{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-14T00:14:46.313410Z","repo":{"ref":{"host":"github.com","owner":"shinshin86","name":"mesh-avatar-studio"},"default_branch":"main","clone_url":"https://github.com/shinshin86/mesh-avatar-studio.git","html_url":"https://github.com/shinshin86/mesh-avatar-studio","description":"Turn one illustration into an animated 2D mesh avatar with a coding agent and a local editor","stars":2344,"forks":247,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":51602,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2026-10-04T03:33:57Z","pushed_at":"2026-11-12T12:07:55Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-07-20T13:59:15Z","owner_type":"User","release_assets":[]}},"commit_sha":"6d2817aa0869365a0a5634241bf50af6bfd78a2a","profile":{"lines_by_language":{"Rust":16067,"TypeScript":15567,"JavaScript":8078,"Python":2651,"C":798,"Shell":20},"files_by_category":{"source":210,"test":87,"binary":48,"docs":31,"config":28,"other":26,"oversized":14,"vendored":4,"generated":2},"source_lines":32450,"test_lines":10731},"pillars":{"ai_provenance":{"score":69.5,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.6948,"suspected_share":0.0439,"estimated_share":0.6948,"ai_artifacts":2.0,"flagged_work_units":5.0,"flagged_releases":1.0},"summary":"Explicit AI attribution on 69% of first-party code added; an estimated 69% including velocity signals."},"quality":{"score":69.7,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":40.8,"duplication":52.6,"lint":86.4,"testing":91.5,"docs":65.0,"type_safety":86.4,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.33, CI runs tests; 30% of function code in complex or long functions; 11% duplicated lines. Weakest area: complexity."},"security":{"score":55.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":85.2,"dependencies":34.4,"ci_actions":4.5,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 21 known vulnerabilities in 10 dependencies; 2 high-severity SAST findings; 15 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":29.0,"checked":29.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":186.0,"attributed_commits":138.0,"attributed_commit_share":0.7419354838709677,"effective_loc":46069.0,"attributed_loc":32010.0,"attributed_loc_share":0.6948273242310448,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 130 attributed commits, 31,681 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 8 attributed commits, 329 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: on merged branch (c220f4eb0a)","ref":"73d6531bca8877b8bfb6d035d69ebe84adb696cd","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/73d6531bca8877b8bfb6d035d69ebe84adb696cd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4732e76fdb525f56b93301dc2fbe7b2ee646a3e8","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/4732e76fdb525f56b93301dc2fbe7b2ee646a3e8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"afb3e6d7dc2f0b2855b97e371752a28f0d851ea2","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/afb3e6d7dc2f0b2855b97e371752a28f0d851ea2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"571566de024a3195c080d80d21d2bfa44d3c7b31","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/571566de024a3195c080d80d21d2bfa44d3c7b31","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"01a34e8a7987fcd7bf51def0341377ae38f849c0","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/01a34e8a7987fcd7bf51def0341377ae38f849c0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3a2eed52b46ff44e9215a2a6e781105a01f06425","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/3a2eed52b46ff44e9215a2a6e781105a01f06425","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (fceeced452)","ref":"8263722b987465b18316b2bcfca1385ba67b5319","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/8263722b987465b18316b2bcfca1385ba67b5319","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (3af275e0b1)","ref":"58f6598d78ad9d175309ac3dc9d2c5c4da931927","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/58f6598d78ad9d175309ac3dc9d2c5c4da931927","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (3af275e0b1)","ref":"bcaedfad55faa81525f2542f92e150846cf7868d","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/bcaedfad55faa81525f2542f92e150846cf7868d","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (3af275e0b1)","ref":"2ee6dd29d88ebb73fa671970ee906b03758ed5b3","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/2ee6dd29d88ebb73fa671970ee906b03758ed5b3","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (3af275e0b1)","ref":"f7798fd037ecc5b8ee655ed84c0788799112e908","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/f7798fd037ecc5b8ee655ed84c0788799112e908","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (3af275e0b1)","ref":"4c5929fcd67df86e879ef95e0f2411104135941a","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/4c5929fcd67df86e879ef95e0f2411104135941a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1b90af02aee76801561f651e502c2a0366d9f973","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/1b90af02aee76801561f651e502c2a0366d9f973","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f9a1542b1ba6faaccd38e604ff7969f930eb4deb","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/f9a1542b1ba6faaccd38e604ff7969f930eb4deb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7566e98426f52fe5a907cff72d6c6d774773a658","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/7566e98426f52fe5a907cff72d6c6d774773a658","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1382c220235a3b21bfa93e3681b8d23287a0859f","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/1382c220235a3b21bfa93e3681b8d23287a0859f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"acde8e8e69eba7870e81259c38bb5deffb0c49bd","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/acde8e8e69eba7870e81259c38bb5deffb0c49bd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"858fc51fd5e54c12d910fbedc73bb285c510c4d3","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/858fc51fd5e54c12d910fbedc73bb285c510c4d3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"70dcc7371116c86450ad478c4ee3c1b43beb640a","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/70dcc7371116c86450ad478c4ee3c1b43beb640a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e9de7e4297809ccac8a621ad30ae0b90832e2670","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/e9de7e4297809ccac8a621ad30ae0b90832e2670","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d6939487f577a992bcadd4046ac37776047d29c4","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/d6939487f577a992bcadd4046ac37776047d29c4","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"652f081ecaf9c641c31f19fe417eb624627bf120","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/652f081ecaf9c641c31f19fe417eb624627bf120","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1674c25c2ed716cd62d88813c95d48d0d9d6ad6f","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/1674c25c2ed716cd62d88813c95d48d0d9d6ad6f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8239660b2eb69d6f5b3f0a550fde09fa86ba9d20","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/8239660b2eb69d6f5b3f0a550fde09fa86ba9d20","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"fcec4355f88c4f8a09e0e737ba153a7ea84150f3","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/fcec4355f88c4f8a09e0e737ba153a7ea84150f3","weight":0.9}],"data":{"attributed_loc_by_commit":{"2c596eb15feb3d0b073d48d6d87b08ae514c5ef9":144,"2d1c436c3c4b3845dcc899c9e7a8e7fd1606d905":1,"3ed174ae83085f672a1337618c40cffd74d0639c":642,"4909edc21c375aa904cd00f3cce2f8f8c9a8bf09":35,"4beeda4719bdc82a3422d8292fb26d43d9a31d90":199,"a737e5fecd8771623b43cc4e2a0b5ca9947afd62":0,"61430ddf0d3a4afdf350026a30d5210e708f60a7":2,"e4f58de2f647999eaaf259075d145a9490ec089e":0,"4dfc178ec273b1d759a7d40da47bea9449d2f098":0,"2678e00f5d73fc4894dad5363f2336daf110bb3d":183,"3227865390e070c433189f16a6e09bf99c65033a":247,"8cbe89c290046e36678cdbb5d6dbb00bfeac3b00":63,"7330b9eae9ad6ea40b1fcb3787adbfd4013d1c58":0,"0e94b84f7a80402a40f7a644831e1b3d893b5d29":32,"fe2ea584f5346288b7814803de32e573ba9041f1":19,"67174931b0e23d45dd6e6522327094eb75386232":222,"5f7b652020bf89b32515683ac9276271e18c03a0":14,"f306ce75387a2bdabd4032006f8e0192c88e5260":141,"cf02d8568f7e9f301f46e9472bb132ccc5835b51":360,"7fb83fe5206343e2c9a508aa05e1a8b58a85786d":655,"af8ed71f3346c39399d15126267cfee4feeb6e5c":584,"19ca82fee98669dd7a0cca966af4fc20e4aed8a3":50,"8ecf14d4cbd7d445eb6134db64d9d840b5c2e72f":3,"133b02a3e88587e51b22fd6740d403f33e456d4e":0,"cd52a3d494992a2cddd5048d6a12929b586fcf2b":0,"c32f694fe0ad1bafdd838753e0d43072dbcaeb10":0,"c30e3e8d3a841c0d4a973382b584083afd82fa30":0,"a0579f53ca7158cd3435d1fdcc122e5730370f40":228,"5babf896820e7a26e008f2972c2a632f5f6437c4":107,"5b25666e458bb6587bf668425a415cceee62d167":42,"3124465b07d6f12652554a4bca838223f7c33a89":0,"987f6f693ded3bce36533d418dd8b1ae90bd0e14":0,"594395abf1b06e1d142ea1403fcb0640198ae0f9":61,"0a4c9d1d3aa6ad7f3a678a5784fcc70998876d4e":0,"1f9a51b97e865f84c0011fea3cfd58c6b57aeb03":0,"c8c59d41e1b3c66aab10e14df5dec6d5e56593ba":2,"f06564785649f55a74fbfe31c65bb9b931f1dfa2":8,"478a8ffc6b14729f7df752aedf20a417e65ac465":329,"b9b59256d5797afbd95d5af71c1cbe85b0cb8543":134,"df17c3bde04d682b6b85db6b9114854461f87c7f":0,"a363588df0947cb80eae07782b87aa7c70039e83":7,"ce18df6b2752750a5568933f86edd058a98729ec":2,"f44e16589437d415adab7a61dc468e9849b8c04a":49,"750619b5d81f7be6af649a3667cab8105e8c602e":565,"384d5c68e9985b990001d1d0dee9d6bae38c728c":6,"af1c9d7ae73f24158d95b53c6d6fe7905b47c1d8":345,"4e90ef82b8ee269626d8a283f07cf34c4cf8f013":4,"200ea878007adae16df776fa7ff1985d37fd7fd9":0,"144ebc9d6e5c5d84a510ce6e1dccec5a06c93b7e":0,"b2a70a15b6ce30f0881657800f8017a1c20f1d39":0,"5cec24b3d622d6476fa84ce844cb9d321643a41d":508,"6c6d2985908242d48e23015eeb68de5251bd67c4":464,"86bb8bc537f1856f8b176890380acdd48c0cc454":65,"8090e7ddb75e7b24f01d51864f00b31d1c97c817":7,"d929ae0fb9ec18eb02165167840ef40d2d971189":91,"4fbcbc654177a303f9c091c5f6bc7249092ebd24":26,"555611abeb309168410f8fb9f87b6a9999eb0e3e":304,"6046d010e1e7b44808715488f6fb9e72aac798bf":4,"7fbd5e9d5a1a96d7e8dc9294dffddf88346f8a82":0,"77d15b346027a04cde35aca546db7acf42426ed8":0,"3a8187c3b03ccfaea3bab0fdb622bc4b7aee1487":0,"fd1d70fe0fdbf6491f9c94163eb366bdb66c2c32":79,"5e46ac4da7a7ec41f5df57a40ae8624388652b76":0,"2177443c0d513f80173af43b55583f250de12681":3,"ea468624ca40250346ca77f1984b5645422e7ad0":597,"fc3e071b046a9a5d806252af1c8bf5adbf3ab1e7":726,"53e5edd2096b1b2a117c57068de39f6d5ef20d62":89,"f1cd0291b5600b006d9fee2629597a4ffc9af0d4":13,"7d3a965c476eec1918f4af9cbf2c1ef38df6a657":0,"24f8172650f89c68c8b0ed89646687433c02d141":603,"7f10ab94701ba51cd41d6ae4abb21d98b41bfb0f":0,"abcd8dba1ffe2e06b104be805be35d291103a2cf":1485,"360de2e8440fce049ea56e79524eb755d4e07567":1751,"020b28a1f0aaf783387d9da1fa30d2ea60e0c3ca":2589,"87fa6166d71956ab523ac1e10bcafa5236681120":1087,"d04bd5f9798c57a3d31b58f9c8c1c4f131ea34a8":987,"cb32a239b705baadbcce4fe90437d0424ee45c59":849,"a03a0ad5db201523310266bc9c92b2ca1579b8c1":0,"7556dd40f81963823ec763903795225e6e611e94":0,"f6759928c059ce11ce0ac0273cc644a8188e5ddd":673,"1a79c3ddccd5f103a4888d9b03020930e8fa2bdc":247,"76e863b4aba3ce442890e7ab7b3c8a7d9945ac13":885,"f9e70641d7c01874d48901b764dd7ba29969ee9d":1561,"65ae9aeb108de0dee8c7b2cae2205081cee4cebe":833,"058605183eb2737c6d773ac1b396a59672f0754f":0,"16522a09720bddb847ece4489eb8a682c08be732":10,"21e5e2ad94d3e1b64dbe4cb9165e1a2dd7e1ab3c":197,"f8599571a0c3b2ff261ac6331b8ab4c84aaf01f0":251,"aab58fc16ee30b8980a33c0f2bc4d07b920464c3":6,"f2c2483e46256a6458faf6abf743907b5c713bb2":13,"d5e4fd477240a51d19f9b2825289320ebb3c2445":5,"95f326c5c5d09cba48d1189e174ed1e659794eb2":81,"022636512cf69a9704aed0382401b1c58e02b939":2,"9e3001baed28d4c8874add8e1f552af930291192":97,"7fdc53465045b5d5fb5db332cd1c8abcd7dd259a":1,"a374f53b713ec8932eaaec7a9100b281cbd4b7ca":57,"386ab9b764d4583de56101e90ef4f44250cf0c30":0,"498a8312fb2769b81080dc340cf7600dedaf7be8":229,"364e4015adc1471d3dde00b133b7c026d4899e83":2,"60bfbf093c6e293ad424c971c095f5041b01aab3":157,"96ec52591fc8649cfda977e4e0f2654a08836bb0":0,"6df5075fbaa0bf975973bc1cefefb8a231309acd":0,"9d752c1c4afd0d04554484fb1c27a965eabfc7df":241,"43b82d015611057cf10b6014a3c8b64326382797":53,"cbe84a5211fd3faeb7a68de8447421c7a2be409c":56,"1bdb5aa09f92dcf57f18f395f825594bf4e39665":6,"5e17c80bcabde422a5f8f468f4ba4852f3f98e57":753,"ba759d53cf19e36b61ab9cebdb66aed39f111bc1":162,"42a04066f57ee5c788ede26ed822ee5d49bcd2c8":13,"24a97691fceb49d225bfb94049746122746273c8":795,"94d866834fca93281634d6c21fea40242fac6131":0,"4ac5285a4952c838ea57e9c8da57eec06cb3a517":409,"063f8364e2e3283d9b24423a51a4d9d280520105":396,"fcec4355f88c4f8a09e0e737ba153a7ea84150f3":3,"8239660b2eb69d6f5b3f0a550fde09fa86ba9d20":19,"1674c25c2ed716cd62d88813c95d48d0d9d6ad6f":359,"652f081ecaf9c641c31f19fe417eb624627bf120":357,"d6939487f577a992bcadd4046ac37776047d29c4":204,"e9de7e4297809ccac8a621ad30ae0b90832e2670":205,"70dcc7371116c86450ad478c4ee3c1b43beb640a":15,"858fc51fd5e54c12d910fbedc73bb285c510c4d3":6,"acde8e8e69eba7870e81259c38bb5deffb0c49bd":13,"1382c220235a3b21bfa93e3681b8d23287a0859f":46,"7566e98426f52fe5a907cff72d6c6d774773a658":38,"f9a1542b1ba6faaccd38e604ff7969f930eb4deb":195,"1b90af02aee76801561f651e502c2a0366d9f973":506,"4c5929fcd67df86e879ef95e0f2411104135941a":38,"f7798fd037ecc5b8ee655ed84c0788799112e908":2,"2ee6dd29d88ebb73fa671970ee906b03758ed5b3":76,"bcaedfad55faa81525f2542f92e150846cf7868d":15,"58f6598d78ad9d175309ac3dc9d2c5c4da931927":54,"8263722b987465b18316b2bcfca1385ba67b5319":0,"3a2eed52b46ff44e9215a2a6e781105a01f06425":58,"01a34e8a7987fcd7bf51def0341377ae38f849c0":0,"571566de024a3195c080d80d21d2bfa44d3c7b31":1348,"afb3e6d7dc2f0b2855b97e371752a28f0d851ea2":2022,"4732e76fdb525f56b93301dc2fbe7b2ee646a3e8":159,"73d6531bca8877b8bfb6d035d69ebe84adb696cd":269},"tools":{"openai-codex":{"name":"OpenAI Codex","commits":8,"loc":329,"first_seen":1791126053,"last_seen":1793776895},"claude-code":{"name":"Claude Code","commits":130,"loc":31681,"first_seen":1791152032,"last_seen":1794481806}},"monthly":{"2026-09":{"loc":6147,"attributed_loc":0},"2026-10":{"loc":35096,"attributed_loc":27184},"2026-11":{"loc":4826,"attributed_loc":4826}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1791028465.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1791028465},{"tool":"generic-agent","path":"AGENTS.md","added_at":1791028465}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":71.0,"flagged_units":5.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":40992.0,"flagged_loc":15313.0,"flagged_loc_share":0.37356069476971115,"max_loc_per_hour":1693.6151855047456,"median_loc_per_hour":150.75,"pr_timed_units":0.0,"excluded_import_loc":5077.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,181 lines of first-party code in ~1.3h (1,694 lines/hour, 2 commit session)","ref":"4732e76fdb525f56b93301dc2fbe7b2ee646a3e8","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/4732e76fdb525f56b93301dc2fbe7b2ee646a3e8","weight":0.5080845556514236},{"kind":"velocity-burst","description":"1,087 lines of first-party code in ~0.8h (1,428 lines/hour, 1 commit session)","ref":"87fa6166d71956ab523ac1e10bcafa5236681120","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/87fa6166d71956ab523ac1e10bcafa5236681120","weight":0.4284525547445255},{"kind":"velocity-burst","description":"4,199 lines of first-party code in ~3.1h (1,357 lines/hour, 5 commit session)","ref":"65ae9aeb108de0dee8c7b2cae2205081cee4cebe","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/65ae9aeb108de0dee8c7b2cae2205081cee4cebe","weight":0.40701130856219714},{"kind":"velocity-burst","description":"5,825 lines of first-party code in ~4.6h (1,253 lines/hour, 3 commit session)","ref":"020b28a1f0aaf783387d9da1fa30d2ea60e0c3ca","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/020b28a1f0aaf783387d9da1fa30d2ea60e0c3ca","weight":0.3760086067778376},{"kind":"velocity-burst","description":"2,021 lines of first-party code in ~4.0h (504 lines/hour, 2 commit session)","ref":"fcc00758c7defb9324839e7899388f315f54dfd4","url":"https://github.com/shinshin86/mesh-avatar-studio/commit/fcc00758c7defb9324839e7899388f315f54dfd4","weight":0.15132279534109813}],"data":{"flagged_loc_by_commit":{"1b71de020c789495b2f55427faf1e01587267011":789,"fcc00758c7defb9324839e7899388f315f54dfd4":1232,"abcd8dba1ffe2e06b104be805be35d291103a2cf":1485,"360de2e8440fce049ea56e79524eb755d4e07567":1751,"020b28a1f0aaf783387d9da1fa30d2ea60e0c3ca":2589,"87fa6166d71956ab523ac1e10bcafa5236681120":1087,"f6759928c059ce11ce0ac0273cc644a8188e5ddd":673,"1a79c3ddccd5f103a4888d9b03020930e8fa2bdc":247,"76e863b4aba3ce442890e7ab7b3c8a7d9945ac13":885,"f9e70641d7c01874d48901b764dd7ba29969ee9d":1561,"65ae9aeb108de0dee8c7b2cae2205081cee4cebe":833,"afb3e6d7dc2f0b2855b97e371752a28f0d851ea2":2022,"4732e76fdb525f56b93301dc2fbe7b2ee646a3e8":159},"excluded_import_commits":["1c012a585866214a8a5b1a355f7f85f403dd4dea","6c2ecd53820202b3dadbe48170f6aca9a90940ed"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":26.0,"flagged_releases":1.0,"max_loc_per_day":4416.9},"findings":[],"evidence":[{"kind":"release-burst","description":"mesh-avatar-react@0.1.1 → mesh-avatar-element@0.2.1: 13,667 lines in 3.09 days (4,416.9 lines/day)","ref":"mesh-avatar-react@0.1.1...mesh-avatar-element@0.2.1","url":"https://github.com/shinshin86/mesh-avatar-studio/compare/mesh-avatar-react@0.1.1...mesh-avatar-element@0.2.1","weight":0.4}],"data":{"releases":[{"from":"mesh-avatar@0.1.1","to":"mesh-avatar@0.2.0","loc":969,"days":3.08,"loc_per_day":314.5,"flagged":false},{"from":"mesh-avatar@0.2.0","to":"create-mesh-avatar-studio@0.1.1","loc":920,"days":2.86,"loc_per_day":321.7,"flagged":false},{"from":"create-mesh-avatar-studio@0.1.1","to":"mesh-avatar@0.2.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar@0.2.1","to":"mesh-avatar-element@0.1.1","loc":1371,"days":3.44,"loc_per_day":398.8,"flagged":false},{"from":"mesh-avatar-element@0.1.1","to":"mesh-avatar-element@0.2.0","loc":1592,"days":3.76,"loc_per_day":423.1,"flagged":false},{"from":"mesh-avatar-element@0.2.0","to":"mesh-avatar@0.3.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar@0.3.0","to":"mesh-avatar-react@0.1.1","loc":13,"days":0.04,"loc_per_day":312.0,"flagged":false},{"from":"mesh-avatar-react@0.1.1","to":"mesh-avatar-element@0.2.1","loc":13667,"days":3.09,"loc_per_day":4416.9,"flagged":true},{"from":"mesh-avatar-element@0.2.1","to":"mesh-avatar@0.3.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar@0.3.1","to":"mesh-avatar-element@0.3.0","loc":682,"days":0.75,"loc_per_day":906.8,"flagged":false},{"from":"mesh-avatar-element@0.3.0","to":"mesh-avatar-react@0.2.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar-react@0.2.0","to":"mesh-avatar@0.4.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar@0.4.0","to":"mesh-avatar-element@0.4.0","loc":4342,"days":3.25,"loc_per_day":1335.7,"flagged":false},{"from":"mesh-avatar-element@0.4.0","to":"mesh-avatar-react@0.3.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar-react@0.3.0","to":"mesh-avatar@0.5.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar@0.5.0","to":"mesh-avatar-element@0.4.1","loc":32,"days":0.57,"loc_per_day":55.7,"flagged":false},{"from":"mesh-avatar-element@0.4.1","to":"mesh-avatar@0.6.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar@0.6.0","to":"mesh-avatar@0.6.1","loc":46,"days":1.49,"loc_per_day":30.8,"flagged":false},{"from":"mesh-avatar@0.6.1","to":"mesh-avatar-element@0.4.2","loc":233,"days":1.01,"loc_per_day":230.2,"flagged":false},{"from":"mesh-avatar-element@0.4.2","to":"mesh-avatar@0.7.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar@0.7.0","to":"mesh-avatar-element@0.4.3","loc":691,"days":0.86,"loc_per_day":799.1,"flagged":false},{"from":"mesh-avatar-element@0.4.3","to":"mesh-avatar@0.7.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar@0.7.1","to":"mesh-avatar-element@0.4.4","loc":3587,"days":1.79,"loc_per_day":2003.8,"flagged":false},{"from":"mesh-avatar-element@0.4.4","to":"mesh-avatar@0.7.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"mesh-avatar@0.7.2","to":"mesh-avatar-element@0.4.5","loc":269,"days":6.4,"loc_per_day":42.0,"flagged":false},{"from":"mesh-avatar-element@0.4.5","to":"mesh-avatar@0.8.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":32450.0,"index":0.031,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":2.0,"per_kloc:emoji_in_code":0.062,"files:emoji_in_code":2.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":52.0,"findings_high":2.0,"findings_medium":5.0,"findings_low":45.0,"weighted_findings":14.862,"scanned_lines":32450.0,"parse_errors":8.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.spawn-shell-true","severity":"high","message":"Found '$SPAWN' with '{shell: process.platform === 'win32' && command === 'npm'}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{sh [confidence low]","path":"packages/create-mesh-avatar-studio/index.mjs","line":82,"fingerprint":"javascript.lang.security.audit.spawn-shell-true:packages/create-mesh-avatar-studio/index.mjs:82"},{"rule_id":"opengrep/javascript.lang.security.audit.spawn-shell-true","severity":"high","message":"Found '$SPAWN' with '{shell: process.platform === 'win32'}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low]","path":"tools/prepack.mjs","line":11,"fingerprint":"javascript.lang.security.audit.spawn-shell-true:tools/prepack.mjs:11"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/element/src/index.ts","line":231,"fingerprint":"javascript.lang.security.html-in-template-string:packages/element/src/index.ts:231"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"reference/build_layers.py","line":253,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:reference/build_layers.py:253"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"reference/build_sprites.py","line":67,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:reference/build_sprites.py:67"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"site/src/embed/playground.js","line":80,"fingerprint":"javascript.lang.security.html-in-template-string:site/src/embed/playground.js:80"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"tools/build-sprites.py","line":238,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:tools/build-sprites.py:238"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"native/apps/mesh-avatar-desktop/src/loading.rs","line":172,"fingerprint":"rust.lang.security.temp-dir:native/apps/mesh-avatar-desktop/src/loading.rs:172"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"native/apps/mesh-avatar-desktop/src/main.rs","line":48,"fingerprint":"rust.lang.security.current-exe:native/apps/mesh-avatar-desktop/src/main.rs:48"},{"rule_id":"opengrep/rust.lang.security.args-os","severity":"low","message":"args_os should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"native/apps/mesh-avatar-desktop/src/main.rs","line":947,"fingerprint":"rust.lang.security.args-os:native/apps/mesh-avatar-desktop/src/main.rs:947"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"native/apps/mesh-avatar-desktop/src/settings.rs","line":191,"fingerprint":"rust.lang.security.temp-dir:native/apps/mesh-avatar-desktop/src/settings.rs:191"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/boundary.rs","line":91,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/boundary.rs:91"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/boundary.rs","line":99,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/boundary.rs:99"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":48,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:48"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":50,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:50"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":54,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:54"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":70,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:70"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":71,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:71"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":78,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:78"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":117,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:117"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":143,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:143"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":161,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:161"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":182,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:182"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":201,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:201"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":227,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:227"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":230,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:230"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":278,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:278"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":280,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:280"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":283,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:283"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":323,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:323"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":349,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:349"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":352,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:352"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":371,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:371"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":390,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:390"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":439,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:439"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/lib.rs","line":468,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/lib.rs:468"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/render.rs","line":117,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/render.rs:117"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/render.rs","line":121,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/render.rs:121"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/render.rs","line":193,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/render.rs:193"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/render.rs","line":248,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/render.rs:248"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/render/tests.rs","line":32,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/render/tests.rs:32"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/render/tests.rs","line":147,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/render/tests.rs:147"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/tests.rs","line":31,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/tests.rs:31"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/tests.rs","line":39,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/tests.rs:39"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/tests.rs","line":42,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/tests.rs:42"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/tests.rs","line":173,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/tests.rs:173"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/tests.rs","line":209,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/tests.rs:209"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/tests.rs","line":418,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/tests.rs:418"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/tests.rs","line":421,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/tests.rs:421"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"native/crates/mesh-avatar-ffi/src/tests.rs","line":493,"fingerprint":"rust.lang.security.unsafe-usage:native/crates/mesh-avatar-ffi/src/tests.rs:493"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"native/crates/mesh-avatar-wgpu/src/bin/mesh-avatar-render.rs","line":36,"fingerprint":"rust.lang.security.args:native/crates/mesh-avatar-wgpu/src/bin/mesh-avatar-render.rs:36"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"src/server/project-jobs.ts","line":110,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:src/server/project-jobs.ts:110"}],"evidence":[],"data":{"rulesets":["rust","javascript","typescript","python","c","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":10.0,"vulnerabilities":21.0,"vulns_critical":4.0,"vulns_high":4.0,"vulns_medium":8.0,"vulns_low":1.0,"vulns_unknown":4.0,"penalty":64.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0369","severity":"critical","message":"zip@2.6.1 (crates.io) is affected by RUSTSEC-2026-0369","path":"native/Cargo.lock","line":null,"fingerprint":"zip@2.6.1 (crates.io):RUSTSEC-2026-0369"},{"rule_id":"osv/GHSA-m665-v7pm-7grj","severity":"critical","message":"zip@2.6.1 (crates.io) is affected by GHSA-m665-v7pm-7grj","path":"native/Cargo.lock","line":null,"fingerprint":"zip@2.6.1 (crates.io):GHSA-m665-v7pm-7grj"},{"rule_id":"osv/GHSA-5gmw-xhrv-c9v3","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-5gmw-xhrv-c9v3","path":"package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-5gmw-xhrv-c9v3"},{"rule_id":"osv/GHSA-85c8-ppgw-ccpr","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-85c8-ppgw-ccpr","path":"package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-85c8-ppgw-ccpr"},{"rule_id":"osv/RUSTSEC-2026-0367","severity":"high","message":"zip@2.6.1 (crates.io) is affected by RUSTSEC-2026-0367","path":"native/Cargo.lock","line":null,"fingerprint":"zip@2.6.1 (crates.io):RUSTSEC-2026-0367"},{"rule_id":"osv/GHSA-q7v9-x93c-xqv3","severity":"high","message":"zip@2.6.1 (crates.io) is affected by RUSTSEC-2026-0429, GHSA-q7v9-x93c-xqv3","path":"native/Cargo.lock","line":null,"fingerprint":"zip@2.6.1 (crates.io):GHSA-q7v9-x93c-xqv3"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@7.3.6 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/RUSTSEC-2024-0436","severity":"medium","message":"paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436","path":"native/Cargo.lock","line":null,"fingerprint":"paste@1.0.15 (crates.io):RUSTSEC-2024-0436"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.5 (crates.io) is affected by RUSTSEC-2026-0486","path":"native/Cargo.lock","line":null,"fingerprint":"rustix@1.1.5 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/RUSTSEC-2026-0192","severity":"medium","message":"ttf-parser@0.25.1 (crates.io) is affected by RUSTSEC-2026-0192","path":"native/Cargo.lock","line":null,"fingerprint":"ttf-parser@0.25.1 (crates.io):RUSTSEC-2026-0192"},{"rule_id":"osv/RUSTSEC-2026-0368","severity":"medium","message":"zip@2.6.1 (crates.io) is affected by RUSTSEC-2026-0368","path":"native/Cargo.lock","line":null,"fingerprint":"zip@2.6.1 (crates.io):RUSTSEC-2026-0368"},{"rule_id":"osv/GHSA-8hxf-qr8p-62x4","severity":"medium","message":"zip@2.6.1 (crates.io) is affected by GHSA-8hxf-qr8p-62x4","path":"native/Cargo.lock","line":null,"fingerprint":"zip@2.6.1 (crates.io):GHSA-8hxf-qr8p-62x4"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@3.2.7 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@3.2.7 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@3.2.7 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@3.2.7 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@7.3.6 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@7.3.6 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@7.3.6 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@3.2.7 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"vitest@3.2.7 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@7.3.6 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["crates.io","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":3.0,"findings":20.0,"findings_high":15.0,"findings_medium":4.0,"findings_low":1.0,"penalty":185.8},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":65,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:65"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":82,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:82"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":85,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:85"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":98,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:98"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":104,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:104"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":39,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:39"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":42,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:42"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":54,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:54"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":57,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:57"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/pages.yml","line":63,"fingerprint":"unpinned-uses:.github/workflows/pages.yml:63"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/release.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/release.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":50,"fingerprint":"unpinned-uses:.github/workflows/release.yml:50"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":19,"fingerprint":"artipacked:.github/workflows/ci.yml:19"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":81,"fingerprint":"artipacked:.github/workflows/ci.yml:81"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/pages.yml","line":38,"fingerprint":"artipacked:.github/workflows/pages.yml:38"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":19,"fingerprint":"artipacked:.github/workflows/release.yml:19"},{"rule_id":"zizmor/adhoc-packages","severity":"low","message":"ad-hoc installation of packages [confidence high]","path":".github/workflows/release.yml","line":29,"fingerprint":"adhoc-packages:.github/workflows/release.yml:29"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":8.0},"findings":[],"evidence":[{"kind":"posture","description":"native/apps/mesh-avatar-desktop/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"native/apps/mesh-avatar-desktop/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"native/crates/mesh-avatar-core/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"native/crates/mesh-avatar-core/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"native/crates/mesh-avatar-ffi/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"native/crates/mesh-avatar-ffi/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"native/crates/mesh-avatar-wgpu/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"native/crates/mesh-avatar-wgpu/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"packages/create-mesh-avatar-studio/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/create-mesh-avatar-studio/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/element/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/element/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/react/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/react/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/runtime/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/runtime/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"star-burst","description":"2344 stars in 41 days (57/day)","ref":null,"url":null,"weight":0.0}],"data":{"signals":["star-burst"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":2648.0,"function_nloc":25074.0,"mean_ccn":3.34,"p90_ccn":7.0,"complex_functions":85.0,"long_functions":28.0,"many_param_functions":1.0,"risky_nloc_share":0.2986},"findings":[],"evidence":[{"kind":"complex-function","description":"(anonymous) in src/server/local-projects.ts: complexity 114, 155 lines","ref":"src/server/local-projects.ts","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/src/server/local-projects.ts#L186","weight":1.0},{"kind":"complex-function","description":"Workspace in src/editor/App.tsx: complexity 105, 175 lines","ref":"src/editor/App.tsx","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/src/editor/App.tsx#L33","weight":1.0},{"kind":"complex-function","description":"update in packages/runtime/src/engine/motion.js: complexity 89, 158 lines","ref":"packages/runtime/src/engine/motion.js","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/packages/runtime/src/engine/motion.js#L251","weight":1.0},{"kind":"complex-function","description":"update in reference/engine/motion.js: complexity 76, 138 lines","ref":"reference/engine/motion.js","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/reference/engine/motion.js#L204","weight":1.0},{"kind":"complex-function","description":"update in native/crates/mesh-avatar-core/src/engine/motion.rs: complexity 67, 262 lines","ref":"native/crates/mesh-avatar-core/src/engine/motion.rs","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/native/crates/mesh-avatar-core/src/engine/motion.rs#L537","weight":1.0},{"kind":"complex-function","description":"create in tools/create.mjs: complexity 67, 66 lines","ref":"tools/create.mjs","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/tools/create.mjs#L255","weight":1.0},{"kind":"complex-function","description":"validate in native/crates/mesh-avatar-core/src/rig.rs: complexity 59, 219 lines","ref":"native/crates/mesh-avatar-core/src/rig.rs","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/native/crates/mesh-avatar-core/src/rig.rs#L340","weight":0.9833333333333333},{"kind":"complex-function","description":"validateRig in packages/runtime/src/rig/validate.ts: complexity 59, 69 lines","ref":"packages/runtime/src/rig/validate.ts","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/packages/runtime/src/rig/validate.ts#L99","weight":0.9833333333333333},{"kind":"complex-function","description":"validate_inputs in tools/build-layers.py: complexity 43, 103 lines","ref":"tools/build-layers.py","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/tools/build-layers.py#L449","weight":0.7166666666666667},{"kind":"complex-function","description":"load in native/crates/mesh-avatar-core/src/format.rs: complexity 42, 135 lines","ref":"native/crates/mesh-avatar-core/src/format.rs","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/native/crates/mesh-avatar-core/src/format.rs#L531","weight":0.7}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":25956.0,"duplicated_lines":2776.0,"duplicated_share":0.107,"files":210.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: native/apps/mesh-avatar-desktop/src/presentation.rs:40 and native/crates/mesh-avatar-wgpu/src/lib.rs:250","ref":"native/apps/mesh-avatar-desktop/src/presentation.rs","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/native/apps/mesh-avatar-desktop/src/presentation.rs#L40","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native/crates/mesh-avatar-core/src/avatar.rs:43 and native/crates/mesh-avatar-ffi/src/types.rs:25","ref":"native/crates/mesh-avatar-core/src/avatar.rs","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/native/crates/mesh-avatar-core/src/avatar.rs#L43","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native/crates/mesh-avatar-core/src/engine/overlays.rs:86 and native/crates/mesh-avatar-core/src/engine/sprites.rs:221","ref":"native/crates/mesh-avatar-core/src/engine/overlays.rs","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/native/crates/mesh-avatar-core/src/engine/overlays.rs#L86","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native/crates/mesh-avatar-ffi/src/lib.rs:109 and native/crates/mesh-avatar-ffi/src/lib.rs:131","ref":"native/crates/mesh-avatar-ffi/src/lib.rs","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/native/crates/mesh-avatar-ffi/src/lib.rs#L109","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native/crates/mesh-avatar-ffi/src/tests.rs:318 and native/crates/mesh-avatar-ffi/src/tests.rs:354","ref":"native/crates/mesh-avatar-ffi/src/tests.rs","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/native/crates/mesh-avatar-ffi/src/tests.rs#L318","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: native/examples/c/render.c:5 and native/examples/c/terminal.c:13","ref":"native/examples/c/render.c","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/native/examples/c/render.c#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/runtime/src/engine/createMeshAvatar.js:35 and reference/engine/createMeshAvatar.js:22","ref":"packages/runtime/src/engine/createMeshAvatar.js","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/packages/runtime/src/engine/createMeshAvatar.js#L35","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/runtime/src/engine/kana.js:1 and reference/engine/kana.js:1","ref":"packages/runtime/src/engine/kana.js","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/packages/runtime/src/engine/kana.js#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/runtime/src/engine/motion.js:8 and reference/engine/motion.js:6","ref":"packages/runtime/src/engine/motion.js","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/packages/runtime/src/engine/motion.js#L8","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/runtime/src/engine/motions.js:1 and reference/engine/motions.js:1","ref":"packages/runtime/src/engine/motions.js","url":"https://github.com/shinshin86/mesh-avatar-studio/blob/6d2817aa0869365a0a5634241bf50af6bfd78a2a/packages/runtime/src/engine/motions.js#L1","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":40.0,"weighted_findings":19.0,"scanned_lines":32450.0,"category:best-practice":1.0,"category:correctness":39.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"native/conformance/compare-pixels.mjs","line":176,"fingerprint":"javascript.lang.correctness.no-stringify-keys:native/conformance/compare-pixels.mjs:176"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/runtime/src/format/open.ts","line":100,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/runtime/src/format/open.ts:100"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/runtime/src/format/open.ts","line":103,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/runtime/src/format/open.ts:103"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/runtime/src/format/zip.ts","line":78,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/runtime/src/format/zip.ts:78"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/runtime/src/format/zip.ts","line":79,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/runtime/src/format/zip.ts:79"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"site/vite.config.ts","line":33,"fingerprint":"javascript.lang.correctness.no-replaceall:site/vite.config.ts:33"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/editor/App.tsx","line":276,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/editor/App.tsx:276"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/editor/App.tsx","line":276,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/editor/App.tsx:276"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/editor/App.tsx","line":429,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/editor/App.tsx:429"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/server/local-projects.ts","line":114,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/server/local-projects.ts:114"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/server/local-projects.ts","line":137,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/server/local-projects.ts:137"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"tools/capture-readme-screenshots.mjs","line":36,"fingerprint":"javascript.lang.correctness.no-replaceall:tools/capture-readme-screenshots.mjs:36"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"native/conformance/avatar.mjs","line":27,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:native/conformance/avatar.mjs:27"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"native/conformance/avatar.mjs","line":27,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:native/conformance/avatar.mjs:27"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/element/src/index.ts","line":8,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/element/src/index.ts:8"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/element/src/index.ts","line":8,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/element/src/index.ts:8"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/engine/renderer.js","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/engine/renderer.js:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/engine/renderer.js","line":14,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/engine/renderer.js:14"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/engine/renderer.js","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/engine/renderer.js:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/engine/renderer.js","line":20,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/engine/renderer.js:20"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/engine/renderer.js","line":200,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/engine/renderer.js:200"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/engine/renderer.js","line":200,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/engine/renderer.js:200"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/engine/renderer.js","line":203,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/engine/renderer.js:203"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/engine/renderer.js","line":203,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/engine/renderer.js:203"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/format/validate.ts","line":124,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/format/validate.ts:124"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/format/validate.ts","line":124,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/format/validate.ts:124"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/lighting/shadow.js","line":8,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/lighting/shadow.js:8"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/lighting/shadow.js","line":8,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/lighting/shadow.js:8"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/lighting/shadow.js","line":10,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/lighting/shadow.js:10"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/runtime/src/lighting/shadow.js","line":10,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/runtime/src/lighting/shadow.js:10"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"reference/engine/renderer.js","line":5,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:reference/engine/renderer.js:5"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"reference/engine/renderer.js","line":5,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:reference/engine/renderer.js:5"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"reference/engine/renderer.js","line":11,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:reference/engine/renderer.js:11"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"reference/engine/renderer.js","line":11,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:reference/engine/renderer.js:11"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"reference/engine/renderer.js","line":121,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:reference/engine/renderer.js:121"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"reference/engine/renderer.js","line":121,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:reference/engine/renderer.js:121"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"reference/engine/renderer.js","line":124,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:reference/engine/renderer.js:124"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"reference/engine/renderer.js","line":124,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:reference/engine/renderer.js:124"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/capture-readme-screenshots.mjs","line":213,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/capture-readme-screenshots.mjs:213"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"tools/capture-readme-screenshots.mjs","line":213,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:tools/capture-readme-screenshots.mjs:213"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.6614,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":10731.0,"source_lines":32450.0,"test_ratio":0.3307,"ci_files":3.0,"cochange_share":0.748,"cochange_commits":123.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/pages.yml","ref":".github/workflows/pages.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test, go test, cargo test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (clippy, rustfmt, cargo fmt)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test","go test","cargo test"],"lint_commands":["clippy","rustfmt","cargo fmt"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":192.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.7739,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: packages/element/tsconfig.build.json","ref":"packages/element/tsconfig.build.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":23054.0,"other_lines":9396.0,"files_blamed":210.0,"blame_failures":0.0,"quality:ai_findings":18.0,"quality:ai_per_kloc":0.781,"quality:other_findings":22.0,"quality:other_per_kloc":2.341,"quality:ratio":0.33,"security:ai_findings":49.0,"security:ai_per_kloc":2.125,"security:other_findings":3.0,"security:other_per_kloc":0.319,"security:ratio":6.66},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}