{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:22:02.987212Z","repo":{"ref":{"host":"github.com","owner":"yinghuocho","name":"firefly-proxy"},"default_branch":"master","clone_url":"https://github.com/yinghuocho/firefly-proxy.git","html_url":"https://github.com/yinghuocho/firefly-proxy","description":"A proxy software to help circumventing the Great Firewall.","stars":4804,"forks":854,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2271,"primary_language":"Go","license_spdx":"BSD-2-Clause","created_at":"2014-11-04T23:58:39Z","pushed_at":"2018-11-14T09:18:47Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-11-04T23:51:26Z","owner_type":"User","release_assets":[{"name":"update_darwin_amd64.bz2","size":4023484,"download_count":2236,"release_tag":"0.9.8","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.9.8/update_darwin_amd64.bz2"},{"name":"update_linux_amd64.bz2","size":3281794,"download_count":564696,"release_tag":"0.9.8","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.9.8/update_linux_amd64.bz2"},{"name":"update_windows_386.bz2","size":3996968,"download_count":3553,"release_tag":"0.9.8","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.9.8/update_windows_386.bz2"},{"name":"update_darwin_amd64.bz2","size":3422086,"download_count":2024,"release_tag":"0.9.7","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.9.7/update_darwin_amd64.bz2"},{"name":"update_linux_386.bz2","size":3181990,"download_count":257,"release_tag":"0.9.7","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.9.7/update_linux_386.bz2"},{"name":"update_linux_amd64.bz2","size":3274475,"download_count":346,"release_tag":"0.9.7","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.9.7/update_linux_amd64.bz2"},{"name":"update_windows_386.bz2","size":3376584,"download_count":3095,"release_tag":"0.9.7","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.9.7/update_windows_386.bz2"},{"name":"update_darwin_amd64.bz2","size":2806152,"download_count":1939,"release_tag":"0.5.0","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.5.0/update_darwin_amd64.bz2"},{"name":"update_linux_386.bz2","size":2502287,"download_count":217,"release_tag":"0.5.0","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.5.0/update_linux_386.bz2"},{"name":"update_linux_amd64.bz2","size":2628681,"download_count":397,"release_tag":"0.5.0","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.5.0/update_linux_amd64.bz2"},{"name":"update_windows_386.bz2","size":2565949,"download_count":3128,"release_tag":"0.5.0","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.5.0/update_windows_386.bz2"},{"name":"update_darwin_amd64.bz2","size":2810624,"download_count":408,"release_tag":"0.4.9","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.9/update_darwin_amd64.bz2"},{"name":"update_linux_386.bz2","size":2508367,"download_count":103,"release_tag":"0.4.9","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.9/update_linux_386.bz2"},{"name":"update_linux_amd64.bz2","size":2631105,"download_count":253,"release_tag":"0.4.9","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.9/update_linux_amd64.bz2"},{"name":"update_windows_386.bz2","size":2571784,"download_count":1095,"release_tag":"0.4.9","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.9/update_windows_386.bz2"},{"name":"update_darwin_amd64.bz2","size":2677428,"download_count":190,"release_tag":"0.4.8","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.8/update_darwin_amd64.bz2"},{"name":"update_linux_386.bz2","size":2387095,"download_count":62,"release_tag":"0.4.8","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.8/update_linux_386.bz2"},{"name":"update_linux_amd64.bz2","size":2501812,"download_count":101,"release_tag":"0.4.8","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.8/update_linux_amd64.bz2"},{"name":"update_windows_386.bz2","size":2457045,"download_count":367,"release_tag":"0.4.8","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.8/update_windows_386.bz2"},{"name":"update_darwin_amd64.bz2","size":2677096,"download_count":174,"release_tag":"0.4.7","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.7/update_darwin_amd64.bz2"},{"name":"update_linux_386.bz2","size":2386126,"download_count":68,"release_tag":"0.4.7","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.7/update_linux_386.bz2"},{"name":"update_linux_amd64.bz2","size":2501326,"download_count":86,"release_tag":"0.4.7","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.7/update_linux_amd64.bz2"},{"name":"update_windows_386.bz2","size":2455885,"download_count":213,"release_tag":"0.4.7","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.7/update_windows_386.bz2"},{"name":"update_darwin_amd64.bz2","size":2546470,"download_count":186,"release_tag":"0.4.6","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.6/update_darwin_amd64.bz2"},{"name":"update_linux_386.bz2","size":2244428,"download_count":70,"release_tag":"0.4.6","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.6/update_linux_386.bz2"},{"name":"update_linux_amd64.bz2","size":2333003,"download_count":80,"release_tag":"0.4.6","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.6/update_linux_amd64.bz2"},{"name":"update_windows_386.bz2","size":2435296,"download_count":340,"release_tag":"0.4.6","url":"https://github.com/yinghuocho/firefly-proxy/releases/download/0.4.6/update_windows_386.bz2"}]}},"commit_sha":"69c2bd0414cf1a17fc55d01836cbc021fe291f14","profile":{"lines_by_language":{"Python":5308,"Go":2040,"JavaScript":66,"Shell":24},"files_by_category":{"source":54,"other":17,"docs":16,"binary":15,"config":9,"vendored":6,"oversized":1},"source_lines":7438,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.49,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":41.9,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":86.4,"duplication":54.0,"lint":25.4,"testing":0.0,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 5% of function code in complex or long functions; 10% duplicated lines. Weakest area: testing."},"security":{"score":60.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":42.3,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 9 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":37.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":7774.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2016-04":{"loc":7565,"attributed_loc":0},"2016-05":{"loc":5,"attributed_loc":0},"2016-06":{"loc":80,"attributed_loc":0},"2016-07":{"loc":0,"attributed_loc":0},"2016-08":{"loc":0,"attributed_loc":0},"2016-09":{"loc":3,"attributed_loc":0},"2016-11":{"loc":101,"attributed_loc":0},"2016-12":{"loc":17,"attributed_loc":0},"2017-03":{"loc":0,"attributed_loc":0},"2017-05":{"loc":1,"attributed_loc":0},"2017-07":{"loc":1,"attributed_loc":0},"2017-08":{"loc":0,"attributed_loc":0},"2017-09":{"loc":0,"attributed_loc":0},"2017-10":{"loc":1,"attributed_loc":0},"2018-01":{"loc":0,"attributed_loc":0},"2018-03":{"loc":0,"attributed_loc":0},"2018-06":{"loc":0,"attributed_loc":0},"2018-07":{"loc":0,"attributed_loc":0},"2018-11":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":12.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":508.0,"pre_ai_era_burst_loc":0.0,"measured_loc":508.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":72.0,"median_loc_per_hour":48.625,"pr_timed_units":0.0,"excluded_import_loc":7266.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["a1fc12a1650216cb8db1d70e11637a4b0f427a28"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":12.0,"flagged_releases":0.0,"max_loc_per_day":18.4},"findings":[],"evidence":[],"data":{"releases":[{"from":"0.4.0","to":"0.4.1","loc":8,"days":0.89,"loc_per_day":9.0,"flagged":false},{"from":"0.4.1","to":"0.4.2","loc":291,"days":15.85,"loc_per_day":18.4,"flagged":false},{"from":"0.4.2","to":"0.4.3","loc":85,"days":35.23,"loc_per_day":2.4,"flagged":false},{"from":"0.4.3","to":"0.4.4","loc":104,"days":156.19,"loc_per_day":0.7,"flagged":false},{"from":"0.4.4","to":"0.4.5","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"0.4.5","to":"0.4.6","loc":17,"days":32.39,"loc_per_day":0.5,"flagged":false},{"from":"0.4.6","to":"0.4.7","loc":1,"days":170.86,"loc_per_day":0.0,"flagged":false},{"from":"0.4.7","to":"0.4.8","loc":1,"days":39.78,"loc_per_day":0.0,"flagged":false},{"from":"0.4.8","to":"0.4.9","loc":1,"days":95.77,"loc_per_day":0.0,"flagged":false},{"from":"0.4.9","to":"0.5.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"0.5.0","to":"0.9.7","loc":0,"days":263.9,"loc_per_day":0.0,"flagged":false},{"from":"0.9.7","to":"0.9.8","loc":0,"days":19.11,"loc_per_day":0.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":7438.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":31.0,"findings_high":9.0,"findings_medium":21.0,"findings_low":1.0,"weighted_findings":18.3,"scanned_lines":7438.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/_brz_win.py","line":142,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:DEPRECATED_PYTHON_SRC/component/_brz_win.py:142"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/_brz_win.py","line":150,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:DEPRECATED_PYTHON_SRC/component/_brz_win.py:150"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/brz.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:DEPRECATED_PYTHON_SRC/component/brz.py:32"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/brz.py","line":42,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:DEPRECATED_PYTHON_SRC/component/brz.py:42"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/brz.py","line":88,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:DEPRECATED_PYTHON_SRC/component/brz.py:88"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/brz.py","line":101,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:DEPRECATED_PYTHON_SRC/component/brz.py:101"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/circumvention.py","line":190,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:DEPRECATED_PYTHON_SRC/component/circumvention.py:190"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'STARTUPINFO' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/circumvention.py","line":210,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:DEPRECATED_PYTHON_SRC/component/circumvention.py:210"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/circumvention.py","line":214,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:DEPRECATED_PYTHON_SRC/component/circumvention.py:214"},{"rule_id":"opengrep/python.lang.security.audit.weak-ssl-version","severity":"medium","message":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/component/circumvention.py","line":97,"fingerprint":"python.lang.security.audit.weak-ssl-version:DEPRECATED_PYTHON_SRC/component/circumvention.py:97"},{"rule_id":"opengrep/python.django.security.injection.tainted-url-host","severity":"medium","message":"User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources th [confidence low]","path":"DEPRECATED_PYTHON_SRC/component/local.py","line":135,"fingerprint":"python.django.security.injection.tainted-url-host:DEPRECATED_PYTHON_SRC/component/local.py:135"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/lib/utils.py","line":117,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:DEPRECATED_PYTHON_SRC/lib/utils.py:117"},{"rule_id":"opengrep/python.lang.security.audit.weak-ssl-version","severity":"medium","message":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/meeksocks/relay.py","line":52,"fingerprint":"python.lang.security.audit.weak-ssl-version:DEPRECATED_PYTHON_SRC/meeksocks/relay.py:52"},{"rule_id":"opengrep/python.lang.security.audit.weak-ssl-version","severity":"medium","message":"An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/meeksocks/relay.py","line":54,"fingerprint":"python.lang.security.audit.weak-ssl-version:DEPRECATED_PYTHON_SRC/meeksocks/relay.py:54"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"DEPRECATED_PYTHON_SRC/webpanel/static/js/fl.js","line":20,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:DEPRECATED_PYTHON_SRC/webpanel/static/js/fl.js:20"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"DEPRECATED_PYTHON_SRC/webpanel/static/js/fl.js","line":33,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:DEPRECATED_PYTHON_SRC/webpanel/static/js/fl.js:33"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/webpanel/templates/blacklist.html","line":18,"fingerprint":"python.django.security.django-no-csrf-token:DEPRECATED_PYTHON_SRC/webpanel/templates/blacklist.html:18"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/webpanel/templates/blacklist.html","line":32,"fingerprint":"python.django.security.django-no-csrf-token:DEPRECATED_PYTHON_SRC/webpanel/templates/blacklist.html:32"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/webpanel/templates/blacklist.html","line":51,"fingerprint":"python.django.security.django-no-csrf-token:DEPRECATED_PYTHON_SRC/webpanel/templates/blacklist.html:51"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/webpanel/templates/hosts.html","line":18,"fingerprint":"python.django.security.django-no-csrf-token:DEPRECATED_PYTHON_SRC/webpanel/templates/hosts.html:18"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/webpanel/templates/hosts.html","line":27,"fingerprint":"python.django.security.django-no-csrf-token:DEPRECATED_PYTHON_SRC/webpanel/templates/hosts.html:27"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/webpanel/templates/hosts.html","line":47,"fingerprint":"python.django.security.django-no-csrf-token:DEPRECATED_PYTHON_SRC/webpanel/templates/hosts.html:47"},{"rule_id":"opengrep/python.django.security.django-no-csrf-token","severity":"medium","message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium]","path":"DEPRECATED_PYTHON_SRC/webpanel/templates/proxy.html","line":14,"fingerprint":"python.django.security.django-no-csrf-token:DEPRECATED_PYTHON_SRC/webpanel/templates/proxy.html:14"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"client/pac.go","line":74,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:client/pac.go:74"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"client/tunnel.go","line":7,"fingerprint":"go.lang.security.audit.crypto.math-random-used:client/tunnel.go:7"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"client/ui.go","line":7,"fingerprint":"go.lang.security.audit.crypto.math-random-used:client/ui.go:7"},{"rule_id":"opengrep/go.lang.security.audit.xss.unsafe-template-type","severity":"medium","message":"Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use  [confidence low]","path":"client/ui.go","line":22,"fingerprint":"go.lang.security.audit.xss.unsafe-template-type:client/ui.go:22"},{"rule_id":"opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter","severity":"medium","message":"Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low]","path":"client/ui.go","line":97,"fingerprint":"go.lang.security.audit.xss.no-direct-write-to-responsewriter:client/ui.go:97"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"client/update.go","line":46,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:client/update.go:46"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"server/main.go","line":143,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:server/main.go:143"},{"rule_id":"opengrep/python.lang.security.audit.network.avoid-bind-to-all-interfaces","severity":"low","message":"Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file. [confidence high]","path":"DEPRECATED_PYTHON_SRC/lib/utils.py","line":18,"fingerprint":"python.lang.security.audit.network.avoid-bind-to-all-interfaces:DEPRECATED_PYTHON_SRC/lib/utils.py:18"}],"evidence":[],"data":{"rulesets":["python","go","javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.3514,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":563.0,"function_nloc":5279.0,"mean_ccn":2.48,"p90_ccn":5.0,"complex_functions":3.0,"long_functions":1.0,"many_param_functions":1.0,"risky_nloc_share":0.0487},"findings":[],"evidence":[{"kind":"complex-function","description":"uiCommandProc in client/ui.go: complexity 25, 58 lines","ref":"client/ui.go","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/client/ui.go#L304","weight":0.4166666666666667},{"kind":"complex-function","description":"_main in client/main.go: complexity 21, 138 lines","ref":"client/main.go","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/client/main.go#L437","weight":0.35},{"kind":"complex-function","description":"settingsPOST in client/ui.go: complexity 18, 61 lines","ref":"client/ui.go","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/client/ui.go#L159","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5676.0,"duplicated_lines":583.0,"duplicated_share":0.1027,"files":54.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: DEPRECATED_PYTHON_SRC/component/circumvention.py:228 and DEPRECATED_PYTHON_SRC/lib/ipc.py:115","ref":"DEPRECATED_PYTHON_SRC/component/circumvention.py","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/DEPRECATED_PYTHON_SRC/component/circumvention.py#L228","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: DEPRECATED_PYTHON_SRC/component/local.py:52 and DEPRECATED_PYTHON_SRC/ghttproxy/server.py:196","ref":"DEPRECATED_PYTHON_SRC/component/local.py","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/DEPRECATED_PYTHON_SRC/component/local.py#L52","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: DEPRECATED_PYTHON_SRC/ghttproxy/server.py:195 and DEPRECATED_PYTHON_SRC/ghttproxy/socks_relay.py:79","ref":"DEPRECATED_PYTHON_SRC/ghttproxy/server.py","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/DEPRECATED_PYTHON_SRC/ghttproxy/server.py#L195","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: DEPRECATED_PYTHON_SRC/gsocks/relay.py:56 and DEPRECATED_PYTHON_SRC/gsocks/socks_relay.py:92","ref":"DEPRECATED_PYTHON_SRC/gsocks/relay.py","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/DEPRECATED_PYTHON_SRC/gsocks/relay.py#L56","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: DEPRECATED_PYTHON_SRC/gsocks/smartproxy.py:19 and DEPRECATED_PYTHON_SRC/gsocks/socksproxy.py:17","ref":"DEPRECATED_PYTHON_SRC/gsocks/smartproxy.py","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/DEPRECATED_PYTHON_SRC/gsocks/smartproxy.py#L19","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: DEPRECATED_PYTHON_SRC/main.py:15 and DEPRECATED_PYTHON_SRC/proxyonly.py:11","ref":"DEPRECATED_PYTHON_SRC/main.py","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/DEPRECATED_PYTHON_SRC/main.py#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: DEPRECATED_PYTHON_SRC/meeksocks/relay.py:249 and DEPRECATED_PYTHON_SRC/meeksocks/server.py:113","ref":"DEPRECATED_PYTHON_SRC/meeksocks/relay.py","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/DEPRECATED_PYTHON_SRC/meeksocks/relay.py#L249","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: DEPRECATED_PYTHON_SRC/webpanel/app.py:78 and DEPRECATED_PYTHON_SRC/webpanel/app.py:206","ref":"DEPRECATED_PYTHON_SRC/webpanel/app.py","url":"https://github.com/yinghuocho/firefly-proxy/blob/69c2bd0414cf1a17fc55d01836cbc021fe291f14/DEPRECATED_PYTHON_SRC/webpanel/app.py#L78","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":26.0,"weighted_findings":40.75,"scanned_lines":7438.0,"category:best-practice":19.0,"category:correctness":7.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"DEPRECATED_PYTHON_SRC/lib/ipc.py","line":132,"fingerprint":"python.lang.best-practice.arbitrary-sleep:DEPRECATED_PYTHON_SRC/lib/ipc.py:132"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"DEPRECATED_PYTHON_SRC/lib/ipc.py","line":140,"fingerprint":"python.lang.best-practice.arbitrary-sleep:DEPRECATED_PYTHON_SRC/lib/ipc.py:140"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"DEPRECATED_PYTHON_SRC/lib/utils.py","line":149,"fingerprint":"python.lang.best-practice.open-never-closed:DEPRECATED_PYTHON_SRC/lib/utils.py:149"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"DEPRECATED_PYTHON_SRC/main.py","line":182,"fingerprint":"python.lang.best-practice.arbitrary-sleep:DEPRECATED_PYTHON_SRC/main.py:182"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"DEPRECATED_PYTHON_SRC/main.py","line":348,"fingerprint":"python.lang.best-practice.open-never-closed:DEPRECATED_PYTHON_SRC/main.py:348"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"DEPRECATED_PYTHON_SRC/main.py","line":350,"fingerprint":"python.lang.best-practice.open-never-closed:DEPRECATED_PYTHON_SRC/main.py:350"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"DEPRECATED_PYTHON_SRC/proxyonly.py","line":149,"fingerprint":"python.lang.best-practice.arbitrary-sleep:DEPRECATED_PYTHON_SRC/proxyonly.py:149"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"DEPRECATED_PYTHON_SRC/proxyonly.py","line":282,"fingerprint":"python.lang.best-practice.open-never-closed:DEPRECATED_PYTHON_SRC/proxyonly.py:282"},{"rule_id":"opengrep/python.lang.best-practice.open-never-closed","severity":"high","message":"file object opened without corresponding close","path":"DEPRECATED_PYTHON_SRC/proxyonly.py","line":284,"fingerprint":"python.lang.best-practice.open-never-closed:DEPRECATED_PYTHON_SRC/proxyonly.py:284"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"DEPRECATED_PYTHON_SRC/proxyonly.py","line":296,"fingerprint":"python.lang.best-practice.arbitrary-sleep:DEPRECATED_PYTHON_SRC/proxyonly.py:296"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"DEPRECATED_PYTHON_SRC/lib/utils.py","line":149,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:DEPRECATED_PYTHON_SRC/lib/utils.py:149"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"DEPRECATED_PYTHON_SRC/main.py","line":348,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:DEPRECATED_PYTHON_SRC/main.py:348"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"DEPRECATED_PYTHON_SRC/main.py","line":350,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:DEPRECATED_PYTHON_SRC/main.py:350"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"DEPRECATED_PYTHON_SRC/meeksocks/server.py","line":377,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:DEPRECATED_PYTHON_SRC/meeksocks/server.py:377"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"DEPRECATED_PYTHON_SRC/proxyonly.py","line":282,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:DEPRECATED_PYTHON_SRC/proxyonly.py:282"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"DEPRECATED_PYTHON_SRC/proxyonly.py","line":284,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:DEPRECATED_PYTHON_SRC/proxyonly.py:284"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"DEPRECATED_PYTHON_SRC/webpanel/app.py","line":92,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:DEPRECATED_PYTHON_SRC/webpanel/app.py:92"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"DEPRECATED_PYTHON_SRC/webpanel/app.py","line":262,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:DEPRECATED_PYTHON_SRC/webpanel/app.py:262"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"DEPRECATED_PYTHON_SRC/webpanel/app.py","line":316,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:DEPRECATED_PYTHON_SRC/webpanel/app.py:316"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"client/installer/linux/firefly.sh","line":12,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:client/installer/linux/firefly.sh:12"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"client/installer/linux/firefly.sh","line":12,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:client/installer/linux/firefly.sh:12"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"client/installer/linux/firefly.sh","line":14,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:client/installer/linux/firefly.sh:14"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"client/installer/linux/firefly.sh","line":18,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:client/installer/linux/firefly.sh:18"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"client/installer/linux/firefly.sh","line":19,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:client/installer/linux/firefly.sh:19"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"client/installer/linux/firefly.sh","line":20,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:client/installer/linux/firefly.sh:20"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"client/installer/linux/firefly.sh","line":21,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:client/installer/linux/firefly.sh:21"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":7438.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":14.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":19.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}