{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"codehealth","informationUri":"https://codehealth.canine.dev","rules":[{"id":"D13","name":"Secret Scanning","shortDescription":{"text":"Secret Scanning"},"helpUri":"https://codehealth.canine.dev/dimensions/D13","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"]}},{"id":"D15","name":"Churn \u00D7 Complexity Hotspots","shortDescription":{"text":"Churn \u00D7 Complexity Hotspots"},"helpUri":"https://codehealth.canine.dev/dimensions/D15"},{"id":"D16","name":"Bus Factor","shortDescription":{"text":"Bus Factor"},"helpUri":"https://codehealth.canine.dev/dimensions/D16"},{"id":"D19","name":"Documentation Quality","shortDescription":{"text":"Documentation Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D19"},{"id":"D21","name":"Naming Consistency","shortDescription":{"text":"Naming Consistency"},"helpUri":"https://codehealth.canine.dev/dimensions/D21"},{"id":"D28","name":"Secrets (history)","shortDescription":{"text":"Secrets (history)"},"helpUri":"https://codehealth.canine.dev/dimensions/D28","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"]}},{"id":"D29","name":"Static Analysis (SAST)","shortDescription":{"text":"Static Analysis (SAST)"},"helpUri":"https://codehealth.canine.dev/dimensions/D29","relationships":[{"target":{"id":"CWE-79","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-89","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-94","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-77","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-79","CWE-89","CWE-78","CWE-94","CWE-77"]}},{"id":"D31","name":"IaC \u0026 Container Security","shortDescription":{"text":"IaC \u0026 Container Security"},"helpUri":"https://codehealth.canine.dev/dimensions/D31","relationships":[{"target":{"id":"CWE-1032","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-732","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-16","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-1032","CWE-732","CWE-16"]}},{"id":"D33","name":"JS/npm Dependency Vulnerabilities","shortDescription":{"text":"JS/npm Dependency Vulnerabilities"},"helpUri":"https://codehealth.canine.dev/dimensions/D33","relationships":[{"target":{"id":"CWE-1395","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-937","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-1395","CWE-937"]}},{"id":"D34","name":"Knowledge Freshness","shortDescription":{"text":"Knowledge Freshness"},"helpUri":"https://codehealth.canine.dev/dimensions/D34"},{"id":"D35","name":"Change Coupling","shortDescription":{"text":"Change Coupling"},"helpUri":"https://codehealth.canine.dev/dimensions/D35"},{"id":"D36","name":"Supply-chain Provenance \u0026 Signing","shortDescription":{"text":"Supply-chain Provenance \u0026 Signing"},"helpUri":"https://codehealth.canine.dev/dimensions/D36","relationships":[{"target":{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-494","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-1357","CWE-494"]}},{"id":"D37","name":"Vulnerability-disclosure Policy","shortDescription":{"text":"Vulnerability-disclosure Policy"},"helpUri":"https://codehealth.canine.dev/dimensions/D37","relationships":[{"target":{"id":"CWE-1059","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-1059"]}}]}},"results":[{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/opencode/src/provider/provider.ts: packages/opencode/src/provider/provider.ts changed 60 times in last 90 days, max complexity 144. 23 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/opencode/src/provider/provider.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"db20ec65604f0956374ff65cadad7329faddfb5a77ae732e92eb8931773ca701"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/opencode/src/provider/transform.ts: packages/opencode/src/provider/transform.ts changed 59 times in last 90 days, max complexity 77. 44 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/opencode/src/provider/transform.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"4c3a2eaa3818cb464b5c5054c62e493a940d735f7051eb67644a4ec229b1781e"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/app/src/components/prompt-input.tsx: packages/app/src/components/prompt-input.tsx changed 51 times in last 90 days, max complexity 68. 13 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/components/prompt-input.tsx"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"626123c565a4fde621085f7fe242a595e2aadf691f47b27b54b977a6fad2b5cb"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/opencode/src/session/prompt.ts: packages/opencode/src/session/prompt.ts changed 66 times in last 90 days, max complexity 50. 14 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/opencode/src/session/prompt.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"004c6041e9c8e310d0ff95ed4434a37703b6b8490be2ce8f995060d186460b6b"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/app/e2e/utils/mock-server.ts: packages/app/e2e/utils/mock-server.ts changed 21 times in last 90 days, max complexity 128. 6 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/e2e/utils/mock-server.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"752380fb2a7b9f8195b6a8ce911da03dab25d3c30f0841bbc0579600cf4986a7"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/console/app/src/routes/zen/util/handler.ts: packages/console/app/src/routes/zen/util/handler.ts changed 45 times in last 90 days, max complexity 45. 5 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/console/app/src/routes/zen/util/handler.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"05a8a2ed7cfccd5447bcd649a46313648355c8e77becc5757c2b0f62fb011cc8"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/app/src/pages/session.tsx: packages/app/src/pages/session.tsx changed 73 times in last 90 days, max complexity 23. 29 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/pages/session.tsx"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"413d7db7f405f49da12f72bd67d1d4275222dbff3009ab7c354b26d0e2ec381b"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/opencode/src/config/config.ts: packages/opencode/src/config/config.ts changed 33 times in last 90 days, max complexity 49. 8 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/opencode/src/config/config.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"b89a7203710a1a9048810200308f32dba06d54d2d3305a51582214f4a794d4b2"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/opencode/src/session/message-v2.ts: packages/opencode/src/session/message-v2.ts changed 29 times in last 90 days, max complexity 53. 9 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/opencode/src/session/message-v2.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"d4833ed0ff2b7cea52c6e89cf5b25a0a64b04bb8c09682aafea00dfc19f8a6d2"}},{"ruleId":"D15","level":"warning","message":{"text":"Hotspot: packages/opencode/src/session/processor.ts: packages/opencode/src/session/processor.ts changed 30 times in last 90 days, max complexity 46. 4 of those changes were fix/bug commits, so the churn is repair rather than feature work. Before the next change lands here, cover the area it touches with tests, then split that area out of the file so the following change is smaller than this one \u2014 a file this often edited pays the complexity back every time."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/opencode/src/session/processor.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"916399fb5bebd05e739f95aae46b01841bf6560b910c530c04f80b1d4f07f651"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #1: If anonymized user #1 becomes unavailable, 21 significant file(s) lose their only recent owner: packages/httpapi-codegen/src/index.ts, packages/schema/src/v1/session.ts, packages/llm/src/route/transport/websocket.ts, packages/effect-drizzle-sqlite/src/effect-sqlite/session.ts, packages/opencode/src/session/llm/native-request.ts, packages/llm/src/protocols/utils/tool-stream.ts, packages/http-recorder/src/websocket.ts, packages/llm/src/schema/errors.ts (\u002B13 more). Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"2c57b384a7aee7160b02c4b52f252396d2ce01e81ee85c0bc8f931867e73b311"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #2: If anonymized user #2 becomes unavailable, 16 significant file(s) lose their only recent owner: packages/console/app/src/routes/workspace/[id]/usage/graph-section.tsx, packages/console/core/src/billing.ts, packages/console/core/script/lookup-user.ts, packages/console/app/src/routes/workspace/[id]/billing/billing-section.tsx, packages/console/app/src/routes/workspace/[id]/usage/usage-section.tsx, packages/console/app/src/routes/workspace/[id]/model-section.tsx, packages/console/core/src/model.ts, packages/console/app/src/routes/zen/util/providerBudgetTracker.ts (\u002B8 more). Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"cfef072e0fdc5716551397824a0478e98fc28923e8a2fd1a0057ced347bd5c7b"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #3: If anonymized user #3 becomes unavailable, 11 significant file(s) lose their only recent owner: packages/stats/core/src/domain/home.ts, packages/console/app/src/routes/black/workspace.tsx, packages/stats/core/src/domain/model.ts, packages/stats/core/src/domain/provider.ts, packages/app/src/context/highlights.tsx, packages/stats/core/src/database/schema.ts, packages/app/src/components/prompt-input/editor-dom.ts, packages/console/app/src/lib/changelog.ts (\u002B3 more). Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"59c7b684108e176072e6a13847564eca71e1d1c9d0d13565d6600ae85adf7e22"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #4: If anonymized user #4 becomes unavailable, 6 significant file(s) lose their only recent owner: script/github/close-prs.ts, packages/core/src/oauth/page.ts, packages/opencode/src/tool/code-mode.ts, packages/codemode/src/openapi/index.ts, packages/tui/src/component/dialog-console-org.tsx, packages/opencode/src/util/proxy-env.ts. Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"de1b728a594f23f061e0c0a9cf8475f011a1a60fd3f39c4164fe225f023fc1e0"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #5: If anonymized user #5 becomes unavailable, 5 significant file(s) lose their only recent owner: packages/opencode/src/acp/tool.ts, packages/opencode/src/acp/permission.ts, packages/opencode/src/server/routes/instance/httpapi/errors.ts, packages/llm/src/protocols/utils/tool-schema.ts, packages/opencode/src/tool/mcp-websearch.ts. Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"1d80d652707cf51d587e169147ea64c903b31a3d8e66445cf56f4648b9dc3899"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #6: If anonymized user #6 becomes unavailable, 4 significant file(s) lose their only recent owner: packages/opencode/src/cli/cmd/run/types.ts, packages/opencode/src/cli/cmd/run/session.shared.ts, packages/tui/src/ui/dialog-prompt.tsx, packages/tui/src/util/locale.ts. Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"61dff605d877fe4560defcaef9d6b2990a35758e5bd72ac4b2d7868695e555d5"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #7: If anonymized user #7 becomes unavailable, 4 significant file(s) lose their only recent owner: packages/session-ui/src/v2/components/line-comment-annotations-v2.tsx, packages/app/src/components/settings-v2/dialog-server-v2.tsx, packages/ui/src/theme/v2/resolve.ts, packages/app/src/utils/search-keydown.ts. Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"604ed4e247679c5e6a00dc10aa11fa1d481bd49feb4c2e966490f1152542ab37"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #8: If anonymized user #8 becomes unavailable, 3 significant file(s) lose their only recent owner: packages/core/src/location-services.ts, packages/tui/src/context/project.tsx, packages/opencode/src/server/routes/instance/httpapi/handlers/project-copy.ts. Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"e740597cc1a281fbdc2608239ec05c14d42bda8f3d9ea10c2e395c6a9de56b9b"}},{"ruleId":"D16","level":"note","message":{"text":"Further sole-owners (lower concentration): 7 other contributor(s) are each the sole owner of a small amount of code below the off-boarding threshold \u2014 folded into the bus-factor score and metrics (82 single-owned of 1030 analysed files in total, counted over production source files of roughly 100 lines or more, excluding tests, vendored, generated and example/demo trees, largest first). They are anonymized user #9 (3 file(s)), anonymized user #10 (2 file(s)), anonymized user #11 (2 file(s)), anonymized user #12 (2 file(s)), anonymized user #13 (1 file(s)), anonymized user #14 (1 file(s)) (\u002B1 more) \u2014 spread or document their files in the same way, at lower priority than the named off-boarding risks above."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"6eac528f2429e724e1a97ed868f79eefbcf1888dab4af9a9e673429369bb5b2f"}},{"ruleId":"D19","level":"note","message":{"text":"The global README mentions opencode.ai but does not link to the hosted documentation site (https://opencode.ai) where users can find the full API reference, model list, and pricing.: Add a link to the hosted docs site so new visitors can find the resources without leaving the README."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"b77130a67df23c3bfb65f055849ce6b078bd365e58df519173a8734cf4c539bb"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"5a0062ece95325655caf30b65ba1cba47d0a9ad5ae07b77c5f7f5a1cbf4f27a0"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"3c02e964ad62c867b8999a79ed0e0825185e65779775ce526617f14cbbd9099f"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b321893cb63e639281ee42cf351b7f98b4792bb265e6f2b3ae5397a1924fda34"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"d4cc235bb6054946fcc2d9f2f4f8da179ae797848659574b0d3151d31457fd8e"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"5ad5e2e7d0a99386df5f2d029b55ebee91f83845804c305d65ccc695bbda4ed5"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"77a66444f85d4bf7ff307be817c5501391dfeca3746f19ec06ab16bb60970799"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6f593c23864af90525dde129cbf9849088c84993d1d5e12a8aeb729f29a31cc0"}},{"ruleId":"D28","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"3cdfd7beb31b791ae18dcb425e21eb157c842e7bbcd522cc330573c1a6538db1"}},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b4a4368c236771ebe847d3e678b5b24b6f4021bbeafb677310e02fa9477b0951"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"7dbe5a3b3b452d070c193b5786492122b6fc787e7b0a76cd9b95ee48c80d05c7"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"d72e74a050470a11ad950ae25abc51525ad32481c7c16c9192369e2f1ef2d7fb"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"219df958c0cd0809d531c4c0aaa15789e353c0bbdfcf7a3c19f3488a824797ad"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6ab6c00a3af4c80447ca455cbcc07a5fb0de7c115f76a7a4aaec641000fd5699"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"dde6f3fbf9dda22a9f91c7f0e44d5fe2dfe1aea172510bb67a17e168f1aa8513"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"ae3ca8c8f805645d2a57ff0bc334a72313875cd5673a4e9e53a3d9a725fd3e6a"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"43542db13f12b92edd7e9b8688629b031738d91f89faadc9fdfb7d256e0c1d3b"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"234f46f860341cb2a77076436c1a10f179bffd14f9155736d7152acada0ab19c"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"fe9c2422135c7c87299217beac95f376d03757dcfd857fd33dd0732c453e1800"},"taxa":[{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"526d82071ab34d4bb2111dde695d3bf97ace2fe86815fa8ed08b85aebf05e8e7"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"8dce40f41c74797d1e464644503016ef27bc273fe7d782a2f20dbd228e99e82b"},"taxa":[{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6c05fce20f9fcf3c0b9219bd25885b0dfe5e1b4eff1fd4d86751dea057a3a724"},"taxa":[{"id":"CWE-95","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D31","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"5c0326f32eb5f5ed0c88d5987fe0ffe58f48e322423c85a808b8dcbc3aec2996"}},{"ruleId":"D31","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b2c1af8bc7e82d9e0f03f9e5767c3a913ed16fd995418d218b3460eeb76dd03b"}},{"ruleId":"D31","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"685831f423c04b32adbccb807167cebf8ccbd454afc73c455d061f5703dcc0ca"}},{"ruleId":"D31","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"15c8172a1abf20ed367ec96cf9df9ddfab448219cae483bfe6e960aa8022a304"}},{"ruleId":"D31","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"438320c90cfe73a9299353ba7883a1c8b612fe7ea216432f424cf3ef35d180f2"}},{"ruleId":"D31","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c5bafb10d7d7f7608e5da7c358623c67fd1d87fc909753a7469e9777a7f233f0"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b29b6625778e52955ad6a0740db301486c147e1ac89aa7feed220d071a20d0fd"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"523c7291daaaad4f57fc8b8d53a03705f873c4cb251ae678f1a558465393e6f3"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"7e4f13aa9a54fe601979c90ac3116fc436b52300e6529d302bc2855fb4e63e18"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"12db644d9b04ac67de8a768b0900216f507ad1ff29aa3e688db073744de91349"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"760185361a48aaeb16473b85e815e8cad1927dc48f31c9cee31ecdb2a9fbcd67"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"1dff68a53c043076de962616455bee57e5f1f6fef5e60c9c780f2660d1e681e5"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"f8c97849ac7a3e17c3185f421f75febab3d35d00b82f0cfc20ff2be01ff6d33b"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"bdcabac0dd71d4c359d0422ce91b66629adfc2b673122872ad58988ac06068f3"}},{"ruleId":"D31","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"de646f87845761f3b5b963c107039e066cbec51fc2fc4725b090aedec8800111"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: status-popover.tsx \u2194 server-health.ts: \u0060packages/app/src/components/status-popover.tsx\u0060 (context components) and \u0060packages/app/src/utils/server-health.ts\u0060 (context utils) sit in DIFFERENT parts of the tree yet change together 67% of the time (8 of the 12 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/components/status-popover.tsx"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"e2c6d99939e1d2bb5fa41a0511596a78995ea210ac3a7ff9bcfdce2a85c9b27f"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: index.ts \u2194 github.ts: \u0060github/index.ts\u0060 (context github) and \u0060packages/opencode/src/cli/cmd/github.ts\u0060 (context opencode) sit in DIFFERENT parts of the tree yet change together 60% of the time (6 of the 10 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"github/index.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"9f82e4aa99254c6f28565b31f6ecf6b32b82795f868d8ef43b198d624d670d01"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: session-sortable-tab.tsx \u2194 session.tsx: \u0060packages/app/src/components/session/session-sortable-tab.tsx\u0060 (context components) and \u0060packages/app/src/pages/session.tsx\u0060 (context pages) sit in DIFFERENT parts of the tree yet change together 56% of the time (9 of the 16 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/components/session/session-sortable-tab.tsx"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"3fb1437dccdb92ab568eb00144523809433e32837555d41250d3403dacb789f4"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: bootstrap.ts \u2194 font.tsx: \u0060packages/app/src/context/global-sync/bootstrap.ts\u0060 (context context) and \u0060packages/ui/src/components/font.tsx\u0060 (context ui) sit in DIFFERENT parts of the tree yet change together 55% of the time (6 of the 11 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/context/global-sync/bootstrap.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"34c2c3ba2696786ee5502bea537be19e9d2af87f656d7677640e92f92f9e14e2"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: session-context-tab.tsx \u2194 session.tsx: \u0060packages/app/src/components/session/session-context-tab.tsx\u0060 (context components) and \u0060packages/app/src/pages/session.tsx\u0060 (context pages) sit in DIFFERENT parts of the tree yet change together 50% of the time (13 of the 26 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/components/session/session-context-tab.tsx"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"40ee1dce9a7e8cb218332755041adbbee3f765002e3cba15ee4679e2e753d5d2"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: session-sortable-terminal-tab.tsx \u2194 session.tsx: \u0060packages/app/src/components/session/session-sortable-terminal-tab.tsx\u0060 (context components) and \u0060packages/app/src/pages/session.tsx\u0060 (context pages) sit in DIFFERENT parts of the tree yet change together 50% of the time (9 of the 18 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/components/session/session-sortable-terminal-tab.tsx"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"8a71c4c2110cf77014c91fa923fb1f0c452662bd2181f9bfb8afe8fddd4c2832"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: directory-layout.tsx \u2194 server-health.ts: \u0060packages/app/src/pages/directory-layout.tsx\u0060 (context pages) and \u0060packages/app/src/utils/server-health.ts\u0060 (context utils) sit in DIFFERENT parts of the tree yet change together 50% of the time (6 of the 12 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/pages/directory-layout.tsx"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"c8ccf760490ffd9aeb1ae7375bbd2958c61908de6c7a0af811520cefda9236bc"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: bootstrap.ts \u2194 server-health.ts: \u0060packages/app/src/context/global-sync/bootstrap.ts\u0060 (context context) and \u0060packages/app/src/utils/server-health.ts\u0060 (context utils) sit in DIFFERENT parts of the tree yet change together 50% of the time (6 of the 12 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/context/global-sync/bootstrap.ts"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"f262dfa083c2c6f06ae208fb63896504ed655da12b852d88ca80890f06a1c68d"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: server-sync.tsx \u2194 server-health.ts: \u0060packages/app/src/context/server-sync.tsx\u0060 (context context) and \u0060packages/app/src/utils/server-health.ts\u0060 (context utils) sit in DIFFERENT parts of the tree yet change together 50% of the time (6 of the 12 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/context/server-sync.tsx"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"2c3db2c6afd378010327b119f64136d27d4990878d6b1fa06be7238a359eb347"}},{"ruleId":"D35","level":"error","message":{"text":"Boundary-crossing change coupling: terminal.tsx \u2194 server-health.ts: \u0060packages/app/src/components/terminal.tsx\u0060 (context components) and \u0060packages/app/src/utils/server-health.ts\u0060 (context utils) sit in DIFFERENT parts of the tree yet change together 50% of the time (6 of the 12 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well) \u2014 the bounded-context boundary may be in the wrong place, or one context is leaking into the other. This is the behavioural boundary violation a static scan can\u0027t see."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"packages/app/src/components/terminal.tsx"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"7faa2c2a4ba184fd8b42fa756d9f11d8a0623d74a52519d9caf3806cb7aa66c0"}},{"ruleId":"D36","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"1b213f6eedd4b140d0bc37bdf1496f72811a643f34064f12518b32e9e83bcfc7"}},{"ruleId":"D36","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"eb00976a698a5d68999b7ee6d27206fd374e916853e7ff1ead5eed42386f043f"}},{"ruleId":"D36","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"0752d0df7434000fcabf1048e2de30a7a1a8b982b3db9a19898c4dec199856b4"}}],"taxonomies":[{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d","organization":"MITRE","informationUri":"https://cwe.mitre.org/","isComprehensive":false,"shortDescription":{"text":"The MITRE Common Weakness Enumeration (CWE)."},"taxa":[{"id":"CWE-1032","guid":"5f21e517-68aa-a650-9a25-5771ef024637","name":"OWASP Top Ten \u2014 Security Misconfiguration category","shortDescription":{"text":"OWASP Top Ten \u2014 Security Misconfiguration category"},"helpUri":"https://cwe.mitre.org/data/definitions/1032.html"},{"id":"CWE-1059","guid":"a2381a08-60f6-9554-a8b8-f3018cfaaca5","name":"Insufficient Technical Documentation","shortDescription":{"text":"Insufficient Technical Documentation"},"helpUri":"https://cwe.mitre.org/data/definitions/1059.html"},{"id":"CWE-1357","guid":"e4d2e772-757e-0a5c-bd7d-77052949d866","name":"Reliance on Insufficiently Trustworthy Component","shortDescription":{"text":"Reliance on Insufficiently Trustworthy Component"},"helpUri":"https://cwe.mitre.org/data/definitions/1357.html"},{"id":"CWE-1395","guid":"800e09e7-c11a-8654-9fa6-86f398995fed","name":"Dependency on Vulnerable Third-Party Component","shortDescription":{"text":"Dependency on Vulnerable Third-Party Component"},"helpUri":"https://cwe.mitre.org/data/definitions/1395.html"},{"id":"CWE-16","guid":"659db3ea-affc-8453-8add-c1218fbfcb92","name":"Configuration","shortDescription":{"text":"Configuration"},"helpUri":"https://cwe.mitre.org/data/definitions/16.html"},{"id":"CWE-259","guid":"ae9ad959-fbb6-9d5e-892d-3dca66da0b69","name":"Use of Hard-coded Password","shortDescription":{"text":"Use of Hard-coded Password"},"helpUri":"https://cwe.mitre.org/data/definitions/259.html"},{"id":"CWE-353","guid":"09d7e902-d4ee-f05d-ae6c-0a1554d0c18f","name":"CWE-353","shortDescription":{"text":"CWE-353"},"helpUri":"https://cwe.mitre.org/data/definitions/353.html"},{"id":"CWE-494","guid":"b8a65e0d-e459-4a55-a931-fc1136482375","name":"Download of Code Without Integrity Check","shortDescription":{"text":"Download of Code Without Integrity Check"},"helpUri":"https://cwe.mitre.org/data/definitions/494.html"},{"id":"CWE-732","guid":"1da27e8f-b330-7650-ab63-bd61953eae5d","name":"Incorrect Permission Assignment for Critical Resource","shortDescription":{"text":"Incorrect Permission Assignment for Critical Resource"},"helpUri":"https://cwe.mitre.org/data/definitions/732.html"},{"id":"CWE-77","guid":"332c8ade-6612-9f56-a06b-d8d90b1a8750","name":"Command Injection","shortDescription":{"text":"Command Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/77.html"},{"id":"CWE-78","guid":"2e31ceaf-c7ae-2e5e-9661-cfb1362789cf","name":"OS Command Injection","shortDescription":{"text":"OS Command Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/78.html"},{"id":"CWE-79","guid":"fd45580b-e8c4-fc5e-8c2f-aa8fab0b4dbf","name":"Cross-site Scripting (XSS)","shortDescription":{"text":"Cross-site Scripting (XSS)"},"helpUri":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-798","guid":"5e8f057d-fee3-995a-a0cb-9fc5b0d174d1","name":"Use of Hard-coded Credentials","shortDescription":{"text":"Use of Hard-coded Credentials"},"helpUri":"https://cwe.mitre.org/data/definitions/798.html"},{"id":"CWE-829","guid":"13c33925-97fb-5a5e-b40c-56d328b8a4d7","name":"CWE-829","shortDescription":{"text":"CWE-829"},"helpUri":"https://cwe.mitre.org/data/definitions/829.html"},{"id":"CWE-89","guid":"6d08fdad-37eb-c150-bbf0-d7d946863407","name":"SQL Injection","shortDescription":{"text":"SQL Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/89.html"},{"id":"CWE-937","guid":"16f316ae-415c-b354-a59b-1f7905f756e9","name":"Using Components with Known Vulnerabilities","shortDescription":{"text":"Using Components with Known Vulnerabilities"},"helpUri":"https://cwe.mitre.org/data/definitions/937.html"},{"id":"CWE-94","guid":"75e7f50c-6c2f-dd52-bf40-bf6c52b861fd","name":"Code Injection","shortDescription":{"text":"Code Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/94.html"},{"id":"CWE-95","guid":"400bba4e-483c-5c50-a695-114fa9168003","name":"CWE-95","shortDescription":{"text":"CWE-95"},"helpUri":"https://cwe.mitre.org/data/definitions/95.html"}]}],"properties":{"codehealthPublication":{"public":true,"notice":"This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings \u2014 which rule fired, in which file, on which line, and how to fix it \u2014 are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.","securityFindingsRedacted":39,"secretScannerRunsExcluded":0}},"redactionTokens":["A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."]}]}