.js:239"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `inputDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/generate-pdfs.js","line":250,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/generate-pdfs.js:250"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `inputDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/generate-pdfs.js","line":252,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/generate-pdfs.js:252"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/import-stripe-invoices.js","line":38,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/import-stripe-invoices.js:38"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `indexPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/import-stripe-invoices.js","line":56,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/import-stripe-invoices.js:56"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `indexPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/import-stripe-invoices.js","line":57,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/import-stripe-invoices.js:57"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `indexPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/import-stripe-invoices.js","line":64,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/import-stripe-invoices.js:64"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `indexPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/import-stripe-invoices.js","line":65,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/import-stripe-invoices.js:65"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"scripts/parse-einvoice.js","line":103,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/parse-einvoice.js:103"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"scripts/parse-einvoice.js","line":114,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/parse-einvoice.js:114"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"scripts/parse-einvoice.js","line":137,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/parse-einvoice.js:137"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"scripts/parse-einvoice.js","line":141,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/parse-einvoice.js:141"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/parse-einvoice.js","line":763,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/parse-einvoice.js:763"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/parse-einvoice.js","line":780,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/parse-einvoice.js:780"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/parse-einvoice.js","line":785,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/parse-einvoice.js:785"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `rel` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/sync-skill-copies.js","line":76,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/sync-skill-copies.js:76"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/sync-skill-copies.js","line":76,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/sync-skill-copies.js:76"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-parse-einvoice.js","line":86,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-parse-einvoice.js:86"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-parse-einvoice.js","line":87,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-parse-einvoice.js:87"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-parse-einvoice.js","line":96,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-parse-einvoice.js:96"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `invoice` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-parse-einvoice.js","line":97,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-parse-einvoice.js:97"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"scripts/test-parse-einvoice.js","line":103,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:scripts/test-parse-einvoice.js:103"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/test-parse-einvoice.js","line":581,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/test-parse-einvoice.js:581"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/test-parse-einvoice.js","line":613,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/test-parse-einvoice.js:613"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/test-parse-einvoice.js","line":634,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/test-parse-einvoice.js:634"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/test-parse-einvoice.js","line":649,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/test-parse-einvoice.js:649"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/test-parse-einvoice.js","line":688,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/test-parse-einvoice.js:688"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/test-parse-einvoice.js","line":748,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/test-parse-einvoice.js:748"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/update_data.py","line":200,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/update_data.py:200"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/update_data.py","line":232,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/update_data.py:232"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/update_data.py","line":267,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/update_data.py:267"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/update_data.py","line":301,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/update_data.py:301"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/upload-qonto-attachments.js","line":44,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/upload-qonto-attachments.js:44"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `pdfPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/upload-qonto-attachments.js","line":105,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/upload-qonto-attachments.js:105"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/upload-qonto-attachments.js","line":130,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/upload-qonto-attachments.js:130"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/upload-qonto-attachments.js","line":133,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/upload-qonto-attachments.js:133"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/validate-facture.js","line":34,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/validate-facture.js:34"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"scripts/validate-facture.js","line":307,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:scripts/validate-facture.js:307"}],"evidence":[],"data":{"rulesets":["javascript","python"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":7.0,"vulnerabilities":26.0,"vulns_critical":0.0,"vulns_high":13.0,"vulns_medium":13.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":51.0},"findings":[{"rule_id":"osv/GHSA-6v7q-wjvx-w8wg","severity":"high","message":"basic-ftp@5.2.0 (npm) is affected by GHSA-6v7q-wjvx-w8wg","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.0 (npm):GHSA-6v7q-wjvx-w8wg"},{"rule_id":"osv/GHSA-c475-qrg2-pj4r","severity":"high","message":"basic-ftp@5.2.0 (npm) is affected by GHSA-c475-qrg2-pj4r","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.0 (npm):GHSA-c475-qrg2-pj4r"},{"rule_id":"osv/GHSA-chqc-8p9q-pq6q","severity":"high","message":"basic-ftp@5.2.0 (npm) is affected by GHSA-chqc-8p9q-pq6q","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.0 (npm):GHSA-chqc-8p9q-pq6q"},{"rule_id":"osv/GHSA-rp42-5vxx-qpwr","severity":"high","message":"basic-ftp@5.2.0 (npm) is affected by GHSA-rp42-5vxx-qpwr","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.0 (npm):GHSA-rp42-5vxx-qpwr"},{"rule_id":"osv/GHSA-rpmf-866q-6p89","severity":"high","message":"basic-ftp@5.2.0 (npm) is affected by GHSA-rpmf-866q-6p89","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.0 (npm):GHSA-rpmf-866q-6p89"},{"rule_id":"osv/GHSA-7pqw-9j4j-h8q3","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-7pqw-9j4j-h8q3","path":"package-lock.json","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-7pqw-9j4j-h8q3"},{"rule_id":"osv/GHSA-jmr9-qjv8-65gv","severity":"high","message":"extract-zip@2.0.1 (npm) is affected by GHSA-jmr9-qjv8-65gv","path":"package-lock.json","line":null,"fingerprint":"extract-zip@2.0.1 (npm):GHSA-jmr9-qjv8-65gv"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@10.1.0 (npm) is affected by GHSA-mwp4-54f8-5fhr","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-96hv-2xvq-fx4p","severity":"high","message":"ws@8.20.0 (npm) is affected by GHSA-96hv-2xvq-fx4p","path":"package-lock.json","line":null,"fingerprint":"ws@8.20.0 (npm):GHSA-96hv-2xvq-fx4p"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-5pm8-86m8-9m6r","severity":"medium","message":"basic-ftp@5.2.0 (npm) is affected by GHSA-5pm8-86m8-9m6r","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.0 (npm):GHSA-5pm8-86m8-9m6r"},{"rule_id":"osv/GHSA-r4jh-29pc-gfqr","severity":"medium","message":"basic-ftp@5.2.0 (npm) is affected by GHSA-r4jh-29pc-gfqr","path":"package-lock.json","line":null,"fingerprint":"basic-ftp@5.2.0 (npm):GHSA-r4jh-29pc-gfqr"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-h3mg-xc3c-68pw","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-j6r3-76f7-8jcv","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rpw4-54j3-4h4q","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rxp7-6hxx-x8q5","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-v2v4-37r5-5v8g","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-v2v4-37r5-5v8g","path":"package-lock.json","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-v2v4-37r5-5v8g"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.1 (npm) is affected by GHSA-h67p-54hq-rp68","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-q8mj-m7cp-5q26","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-q8mj-m7cp-5q26","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-q8mj-m7cp-5q26"},{"rule_id":"osv/GHSA-x5fp-wj9c-mxmx","severity":"medium","message":"qs@6.15.0 (npm) is affected by GHSA-x5fp-wj9c-mxmx","path":"package-lock.json","line":null,"fingerprint":"qs@6.15.0 (npm):GHSA-x5fp-wj9c-mxmx"},{"rule_id":"osv/GHSA-58qx-3vcg-4xpx","severity":"medium","message":"ws@8.20.0 (npm) is affected by GHSA-58qx-3vcg-4xpx","path":"package-lock.json","line":null,"fingerprint":"ws@8.20.0 (npm):GHSA-58qx-3vcg-4xpx"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":3.0,"findings":23.0,"findings_high":19.0,"findings_medium":4.0,"findings_low":0.0,"penalty":232.8},"findings":[{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/evals-smoke.yml","line":39,"fingerprint":"template-injection:.github/workflows/evals-smoke.yml:39"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/evals-smoke.yml","line":45,"fingerprint":"template-injection:.github/workflows/evals-smoke.yml:45"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/evals-smoke.yml","line":132,"fingerprint":"template-injection:.github/workflows/evals-smoke.yml:132"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/evals-smoke.yml","line":163,"fingerprint":"template-injection:.github/workflows/evals-smoke.yml:163"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/evals-smoke.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/evals-smoke.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/evals-smoke.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/evals-smoke.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/evals-smoke.yml","line":87,"fingerprint":"unpinned-uses:.github/workflows/evals-smoke.yml:87"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/evals-smoke.yml","line":116,"fingerprint":"unpinned-uses:.github/workflows/evals-smoke.yml:116"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/evals-smoke.yml","line":121,"fingerprint":"unpinned-uses:.github/workflows/evals-smoke.yml:121"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/evals-smoke.yml","line":137,"fingerprint":"unpinned-uses:.github/workflows/evals-smoke.yml:137"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/evals-smoke.yml","line":204,"fingerprint":"unpinned-uses:.github/workflows/evals-smoke.yml:204"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/evals-smoke.yml","line":209,"fingerprint":"unpinned-uses:.github/workflows/evals-smoke.yml:209"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/integrations-tests.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/integrations-tests.yml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/integrations-tests.yml","line":38,"fingerprint":"unpinned-uses:.github/workflows/integrations-tests.yml:38"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/integrations-tests.yml","line":42,"fingerprint":"unpinned-uses:.github/workflows/integrations-tests.yml:42"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/sponsors.yml","line":15,"fingerprint":"unpinned-uses:.github/workflows/sponsors.yml:15"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/sponsors.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/sponsors.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/sponsors.yml","line":28,"fingerprint":"unpinned-uses:.github/workflows/sponsors.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/sponsors.yml","line":39,"fingerprint":"unpinned-uses:.github/workflows/sponsors.yml:39"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/evals-smoke.yml","line":26,"fingerprint":"artipacked:.github/workflows/evals-smoke.yml:26"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/evals-smoke.yml","line":116,"fingerprint":"artipacked:.github/workflows/evals-smoke.yml:116"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/integrations-tests.yml","line":36,"fingerprint":"artipacked:.github/workflows/integrations-tests.yml:36"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/sponsors.yml","line":15,"fingerprint":"artipacked:.github/workflows/sponsors.yml:15"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.5541,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1036.0,"function_nloc":13166.0,"mean_ccn":3.7,"p90_ccn":8.0,"complex_functions":40.0,"long_functions":12.0,"many_param_functions":3.0,"risky_nloc_share":0.2549},"findings":[],"evidence":[{"kind":"complex-function","description":"generateInvoiceHTML in comptable/scripts/generate-facturx.js: complexity 50, 98 lines","ref":"comptable/scripts/generate-facturx.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/generate-facturx.js#L346","weight":0.8333333333333334},{"kind":"complex-function","description":"generateInvoiceHTML in scripts/generate-facturx.js: complexity 50, 98 lines","ref":"scripts/generate-facturx.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/scripts/generate-facturx.js#L346","weight":0.8333333333333334},{"kind":"complex-function","description":"generateBilan in comptable/scripts/generate-statements.js: complexity 47, 207 lines","ref":"comptable/scripts/generate-statements.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/generate-statements.js#L248","weight":0.7833333333333333},{"kind":"complex-function","description":"generateBilan in scripts/generate-statements.js: complexity 47, 207 lines","ref":"scripts/generate-statements.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/scripts/generate-statements.js#L248","weight":0.7833333333333333},{"kind":"complex-function","description":"main in evals/run_evals.py: complexity 43, 156 lines","ref":"evals/run_evals.py","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/evals/run_evals.py#L898","weight":0.7166666666666667},{"kind":"complex-function","description":"main in fiscaliste/scripts/calc_ir.py: complexity 38, 104 lines","ref":"fiscaliste/scripts/calc_ir.py","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/fiscaliste/scripts/calc_ir.py#L811","weight":0.6333333333333333},{"kind":"complex-function","description":"from_foyer in fiscaliste/scripts/calc_ir.py: complexity 34, 134 lines","ref":"fiscaliste/scripts/calc_ir.py","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/fiscaliste/scripts/calc_ir.py#L331","weight":0.5666666666666667},{"kind":"complex-function","description":"main in comptable/scripts/upload-qonto-attachments.js: complexity 33, 99 lines","ref":"comptable/scripts/upload-qonto-attachments.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/upload-qonto-attachments.js#L201","weight":0.55},{"kind":"complex-function","description":"main in scripts/upload-qonto-attachments.js: complexity 33, 99 lines","ref":"scripts/upload-qonto-attachments.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/scripts/upload-qonto-attachments.js#L201","weight":0.55},{"kind":"complex-function","description":"format_rapport_markdown in comptable/scripts/fetch_notaire_data.py: complexity 27, 118 lines","ref":"comptable/scripts/fetch_notaire_data.py","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/fetch_notaire_data.py#L279","weight":0.45}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":14980.0,"duplicated_lines":12045.0,"duplicated_share":0.8041,"files":49.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/integrations/pennylane/fetch.js:2 and integrations/pennylane/fetch.js:2","ref":"comptable/integrations/pennylane/fetch.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/integrations/pennylane/fetch.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/integrations/qonto/fetch.js:2 and integrations/qonto/fetch.js:2","ref":"comptable/integrations/qonto/fetch.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/integrations/qonto/fetch.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/integrations/stripe/fetch.js:2 and integrations/stripe/fetch.js:2","ref":"comptable/integrations/stripe/fetch.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/integrations/stripe/fetch.js#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/integrations/stripe/fetch.js:88 and comptable/integrations/stripe/fetch.js:122","ref":"comptable/integrations/stripe/fetch.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/integrations/stripe/fetch.js#L88","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/scripts/calc.js:1 and scripts/calc.js:1","ref":"comptable/scripts/calc.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/calc.js#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/scripts/calc_artiste_auteur.py:1 and fiscaliste/scripts/calc_artiste_auteur.py:1","ref":"comptable/scripts/calc_artiste_auteur.py","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/calc_artiste_auteur.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/scripts/check-skill-descriptions.js:1 and scripts/check-skill-descriptions.js:1","ref":"comptable/scripts/check-skill-descriptions.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/check-skill-descriptions.js#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/scripts/fetch_company.py:1 and scripts/fetch_company.py:1","ref":"comptable/scripts/fetch_company.py","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/fetch_company.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/scripts/fetch_notaire_data.py:1 and notaire/scripts/fetch_notaire_data.py:1","ref":"comptable/scripts/fetch_notaire_data.py","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/fetch_notaire_data.py#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: comptable/scripts/generate-facturx.js:1 and scripts/generate-facturx.js:1","ref":"comptable/scripts/generate-facturx.js","url":"https://github.com/romainsimon/paperasse/blob/6fd0981cf677ae8304589f09ab4601b6c1c3eddd/comptable/scripts/generate-facturx.js#L1","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":55.0,"weighted_findings":43.5,"scanned_lines":19624.0,"category:best-practice":37.0,"category:correctness":18.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"evals/generate_review.py","line":302,"fingerprint":"python.lang.best-practice.arbitrary-sleep:evals/generate_review.py:302"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/integrations/stripe/fetch.js","line":72,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/integrations/stripe/fetch.js:72"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/scripts/calc.js","line":292,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/scripts/calc.js:292"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/scripts/calc.js","line":293,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/scripts/calc.js:293"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/scripts/generate-facturx.js","line":505,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/scripts/generate-facturx.js:505"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/scripts/generate-facturx.js","line":532,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/scripts/generate-facturx.js:532"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/scripts/import-stripe-invoices.js","line":94,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/scripts/import-stripe-invoices.js:94"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/scripts/test-deterministic-calculations.js","line":299,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/scripts/test-deterministic-calculations.js:299"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/scripts/test-deterministic-calculations.js","line":300,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/scripts/test-deterministic-calculations.js:300"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/scripts/test-deterministic-calculations.js","line":398,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/scripts/test-deterministic-calculations.js:398"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"comptable/scripts/test-deterministic-calculations.js","line":399,"fingerprint":"javascript.lang.best-practice.lazy-load-module:comptable/scripts/test-deterministic-calculations.js:399"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"comptable/scripts/update_data.py","line":117,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:comptable/scripts/update_data.py:117"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"comptable/scripts/update_data.py","line":314,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:comptable/scripts/update_data.py:314"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"evals/aggregate_benchmark.py","line":90,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:evals/aggregate_benchmark.py:90"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"evals/aggregate_benchmark.py","line":120,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:evals/aggregate_benchmark.py:120"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"evals/aggregate_benchmark.py","line":142,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:evals/aggregate_benchmark.py:142"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"evals/aggregate_benchmark.py","line":377,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:evals/aggregate_benchmark.py:377"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"evals/aggregate_benchmark.py","line":383,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:evals/aggregate_benchmark.py:383"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"evals/run_evals.py","line":118,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:evals/run_evals.py:118"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"evals/run_evals.py","line":189,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:evals/run_evals.py:189"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"fiscaliste/scripts/calc_ir.py","line":118,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:fiscaliste/scripts/calc_ir.py:118"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"fiscaliste/scripts/dgfip_oracle.py","line":111,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:fiscaliste/scripts/dgfip_oracle.py:111"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"fiscaliste/scripts/update_data.py","line":42,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:fiscaliste/scripts/update_data.py:42"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"fiscaliste/scripts/update_data.py","line":136,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:fiscaliste/scripts/update_data.py:136"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"fiscaliste/scripts/update_data.py","line":139,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:fiscaliste/scripts/update_data.py:139"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"integrations/stripe/fetch.js","line":72,"fingerprint":"javascript.lang.best-practice.lazy-load-module:integrations/stripe/fetch.js:72"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/calc.js","line":292,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/calc.js:292"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/calc.js","line":293,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/calc.js:293"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/generate-facturx.js","line":505,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/generate-facturx.js:505"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/generate-facturx.js","line":532,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/generate-facturx.js:532"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/import-stripe-invoices.js","line":94,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/import-stripe-invoices.js:94"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/test-deterministic-calculations.js","line":299,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/test-deterministic-calculations.js:299"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/test-deterministic-calculations.js","line":300,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/test-deterministic-calculations.js:300"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/test-deterministic-calculations.js","line":398,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/test-deterministic-calculations.js:398"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/test-deterministic-calculations.js","line":399,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/test-deterministic-calculations.js:399"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/update_data.py","line":117,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/update_data.py:117"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/update_data.py","line":314,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/update_data.py:314"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"comptable/scripts/generate-facturx.js","line":283,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:comptable/scripts/generate-facturx.js:283"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"comptable/scripts/generate-facturx.js","line":283,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:comptable/scripts/generate-facturx.js:283"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"comptable/scripts/generate-facturx.js","line":283,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:comptable/scripts/generate-facturx.js:283"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"comptable/scripts/generate-facturx.js","line":283,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:comptable/scripts/generate-facturx.js:283"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"comptable/scripts/generate-facturx.js","line":489,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:comptable/scripts/generate-facturx.js:489"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"comptable/scripts/generate-facturx.js","line":489,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:comptable/scripts/generate-facturx.js:489"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"comptable/scripts/generate-pdfs.js","line":51,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:comptable/scripts/generate-pdfs.js:51"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"comptable/scripts/generate-pdfs.js","line":51,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:comptable/scripts/generate-pdfs.js:51"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"comptable/scripts/upload-qonto-attachments.js","line":134,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:comptable/scripts/upload-qonto-attachments.js:134"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/generate-facturx.js","line":283,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/generate-facturx.js:283"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/generate-facturx.js","line":283,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/generate-facturx.js:283"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/generate-facturx.js","line":283,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/generate-facturx.js:283"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/generate-facturx.js","line":283,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/generate-facturx.js:283"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/generate-facturx.js","line":489,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/generate-facturx.js:489"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/generate-facturx.js","line":489,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/generate-facturx.js:489"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/generate-pdfs.js","line":51,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/generate-pdfs.js:51"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/generate-pdfs.js","line":51,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/generate-pdfs.js:51"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/upload-qonto-attachments.js","line":134,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/upload-qonto-attachments.js:134"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1371,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.6316,"test_lines":1345.0,"source_lines":19624.0,"test_ratio":0.0685,"ci_files":3.0,"cochange_share":0.1579,"cochange_commits":38.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/evals-smoke.yml","ref":".github/workflows/evals-smoke.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/integrations-tests.yml","ref":".github/workflows/integrations-tests.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/sponsors.yml","ref":".github/workflows/sponsors.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm run test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm run test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":250.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":37.0,"escapes_per_kloc":6.119},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":15628.0,"other_lines":3996.0,"files_blamed":49.0,"blame_failures":0.0,"quality:ai_findings":51.0,"quality:ai_per_kloc":3.263,"quality:other_findings":4.0,"quality:other_per_kloc":1.001,"quality:ratio":3.26,"security:ai_findings":113.0,"security:ai_per_kloc":7.231,"security:other_findings":22.0,"security:other_per_kloc":5.506,"security:ratio":1.31},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}