Maintainability Report

Generated 2026-09-18T23:57:11+00:00 · commit e54b1c9e6893801bf8df3667516dd308c67a11e1 · branch main · root /Users/marshallguillory/repos/maintainability-agent · standard ISO/IEC 25010 maintainability-inspired 0-5 scale, rate-based

Coverage

12 of 17 tools contributed — concerns all, depth heavy, license policy copyleft-any. Plus 8 built-in detectors.

declarations measured by analyzers, completed by built-in detectors: no analyzer supplies cognitive_complexity for C, C#, C++, Fortran, Go, Java, JavaScript, PHP, Ruby, Rust, Swift, TypeScript, so the built-in scanner supplied it for those declarations and the analyzers supplied the rest; the criterion set is complete per declaration, which is what makes the rate comparable to the rubric's.

Nothing examined: testing.

These concerns are unmeasured, not clean. Install a tool that covers them, or widen analyzers.depth, to have them reported.

Analyzer children are not network-isolated. 12 external tools ran as local child processes. This agent does not transmit the audited source and opens no socket of its own, but it does not sandbox what it spawns: a third-party analyzer that reaches the network is outside what this run controls or observes. Determinism and no upload are the promise; a kernel air-gap is not.

Recorded scans

Estimate over recorded scans

Pillars over time (condition)

Practice level over time (maturity — a separate series)

Categories, this scan

Trend

60 separate series; scans either side of a break were produced by different instruments and are reported apart. The current series is given in full, the earlier ones summarized.

This series begins at a break: the tool version changed, so scans before this point were produced by a different instrument and cannot be joined to those after it.

Current series — 2 scans, 2026-09-18T23:36:36Z to 2026-09-19T00:06:18Z.

• Direction: indistinguishable. Change +0.00.
• Debt velocity: 0 introduced, 0 cleared.
• Growth: neither grew nor got worse.
• Never cleared in this window: 0 findings.

Earlier series (59 series)

Every figure describes scans that happened; nothing forecasts.

Economic Context (scenario)

0 – 0 USD over 12 months (base 0 USD), across 0 work-order item(s).

This is a scenario, not a prediction.

Assumptions:

• each bound = affected changes/year × incremental hours/change × loaded labor rate × horizon/12
• no usable history; assumed one change per work-order item per year
• incremental hours/change of 0.25-2.0 (base 1.0) — a stated default unless configured
• loaded labor rate 130.0-275.0 USD/hour (base 165.0), as configured
• planning horizon of 12 months
• a scenario computed from these assumptions; change them and the range moves with them

TDD-shaped tests

TDD-shaped tests: detected beside 128 of 154 production source files (path pairing). Constructs: pytest in 255 file(s), unittest in 1 file(s), describe_it in 16 file(s), parametrize in 89 file(s), given_when_then in 2 file(s).

Chronology is not measured. Effectiveness is unscored unless the operator opted into suite execution.

Test Suite

The operator opted in to running the repository's test command; it failed (exit 1).

Command: pytest -q

Coverage: no coverage reported by the run

Pillars

Practice level 4 of 5 — CI holds a numeric quality gate.

Not measured here, and why:

• efficiency — requires profiling, load testing and runtime telemetry, none of which a static pass produces; permanently out of scope rather than temporarily unmeasured

Enforcement found: linter-config, recorded-decisions, lint-in-ci, types-in-ci, duplication-in-ci, coverage-gate.

ISO/IEC 25010 Maintainability Score

Aspect Scores

Not Scored — no measurement exists

Largest Files

Function Hotspots

Security Work Order

Written by secure-code-agent 0.12.7 and reproduced as it wrote it. It is that tool's work order, not this one's: its findings are not re-ranked or merged into the maintainability work order above.

# Security work order

**68 to fix · 0 to review · 5187 suppression candidates.**

Work the tiers in order. Everything in §FIX is a defect the scanner is confident about; everything in §REVIEW needs your judgement before you touch it, and the reason is stated per finding. This is a constrained task, not a refactor.

## Hard constraints — MUST NOT violate

1. Fix only the findings listed. Touch nothing else.
2. Do not change crypto algorithms, key derivation, IV/nonce, padding or random sources unless a finding names them.
3. Do not change auth flows, sessions, token lifetime, cookie attributes or authorization gates unless a finding names them.
4. Do not weaken validation, encoding, sanitization, bounds checks, regex strictness or rate limits to make tests pass.
5. Do not disable, delete or skip security tests, or remove `@require_auth`-style decorators.
6. Do not silence warnings: no `# nosec`, `# noqa`, `# type: ignore`, `eslint-disable` or equivalent.
7. Do not add dependencies. If one is genuinely required, stop and ask.
8. Preserve behaviour. If a finding proves current behaviour unsafe, name the input → old/new output.
9. Add one focused test per fix that FAILS before and PASSES after. No "TODO: add test later".
10. Keep the patch small. If you are rewriting a function rather than patching it, stop and report why.

## Protocol

Per finding: quote the lines you will change, state the minimum change and
the test you will add, apply it, then confirm the test fails on the pre-fix
code and passes after. Do not re-run this tool; CI will.

Report per finding: id · files changed (`file:line`) · test added · behaviour
change (yes/no, with input → old/new) · standards satisfied.

A false positive is a successful outcome: do not patch it. Emit a
`.scignore.yaml` suppression candidate with the justification and a proposed
`expires` date (90 days maximum) for the operator to review.

## §FIX — patch these

### 1. `B314` — Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerab

`src/maintainability_audit/_xml.py:70`

```
69             )
70     return ElementTree.fromstring(payload)  # noqa: S314 - declarations refused above
```

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
[CWE-20](https://cwe.mitre.org/data/definitions/20.html) (Top 25) · medium/high via `bandit`

### 2. `B310` — Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often un

`tools/sonar_resolve.py:56`

```
55     request.add_header("Authorization", f"Basic {basic}")
56     with urllib.request.urlopen(request, timeout=30) as response:  # noqa: S310 - fixed host
57         body = response.read().decode()
```

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
[CWE-22](https://cwe.mitre.org/data/definitions/22.html) (Top 25) · A01:2021-Broken Access Control · medium/high via `bandit`

### 3. `B310` — Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often un

`tools/sonar_resolve.py:109`

```
108     request.add_header("Authorization", f"Basic {basic}")
109     with urllib.request.urlopen(request, timeout=30) as response:  # noqa: S310 - fixed host
110         found = json.loads(response.read().decode()).get("issues") or []
```

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
[CWE-22](https://cwe.mitre.org/data/definitions/22.html) (Top 25) · A01:2021-Broken Access Control · medium/high via `bandit`

### 4. `B404` — Consider possible security implications associated with the subprocess module.

`src/maintainability_audit/_backfill.py:29`

```
28 
29 import subprocess
30 from pathlib import Path
```

Consider possible security implications associated with the subprocess module.
[CWE-78](https://cwe.mitre.org/data/definitions/78.html) (Top 25) · A03:2021-Injection · low/high via `bandit`

### 5. `B607` — Starting a process with a partial executable path

`src/maintainability_audit/_backfill.py:51-69`

```
50     try:
51         result = subprocess.run(  # noqa: S603 - argv list, never a shell
52             # D71: this spawn is not `run_git`, and the sweep that was
… 18 more line(s) — open the file
```

Starting a process with a partial executable path
[CWE-78](https://cwe.mitre.org/data/definitions/78.html) (Top 25) · A03:2021-Injection · low/high via `bandit`

### 6. `B603` — subprocess call - check for execution of untrusted input.

`src/maintainability_audit/_backfill.py:51-69`

```
50     try:
51         result = subprocess.run(  # noqa: S603 - argv list, never a shell
52             # D71: this spawn is not `run_git`, and the sweep that was
… 18 more line(s) — open the file
```

subprocess call - check for execution of untrusted input.
[CWE-78](https://cwe.mitre.org/data/definitions/78.html) (Top 25) · A03:2021-Injection · low/high via `bandit`

### 7. `B405` — Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Re

`src/maintainability_audit/_jvm_adapters.py:21`

```
20 from typing import Any
21 from xml.etree import ElementTree
22
```

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
[CWE-20](https://cwe.mitre.org/data/definitions/20.html) (Top 25) · low/high via `bandit`

### 8. `B404` — Consider possible security implications associated with the subprocess module.

`src/maintainability_audit/_runner.py:33`

```
32 import shutil
33 import subprocess
34 import sys
```

Consider possible security implications associated with the subprocess module.
[CWE-78](https://cwe.mitre.org/data/definitions/78.html) (Top 25) · A03:2021-Injection · low/high via `bandit`

### 9. `B603` — subprocess call - check for execution of untrusted input.

`src/maintainability_audit/_runner.py:243-248`

```
242     try:
243         completed = subprocess.run(  # noqa: S603 - argv list, never a shell
244             [npm, "config", "get", "registry"],
… 5 more line(s) — open the file
```

subprocess call - check for execution of untrusted input.
[CWE-78](https://cwe.mitre.org/data/definitions/78.html) (Top 25) · A03:2021-Injection · low/high via `bandit`

### 10. `B603` — subprocess call - check for execution of untrusted input.

`src/maintainability_audit/_runner.py:370-378`

```
369     try:
370         completed = subprocess.run(  # noqa: S603 - argv is built by adapters, never a shell string
371             argv,
… 8 more line(s) — open the file
```

subprocess call - check for execution of untrusted input.
[CWE-78](https://cwe.mitre.org/data/definitions/78.html) (Top 25) · A03:2021-Injection · low/high via `bandit`

### 11. `B405` — Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Re

`src/maintainability_audit/_xml.py:30`

```
29 from typing import Any
30 from xml.etree import ElementTree
31
```

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
[CWE-20](https://cwe.mitre.org/data/definitions/20.html) (Top 25) · low/high via `bandit`

### 12. `B404` — Consider possible security implications associated with the subprocess module.

`src/maintainability_audit/git_tools.py:21`

```
20 import re
21 import subprocess
22 from pathlib import Path
```

Consider possible security implications associated with the subprocess module.
[CWE-78](https://cwe.mitre.org/data/definitions/78.html) (Top 25) · A03:2021-Injection · low/high via `bandit`

> **56 more in §FIX.** Fix this batch, re-run, and the next order carries the rest. All of them are in the JSON report.

## §ACCEPT — test tree and documentation

Findings outside the shipped source. A credential in a test fixture
or a tutorial is usually deliberate, and these do not grade the code
condition — but they are reported, because one of them may be a real
key committed to the wrong place.

**Do not patch these.** Decide per group: a genuine secret to rotate
and remove, or a fixture to record in `.scignore.yaml` with a reason
and an expiry. Propose, do not apply.

Grouped by rule, because the decision is per rule and not per line.

| rule | count | worst | example |
| --- | ---: | --- | --- |
| `B108` | 9 | medium | `tests/test_analyzer_config_isolation.py:139` |
| `B101` | 4678 | low | `tests/_ast_reading.py:94` |
| `B603` | 215 | low | `tests/_analyzer_fixtures.py:30` |
| `B607` | 185 | low | `tests/_analyzer_fixtures.py:30` |
| `B404` | 98 | low | `tests/_analyzer_fixtures.py:27` |
| `B405` | 1 | low | `tests/test_analyzer_xml_bounds.py:112` |
| `B105` | 1 | low | `tests/test_root_grants.py:263` |

A suppression covering one of these groups looks like:

```yaml
- rule_id: B108
  paths: ["*/tests/*"]
  reason: "state why this is deliberate, and what you checked"
  expires: "YYYY-MM-DD"
```

---

End of findings. Apply the patch protocol above per finding. Report each one in the summary block format.

Semantic findings

TypeScript semantic coverage: unknown — no recorded type analysis and no local type checker: semantic coverage for TypeScript is unknown. Absence of analysis is not absence of findings.