{
  "note": "Aggregate distributions from a read-only static sweep. Per-repo findings are withheld for coordinated disclosure and never published. Heuristic, precision-over-recall: treat prevalence as a lower bound.",
  "servers_scanned": 2408,
  "latest_scan": "2026-09-05 21:06:22",
  "tier_counts": {
    "Elevated": 835,
    "High": 67,
    "Low": 1506
  },
  "score_histogram": [
    {
      "bucket": "0-9",
      "repos": 1506
    },
    {
      "bucket": "10-19",
      "repos": 12
    },
    {
      "bucket": "20-29",
      "repos": 758
    },
    {
      "bucket": "30-39",
      "repos": 69
    },
    {
      "bucket": "40-49",
      "repos": 2
    },
    {
      "bucket": "50-59",
      "repos": 52
    },
    {
      "bucket": "60-69",
      "repos": 6
    },
    {
      "bucket": "70-79",
      "repos": 1
    },
    {
      "bucket": "80-89",
      "repos": 1
    },
    {
      "bucket": "90-99",
      "repos": 1
    }
  ],
  "category_prevalence": [
    {
      "category": "ssrf_surface",
      "repos_affected": 818,
      "pct_of_scanned": 34.0
    },
    {
      "category": "code_execution",
      "repos_affected": 86,
      "pct_of_scanned": 3.6
    },
    {
      "category": "command_injection",
      "repos_affected": 48,
      "pct_of_scanned": 2.0
    },
    {
      "category": "unsafe_deserialization",
      "repos_affected": 12,
      "pct_of_scanned": 0.5
    },
    {
      "category": "hardcoded_secret",
      "repos_affected": 12,
      "pct_of_scanned": 0.5
    }
  ]
}