Maintainability Report

Generated 2026-10-02T18:02:32+00:00 · commit 16b46248f9bbb503b850228a913d846eb4b4fbeb · branch codex/hermetic-tests-and-coverage · root /Users/marshallguillory/repos/secure-code-agent · standard ISO/IEC 25010 maintainability-inspired 0-5 scale, rate-based

Coverage

11 of 17 tools contributed — concerns all, depth heavy, license policy copyleft-any. Plus 8 built-in detectors.

One source only: complexity, dead-code, metrics.

A built-in detector examined these and no external tool did, so nothing corroborates them. Install a tool covering the concern to get a second opinion.

declarations measured by analyzers, completed by built-in detectors: no analyzer supplies cognitive_complexity for Go, Java, JavaScript, Ruby, so the built-in scanner supplied it for those declarations and the analyzers supplied the rest; the criterion set is complete per declaration, which is what makes the rate comparable to the rubric's.

Nothing examined: documentation, structure, style, testing, types.

These concerns are unmeasured, not clean. Install a tool that covers them, or widen analyzers.depth, to have them reported.

Analyzer children are not network-isolated. 11 external tools ran as local child processes. This agent does not transmit the audited source and opens no socket of its own, but it does not sandbox what it spawns: a third-party analyzer that reaches the network is outside what this run controls or observes. Determinism and no upload are the promise; a kernel air-gap is not.

Recorded scans

Estimate over recorded scans

Pillars over time (condition)

Practice level over time (maturity — a separate series)

Categories, this scan

Trend

1 scan, 2026-10-02T18:05:36Z to 2026-10-02T18:05:36Z.

• Direction: unknown.
• Debt velocity: 0 introduced, 0 cleared.
• Growth: unknown.
• Never cleared in this window: 47 findings.

Every figure describes scans that happened; nothing forecasts.

Economic Context (scenario)

4,322 – 73,150 USD over 12 months (base 21,945 USD), across 51 work-order item(s).

This is a scenario, not a prediction.

Assumptions:

• each bound = affected changes/year × incremental hours/change × loaded labor rate × horizon/12
• affected changes/year taken from hotspot churn over the 12-month history window
• incremental hours/change of 0.25-2.0 (base 1.0) — a stated default unless configured
• loaded labor rate 130.0-275.0 USD/hour (base 165.0), as configured
• planning horizon of 12 months
• a scenario computed from these assumptions; change them and the range moves with them

TDD-shaped tests

TDD-shaped tests: detected beside 41 of 42 production source files (path pairing). Constructs: pytest in 66 file(s), unittest in 1 file(s), describe_it in 2 file(s), parametrize in 26 file(s), given_when_then in 1 file(s).

Chronology is not measured. Effectiveness is unscored unless the operator opted into suite execution.

Test Suite

The operator opted in to running the repository's test command; it passed.

Command: pytest

Program run: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/pytest

Coverage: no coverage reported by the run

Pillars

Practice level 4 of 5 — CI holds a numeric quality gate.

Not measured here, and why:

• efficiency — requires profiling, load testing and runtime telemetry, none of which a static pass produces; permanently out of scope rather than temporarily unmeasured
• security — secure-code-agent owns the security pillar: it runs the scanner floor, reports coverage as a separate axis, and withholds a grade when the evidence cannot support one

Enforcement found: linter-config, recorded-decisions, lint-in-ci, coverage-gate.

ISO/IEC 25010 Maintainability Score

Aspect Scores

Not Scored — no measurement exists

Largest Files

Function Hotspots

Work order

Copy-paste prompts

One self-contained prompt per item — copy any block into a coding agent. A block for an item that needs a design decision asks for that decision, not a patch.

_do_audit in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 346 lines against 80, complexity 36 against 15, cognitive 32 against 25).
Location: src/secure_code_audit/cli.py:364
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_parser in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 159 lines against 80, complexity 2 against 15, cognitive 0 against 25).
Location: src/secure_code_audit/cli.py:70
Why: a long function is where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_print_summary in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 76 lines against 80, complexity 19 against 15, cognitive 19 against 25).
Location: src/secure_code_audit/cli.py:1277
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_from_dict in src/secure_code_audit/config.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 158 lines against 80, complexity 51 against 15, cognitive 63 against 25).
Location: src/secure_code_audit/config.py:431
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_validate_gates in src/secure_code_audit/config.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 32 lines against 80, complexity 21 against 15, cognitive 21 against 25).
Location: src/secure_code_audit/config.py:606
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/renderers.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `absence-as-zero` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/renderers.py:555
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/renderers.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `absence-as-zero` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/renderers.py:556
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/scoring.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `absence-as-zero` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/scoring.py:437
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/scoring.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `absence-as-zero` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/scoring.py:937
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

Scanner in src/secure_code_audit/scanners/base.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 423 lines against the 300-line class limit).
Location: src/secure_code_audit/scanners/base.py:33
Why: an oversized class hides its own structure, and every change to it is read against all of it

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_make_finding in src/secure_code_audit/scanners/base.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 85 lines against 80, complexity 17 against 15, cognitive 24 against 25).
Location: src/secure_code_audit/scanners/base.py:236
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_parse_sarif in src/secure_code_audit/scanners/semgrep_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 56 lines against 80, complexity 24 against 15, cognitive 32 against 25).
Location: src/secure_code_audit/scanners/semgrep_scanner.py:150
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/findings.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `silent-truncation` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/findings.py:181
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/remediation.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/remediation.py:37
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

load in src/secure_code_audit/suppressions.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 97 lines against 80, complexity 30 against 15, cognitive 44 against 25).
Location: src/secure_code_audit/suppressions.py:113
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_audit_inputs in src/secure_code_audit/scanners/pip_audit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 33 lines against 80, complexity 17 against 15, cognitive 13 against 25).
Location: src/secure_code_audit/scanners/pip_audit_scanner.py:107
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

main in calibration/calibrate.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 114 lines against 80, complexity 16 against 15, cognitive 17 against 25).
Location: calibration/calibrate.py:415
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

summarize in calibration/calibrate.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 70 lines against 80, complexity 31 against 15, cognitive 12 against 25).
Location: calibration/calibrate.py:343
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

unpaired declaration in calibration/calibrate.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: add a paired test for `main`.
Location: calibration/calibrate.py:415
Why: an oversized production unit with no paired test is where changes land unguarded

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

unpaired declaration in calibration/calibrate.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: add a paired test for `summarize`.
Location: calibration/calibrate.py:343
Why: an oversized production unit with no paired test is where changes land unguarded

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

compare in src/secure_code_audit/verify.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 79 lines against 80, complexity 25 against 15, cognitive 7 against 25).
Location: src/secure_code_audit/verify.py:294
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

assess in src/secure_code_audit/practice.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 94 lines against 80, complexity 28 against 15, cognitive 35 against 25).
Location: src/secure_code_audit/practice.py:207
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in README.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: README.md:139
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in docs/remediation.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: docs/remediation.md:57
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in skills/secure-code-agent/references/finding-taxonomy.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: skills/secure-code-agent/references/finding-taxonomy.md:75
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

duplicated block in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/cli.py.
Location: src/secure_code_audit/cli.py:162
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

src/secure_code_audit/cli.py is 1520 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: src/secure_code_audit/cli.py is 1520 lines.
Location: src/secure_code_audit/cli.py
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

near-duplicate declaration in src/secure_code_audit/scoring.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: near-duplicate declaration in src/secure_code_audit/scoring.py.
Location: src/secure_code_audit/scoring.py:832
Also at: src/secure_code_audit/scoring.py:848
Why: near-copies drift apart silently, which is worse than exact duplication; reconciling them requires deciding which behaviour was intended
Direction once decided: consolidate the two into one declaration, or say why they are deliberately separate; editing one alone leaves the other.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

src/secure_code_audit/scoring.py is 940 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: src/secure_code_audit/scoring.py is 940 lines.
Location: src/secure_code_audit/scoring.py
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/semgrep_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/semgrep_scanner.py.
Location: src/secure_code_audit/scanners/semgrep_scanner.py:128
Also at: src/secure_code_audit/scanners/trivy_scanner.py:54
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/bandit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/bandit_scanner.py.
Location: src/secure_code_audit/scanners/bandit_scanner.py:11
Also at: src/secure_code_audit/scanners/gosec_scanner.py:32, src/secure_code_audit/scanners/njsscan_scanner.py:26
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 3 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/osv_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/osv_scanner.py.
Location: src/secure_code_audit/scanners/osv_scanner.py:44
Also at: src/secure_code_audit/scanners/trufflehog_scanner.py:32
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/npm_audit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/npm_audit_scanner.py.
Location: src/secure_code_audit/scanners/npm_audit_scanner.py:103
Also at: src/secure_code_audit/scanners/osv_scanner.py:106
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

CHANGELOG.md is 1391 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: CHANGELOG.md is 1391 lines.
Location: CHANGELOG.md
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

docs/decisions.md is 1857 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: docs/decisions.md is 1857 lines.
Location: docs/decisions.md
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in README.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in README.md.
Location: README.md:112
Also at: docs/remediation.md:27
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in skills/secure-code-agent/SKILL.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in skills/secure-code-agent/SKILL.md.
Location: skills/secure-code-agent/SKILL.md:30
Also at: skills/secure-code-agent/copilot/secure-code-agent.prompt.md:23
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/integration/test_gated_findings_are_reportable.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/integration/test_gated_findings_are_reportable.py.
Location: tests/integration/test_gated_findings_are_reportable.py:99
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/integration/test_target_shapes.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/integration/test_target_shapes.py.
Location: tests/integration/test_target_shapes.py:136
Also at: tests/unit/test_cli_coverage.py:226, tests/unit/test_declared_capabilities.py:220
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 3 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_cli_coverage.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_cli_coverage.py.
Location: tests/unit/test_cli_coverage.py:51
Also at: tests/unit/test_declared_capabilities.py:235
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_code_scanning_sarif_raises_only_alerts.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_code_scanning_sarif_raises_only_alerts.py.
Location: tests/unit/test_code_scanning_sarif_raises_only_alerts.py:57
Also at: tests/unit/test_finding_path_consumers.py:49
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_declared_capabilities.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_declared_capabilities.py.
Location: tests/unit/test_declared_capabilities.py:45
Also at: tests/unit/test_declared_findings_are_not_patch_targets.py:46
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_gate_reporting.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_gate_reporting.py.
Location: tests/unit/test_gate_reporting.py:105
Also at: tests/unit/test_plan_features.py:66, tests/unit/test_scan_scope.py:34
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 3 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_offline_ruleset.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_offline_ruleset.py.
Location: tests/unit/test_offline_ruleset.py:63
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_offline_ruleset.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_offline_ruleset.py.
Location: tests/unit/test_offline_ruleset.py:218
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_plan_features.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_plan_features.py.
Location: tests/unit/test_plan_features.py:37
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_practice.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_practice.py.
Location: tests/unit/test_practice.py:98
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_sarif_roundtrip.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_sarif_roundtrip.py.
Location: tests/unit/test_sarif_roundtrip.py:255
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_sarif_roundtrip.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_sarif_roundtrip.py.
Location: tests/unit/test_sarif_roundtrip.py:135
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_tier2_scanners.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_tier2_scanners.py.
Location: tests/unit/test_tier2_scanners.py:145
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

unreferenced declaration in src/secure_code_audit/findings.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: remove the unreferenced declaration.
Location: src/secure_code_audit/findings.py:353
Why: unreachable code costs reading time and misleads a search, but deleting it is the cheapest change there is

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

Security Work Order

Written by secure-code-agent 0.12.10 and reproduced as it wrote it. It is that tool's work order, not this one's: its findings are not re-ranked or merged into the maintainability work order above.

0 to fix · 0 to review · 1455 suppression candidates.

Semantic findings

TypeScript semantic coverage: unknown — no recorded type analysis and no local type checker: semantic coverage for TypeScript is unknown. Absence of analysis is not absence of findings.