Maintainability Report

Generated 2026-10-02T23:49:37+00:00 · commit 9b16aaba343436cbbc64b01d046bf11d0a310be8 · branch fix/risk-findings · root /Users/marshallguillory/repos/secure-code-agent · standard ISO/IEC 25010 maintainability-inspired 0-5 scale, rate-based

Coverage

11 of 17 tools contributed — concerns all, depth heavy, license policy copyleft-any. Plus 8 built-in detectors.

One source only: complexity, dead-code, metrics.

A built-in detector examined these and no external tool did, so nothing corroborates them. Install a tool covering the concern to get a second opinion.

declarations measured by analyzers, completed by built-in detectors: no analyzer supplies cognitive_complexity for Go, Java, JavaScript, Ruby, so the built-in scanner supplied it for those declarations and the analyzers supplied the rest; the criterion set is complete per declaration, which is what makes the rate comparable to the rubric's.

Nothing examined: documentation, structure, style, testing, types.

These concerns are unmeasured, not clean. Install a tool that covers them, or widen analyzers.depth, to have them reported.

Analyzer children are not network-isolated. 11 external tools ran as local child processes. This agent does not transmit the audited source and opens no socket of its own, but it does not sandbox what it spawns: a third-party analyzer that reaches the network is outside what this run controls or observes. Determinism and no upload are the promise; a kernel air-gap is not.

Recorded scans

Estimate over recorded scans

Pillars over time (condition)

Practice level over time (maturity — a separate series)

Categories, this scan

Trend

9 scans, 2026-10-02T18:05:36Z to 2026-10-02T23:52:25Z.

• Direction: indistinguishable. Change +0.20.
• Debt velocity: 3 introduced, 7 cleared.
• Growth: grew without getting worse.
• Never cleared in this window: 40 findings.

Every figure describes scans that happened; nothing forecasts.

Economic Context (scenario)

3,608 – 61,050 USD over 12 months (base 18,315 USD), across 44 work-order item(s).

This is a scenario, not a prediction.

Assumptions:

• each bound = affected changes/year × incremental hours/change × loaded labor rate × horizon/12
• affected changes/year taken from hotspot churn over the 12-month history window
• incremental hours/change of 0.25-2.0 (base 1.0) — a stated default unless configured
• loaded labor rate 130.0-275.0 USD/hour (base 165.0), as configured
• planning horizon of 12 months
• a scenario computed from these assumptions; change them and the range moves with them

TDD-shaped tests

TDD-shaped tests: detected beside 45 of 45 production source files (path pairing). Constructs: pytest in 77 file(s), unittest in 1 file(s), describe_it in 2 file(s), parametrize in 30 file(s), given_when_then in 2 file(s).

Chronology is not measured. Effectiveness is unscored unless the operator opted into suite execution.

Test Suite

The operator opted in to running the repository's test command; it passed.

Command: pytest

Program run: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/pytest

Coverage: no coverage reported by the run

Pillars

Practice level 4 of 5 — CI holds a numeric quality gate.

Not measured here, and why:

• efficiency — requires profiling, load testing and runtime telemetry, none of which a static pass produces; permanently out of scope rather than temporarily unmeasured
• security — secure-code-agent owns the security pillar: it runs the scanner floor, reports coverage as a separate axis, and withholds a grade when the evidence cannot support one

Enforcement found: linter-config, recorded-decisions, lint-in-ci, coverage-gate.

ISO/IEC 25010 Maintainability Score

Aspect Scores

Not Scored — no measurement exists

Largest Files

Function Hotspots

Work order

Copy-paste prompts

One self-contained prompt per item — copy any block into a coding agent. A block for an item that needs a design decision asks for that decision, not a patch.

_do_audit in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 272 lines against 80, complexity 29 against 15, cognitive 18 against 25).
Location: src/secure_code_audit/cli.py:495
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_parser in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 159 lines against 80, complexity 2 against 15, cognitive 0 against 25).
Location: src/secure_code_audit/cli.py:70
Why: a long function is where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_print_summary in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 76 lines against 80, complexity 19 against 15, cognitive 19 against 25).
Location: src/secure_code_audit/cli.py:1334
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_split_axes in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 108 lines against 80, complexity 8 against 15, cognitive 14 against 25).
Location: src/secure_code_audit/cli.py:385
Why: a long function is where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_apply_scanners in src/secure_code_audit/config.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 36 lines against 80, complexity 17 against 15, cognitive 21 against 25).
Location: src/secure_code_audit/config.py:478
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_validate_gates in src/secure_code_audit/config.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 32 lines against 80, complexity 21 against 15, cognitive 21 against 25).
Location: src/secure_code_audit/config.py:641
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/findings.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `silent-truncation` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/findings.py:181
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_parse_sarif in src/secure_code_audit/scanners/semgrep_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 56 lines against 80, complexity 24 against 15, cognitive 32 against 25).
Location: src/secure_code_audit/scanners/semgrep_scanner.py:150
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/remediation.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/remediation.py:37
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

load in src/secure_code_audit/suppressions.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 111 lines against 80, complexity 30 against 15, cognitive 44 against 25).
Location: src/secure_code_audit/suppressions.py:113
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

main in calibration/calibrate.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 116 lines against 80, complexity 18 against 15, cognitive 17 against 25).
Location: calibration/calibrate.py:438
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

summarize in calibration/calibrate.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 70 lines against 80, complexity 31 against 15, cognitive 12 against 25).
Location: calibration/calibrate.py:366
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_audit_inputs in src/secure_code_audit/scanners/pip_audit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 33 lines against 80, complexity 17 against 15, cognitive 13 against 25).
Location: src/secure_code_audit/scanners/pip_audit_scanner.py:107
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

compare in src/secure_code_audit/verify.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 79 lines against 80, complexity 25 against 15, cognitive 7 against 25).
Location: src/secure_code_audit/verify.py:294
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_resolve_standards in src/secure_code_audit/scanners/_finding_builder.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 51 lines against 80, complexity 16 against 15, cognitive 23 against 25).
Location: src/secure_code_audit/scanners/_finding_builder.py:35
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

assess in src/secure_code_audit/practice.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 94 lines against 80, complexity 28 against 15, cognitive 35 against 25).
Location: src/secure_code_audit/practice.py:207
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in README.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: README.md:139
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in docs/remediation.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: docs/remediation.md:57
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in skills/secure-code-agent/references/finding-taxonomy.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: skills/secure-code-agent/references/finding-taxonomy.md:75
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

duplicated block in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/cli.py.
Location: src/secure_code_audit/cli.py:162
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

src/secure_code_audit/cli.py is 1577 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: src/secure_code_audit/cli.py is 1577 lines.
Location: src/secure_code_audit/cli.py
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

near-duplicate declaration in src/secure_code_audit/scoring.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: near-duplicate declaration in src/secure_code_audit/scoring.py.
Location: src/secure_code_audit/scoring.py:842
Also at: src/secure_code_audit/scoring.py:858
Why: near-copies drift apart silently, which is worse than exact duplication; reconciling them requires deciding which behaviour was intended
Direction once decided: consolidate the two into one declaration, or say why they are deliberately separate; editing one alone leaves the other.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

src/secure_code_audit/scoring.py is 951 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: src/secure_code_audit/scoring.py is 951 lines.
Location: src/secure_code_audit/scoring.py
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/semgrep_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/semgrep_scanner.py.
Location: src/secure_code_audit/scanners/semgrep_scanner.py:128
Also at: src/secure_code_audit/scanners/trivy_scanner.py:54
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/bandit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/bandit_scanner.py.
Location: src/secure_code_audit/scanners/bandit_scanner.py:11
Also at: src/secure_code_audit/scanners/gosec_scanner.py:32, src/secure_code_audit/scanners/njsscan_scanner.py:26
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 3 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/osv_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/osv_scanner.py.
Location: src/secure_code_audit/scanners/osv_scanner.py:44
Also at: src/secure_code_audit/scanners/trufflehog_scanner.py:32
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/npm_audit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/npm_audit_scanner.py.
Location: src/secure_code_audit/scanners/npm_audit_scanner.py:103
Also at: src/secure_code_audit/scanners/osv_scanner.py:106
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

CHANGELOG.md is 1391 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: CHANGELOG.md is 1391 lines.
Location: CHANGELOG.md
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

docs/decisions.md is 1857 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: docs/decisions.md is 1857 lines.
Location: docs/decisions.md
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in README.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in README.md.
Location: README.md:112
Also at: docs/remediation.md:27
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in skills/secure-code-agent/SKILL.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in skills/secure-code-agent/SKILL.md.
Location: skills/secure-code-agent/SKILL.md:30
Also at: skills/secure-code-agent/copilot/secure-code-agent.prompt.md:23
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/integration/test_gated_findings_are_reportable.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/integration/test_gated_findings_are_reportable.py.
Location: tests/integration/test_gated_findings_are_reportable.py:99
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/integration/test_target_shapes.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/integration/test_target_shapes.py.
Location: tests/integration/test_target_shapes.py:136
Also at: tests/unit/test_cli_coverage.py:226, tests/unit/test_declared_capabilities.py:220
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 3 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_cli_coverage.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_cli_coverage.py.
Location: tests/unit/test_cli_coverage.py:51
Also at: tests/unit/test_declared_capabilities.py:235
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_code_scanning_sarif_raises_only_alerts.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_code_scanning_sarif_raises_only_alerts.py.
Location: tests/unit/test_code_scanning_sarif_raises_only_alerts.py:57
Also at: tests/unit/test_finding_path_consumers.py:49
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_declared_capabilities.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_declared_capabilities.py.
Location: tests/unit/test_declared_capabilities.py:45
Also at: tests/unit/test_declared_findings_are_not_patch_targets.py:46
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_gate_reporting.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_gate_reporting.py.
Location: tests/unit/test_gate_reporting.py:105
Also at: tests/unit/test_plan_features.py:66, tests/unit/test_scan_scope.py:34
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 3 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_offline_ruleset.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_offline_ruleset.py.
Location: tests/unit/test_offline_ruleset.py:63
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_offline_ruleset.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_offline_ruleset.py.
Location: tests/unit/test_offline_ruleset.py:218
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_plan_features.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_plan_features.py.
Location: tests/unit/test_plan_features.py:37
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_practice.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_practice.py.
Location: tests/unit/test_practice.py:98
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_sarif_roundtrip.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_sarif_roundtrip.py.
Location: tests/unit/test_sarif_roundtrip.py:255
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_sarif_roundtrip.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_sarif_roundtrip.py.
Location: tests/unit/test_sarif_roundtrip.py:135
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_tier2_scanners.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_tier2_scanners.py.
Location: tests/unit/test_tier2_scanners.py:145
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

Security Work Order

Written by secure-code-agent 0.12.10 and reproduced as it wrote it. It is that tool's work order, not this one's: its findings are not re-ranked or merged into the maintainability work order above.

0 to fix · 0 to review · 1733 suppression candidates.

Semantic findings

TypeScript semantic coverage: unknown — no recorded type analysis and no local type checker: semantic coverage for TypeScript is unknown. Absence of analysis is not absence of findings.