Maintainability Report

Generated 2026-10-03T18:28:17+00:00 · commit 398ed6f2358ee535eea6cc5adc72aa7ffc398d25 · branch main · root /Users/marshallguillory/repos/secure-code-agent · standard ISO/IEC 25010 maintainability-inspired 0-5 scale, rate-based

Coverage

11 of 17 tools contributed — concerns all, depth heavy, license policy copyleft-any. Plus 8 built-in detectors.

One source only: complexity, dead-code, metrics.

A built-in detector examined these and no external tool did, so nothing corroborates them. Install a tool covering the concern to get a second opinion.

declarations measured by analyzers, completed by built-in detectors: no analyzer supplies cognitive_complexity for Go, Java, JavaScript, Ruby, so the built-in scanner supplied it for those declarations and the analyzers supplied the rest; the criterion set is complete per declaration, which is what makes the rate comparable to the rubric's.

Nothing examined: documentation, structure, style, testing, types.

These concerns are unmeasured, not clean. Install a tool that covers them, or widen analyzers.depth, to have them reported.

Analyzer children are not network-isolated. 11 external tools ran as local child processes. This agent does not transmit the audited source and opens no socket of its own, but it does not sandbox what it spawns: a third-party analyzer that reaches the network is outside what this run controls or observes. Determinism and no upload are the promise; a kernel air-gap is not.

Recorded scans

Estimate over recorded scans

Pillars over time (condition)

Practice level over time (maturity — a separate series)

Categories, this scan

Trend

13 scans, 2026-10-02T18:05:36Z to 2026-10-03T18:30:02Z.

• Direction: indistinguishable. Change +0.20.
• Debt velocity: 26 introduced, 20 cleared.
• Growth: grew without getting worse.
• Never cleared in this window: 29 findings.

Every figure describes scans that happened; nothing forecasts.

Economic Context (scenario)

3,608 – 61,050 USD over 12 months (base 18,315 USD), across 54 work-order item(s).

This is a scenario, not a prediction.

Assumptions:

• each bound = affected changes/year × incremental hours/change × loaded labor rate × horizon/12
• affected changes/year taken from hotspot churn over the 12-month history window
• incremental hours/change of 0.25-2.0 (base 1.0) — a stated default unless configured
• loaded labor rate 130.0-275.0 USD/hour (base 165.0), as configured
• planning horizon of 12 months
• a scenario computed from these assumptions; change them and the range moves with them

TDD-shaped tests

TDD-shaped tests: detected beside 45 of 46 production source files (path pairing). Constructs: pytest in 81 file(s), unittest in 1 file(s), describe_it in 2 file(s), parametrize in 32 file(s), given_when_then in 2 file(s).

Chronology is not measured. Effectiveness is unscored unless the operator opted into suite execution.

Test Suite

The operator opted in to running the repository's test command; it did not run (exit 2).

Command: pytest

Program run: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/pytest

Coverage: no coverage reported by the run

Detail: pytest exited 2: ['==================================== ERRORS ====================================']

Pillars

Practice level 4 of 5 — CI holds a numeric quality gate.

Not measured here, and why:

• efficiency — requires profiling, load testing and runtime telemetry, none of which a static pass produces; permanently out of scope rather than temporarily unmeasured
• security — secure-code-agent owns the security pillar: it runs the scanner floor, reports coverage as a separate axis, and withholds a grade when the evidence cannot support one

Enforcement found: linter-config, recorded-decisions, lint-in-ci, coverage-gate.

ISO/IEC 25010 Maintainability Score

Aspect Scores

Not Scored — no measurement exists

Largest Files

Function Hotspots

Work order

Copy-paste prompts

One self-contained prompt per item — copy any block into a coding agent. A block for an item that needs a design decision asks for that decision, not a patch.

_do_audit in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 289 lines against 80, complexity 30 against 15, cognitive 19 against 25).
Location: src/secure_code_audit/cli.py:496
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_parser in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 159 lines against 80, complexity 2 against 15, cognitive 0 against 25).
Location: src/secure_code_audit/cli.py:71
Why: a long function is where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_print_summary in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 76 lines against 80, complexity 19 against 15, cognitive 19 against 25).
Location: src/secure_code_audit/cli.py:1424
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_split_axes in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 108 lines against 80, complexity 8 against 15, cognitive 14 against 25).
Location: src/secure_code_audit/cli.py:386
Why: a long function is where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_apply_scanners in src/secure_code_audit/config.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 36 lines against 80, complexity 17 against 15, cognitive 21 against 25).
Location: src/secure_code_audit/config.py:484
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_validate_gates in src/secure_code_audit/config.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 32 lines against 80, complexity 21 against 15, cognitive 21 against 25).
Location: src/secure_code_audit/config.py:663
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_parse_sarif in src/secure_code_audit/scanners/semgrep_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 56 lines against 80, complexity 24 against 15, cognitive 32 against 25).
Location: src/secure_code_audit/scanners/semgrep_scanner.py:148
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/findings.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `silent-truncation` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/findings.py:181
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in src/secure_code_audit/remediation.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: src/secure_code_audit/remediation.py:37
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

scan in src/secure_code_audit/scanners/bandit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 60 lines against 80, complexity 16 against 15, cognitive 16 against 25).
Location: src/secure_code_audit/scanners/bandit_scanner.py:55
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_audit_inputs in src/secure_code_audit/scanners/pip_audit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 33 lines against 80, complexity 17 against 15, cognitive 13 against 25).
Location: src/secure_code_audit/scanners/pip_audit_scanner.py:106
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

main in calibration/calibrate.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 133 lines against 80, complexity 20 against 15, cognitive 20 against 25).
Location: calibration/calibrate.py:438
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

summarize in calibration/calibrate.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 70 lines against 80, complexity 31 against 15, cognitive 12 against 25).
Location: calibration/calibrate.py:366
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

compare in src/secure_code_audit/verify.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 79 lines against 80, complexity 25 against 15, cognitive 7 against 25).
Location: src/secure_code_audit/verify.py:294
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

_resolve_standards in src/secure_code_audit/scanners/_finding_builder.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 82 lines against 80, complexity 12 against 15, cognitive 14 against 25).
Location: src/secure_code_audit/scanners/_finding_builder.py:41
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

assess in src/secure_code_audit/practice.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: reduce below the configured limits (currently 94 lines against 80, complexity 28 against 15, cognitive 35 against 25).
Location: src/secure_code_audit/practice.py:207
Why: a long, branching function is where defects concentrate and where every future change has to be understood first

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in README.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: README.md:139
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in docs/html/docs-remediation.html

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: docs/html/docs-remediation.html:65
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in docs/html/readme.html

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: docs/html/readme.html:171
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in docs/html/skills-secure-code-agent-references-finding-taxonomy.html

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: docs/html/skills-secure-code-agent-references-finding-taxonomy.html:153
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in docs/remediation.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: docs/remediation.md:57
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

configured risk pattern in skills/secure-code-agent/references/finding-taxonomy.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Task: act on what the `debt-marker` rule matched here, or say why it stays; deleting the matched text alone hides the finding without resolving it.
Location: skills/secure-code-agent/references/finding-taxonomy.md:75
Why: a risk pattern is a rule the active configuration enforces, and each hit is a single located line

Make one small, reviewable change. Do not alter public behavior or refactor unrelated code. If this is a false positive, say so and leave it unchanged; add or update a test when behavior changes.
Verify when done: /Users/marshallguillory/.local/share/maintainability-agent/venv/bin/python -m maintainability_audit --root . --format json

duplicated block in src/secure_code_audit/cli.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/cli.py.
Location: src/secure_code_audit/cli.py:163
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

src/secure_code_audit/cli.py is 1667 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: src/secure_code_audit/cli.py is 1667 lines.
Location: src/secure_code_audit/cli.py
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

near-duplicate declaration in src/secure_code_audit/scoring.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: near-duplicate declaration in src/secure_code_audit/scoring.py.
Location: src/secure_code_audit/scoring.py:842
Also at: src/secure_code_audit/scoring.py:858
Why: near-copies drift apart silently, which is worse than exact duplication; reconciling them requires deciding which behaviour was intended
Direction once decided: consolidate the two into one declaration, or say why they are deliberately separate; editing one alone leaves the other.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

src/secure_code_audit/scoring.py is 951 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: src/secure_code_audit/scoring.py is 951 lines.
Location: src/secure_code_audit/scoring.py
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/suppressions.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/suppressions.py.
Location: src/secure_code_audit/suppressions.py:365
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/bandit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/bandit_scanner.py.
Location: src/secure_code_audit/scanners/bandit_scanner.py:11
Also at: src/secure_code_audit/scanners/gosec_scanner.py:32, src/secure_code_audit/scanners/njsscan_scanner.py:26
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 3 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in src/secure_code_audit/scanners/npm_audit_scanner.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in src/secure_code_audit/scanners/npm_audit_scanner.py.
Location: src/secure_code_audit/scanners/npm_audit_scanner.py:101
Also at: src/secure_code_audit/scanners/osv_scanner.py:104
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

CHANGELOG.md is 1463 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: CHANGELOG.md is 1463 lines.
Location: CHANGELOG.md
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

docs/decisions.md is 2023 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: docs/decisions.md is 2023 lines.
Location: docs/decisions.md
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

docs/html/changelog.html is 1464 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: docs/html/changelog.html is 1464 lines.
Location: docs/html/changelog.html
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

docs/html/docs-decisions.html is 2108 lines

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: docs/html/docs-decisions.html is 2108 lines.
Location: docs/html/docs-decisions.html
Why: a file past the limit hides its own structure, but splitting one touches every importer and is a change worth reviewing on its own
Direction once decided: split below the configured file-length limit.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in README.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in README.md.
Location: README.md:252
Also at: docs/html/readme.html:302
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in README.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in README.md.
Location: README.md:112
Also at: docs/html/docs-remediation.html:35, docs/html/readme.html:144, docs/remediation.md:27
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 4 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in docs/design.md

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in docs/design.md.
Location: docs/design.md:36
Also at: docs/html/docs-design.html:62
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in docs/html/calibration-readme.html

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in docs/html/calibration-readme.html.
Location: docs/html/calibration-readme.html:144
Also at: docs/html/changelog.html:715, docs/html/docs-calibration.html:613, docs/html/docs-decisions.html:1257
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 4 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in docs/html/calibration-readme.html

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in docs/html/calibration-readme.html.
Location: docs/html/calibration-readme.html:110
Also at: docs/html/docs-calibration.html:495, docs/html/docs-decisions.html:463
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 3 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in docs/html/docs-calibration.html

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in docs/html/docs-calibration.html.
Location: docs/html/docs-calibration.html:307
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in docs/html/docs-design.html

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in docs/html/docs-design.html.
Location: docs/html/docs-design.html:208
Also at: docs/html/skills-secure-code-agent-references-finding-taxonomy.html:84
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in docs/html/docs-remediation.html

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in docs/html/docs-remediation.html.
Location: docs/html/docs-remediation.html:66
Also at: docs/remediation.md:58
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in docs/html/docs-scanners.html

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in docs/html/docs-scanners.html.
Location: docs/html/docs-scanners.html:174
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in docs/html/style.css

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in docs/html/style.css.
Location: docs/html/style.css:2
Also at: tools/render_docs.css:2
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 2 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/integration/test_gated_findings_are_reportable.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/integration/test_gated_findings_are_reportable.py.
Location: tests/integration/test_gated_findings_are_reportable.py:99
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/integration/test_target_shapes.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/integration/test_target_shapes.py.
Location: tests/integration/test_target_shapes.py:136
Also at: tests/unit/test_cli_coverage.py:226, tests/unit/test_declared_capabilities.py:220
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: extract the shared block so its 3 copies become one; editing one copy alone leaves the rest.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_calibrate.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_calibrate.py.
Location: tests/unit/test_calibrate.py:508
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_offline_ruleset.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_offline_ruleset.py.
Location: tests/unit/test_offline_ruleset.py:63
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_offline_ruleset.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_offline_ruleset.py.
Location: tests/unit/test_offline_ruleset.py:218
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_plan_features.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_plan_features.py.
Location: tests/unit/test_plan_features.py:37
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_sarif_roundtrip.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_sarif_roundtrip.py.
Location: tests/unit/test_sarif_roundtrip.py:255
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_sarif_roundtrip.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_sarif_roundtrip.py.
Location: tests/unit/test_sarif_roundtrip.py:135
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_standards_overlay.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_standards_overlay.py.
Location: tests/unit/test_standards_overlay.py:163
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_tier1_scanners.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_tier1_scanners.py.
Location: tests/unit/test_tier1_scanners.py:30
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

duplicated block in tests/unit/test_tier2_scanners.py

Repository: /Users/marshallguillory/repos/secure-code-agent
Design decision needed, not a patch: duplicated block in tests/unit/test_tier2_scanners.py.
Location: tests/unit/test_tier2_scanners.py:145
Why: duplicated logic means a fix applied in one place and missed in the others; deduplicating across a codebase is a design change, not a tidy-up
Direction once decided: remove the duplicated block.

Do not change code for this item, because it is a Major Project — the change it needs is a design decision before code moves, not one reviewable patch. Lay out the options for the surrounding design — what each would change, and where — then stop for a human decision. If this is a false positive, say so.

Security Work Order

Written by secure-code-agent 0.12.10 and reproduced as it wrote it. It is that tool's work order, not this one's: its findings are not re-ranked or merged into the maintainability work order above.

0 to fix · 0 to review · 1875 suppression candidates.

Semantic findings

TypeScript semantic coverage: unknown — no recorded type analysis and no local type checker: semantic coverage for TypeScript is unknown. Absence of analysis is not absence of findings.