{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:00.888995Z","repo":{"ref":{"host":"github.com","owner":"Leksat","name":"mp"},"default_branch":"main","clone_url":"https://github.com/Leksat/mp.git","html_url":"https://github.com/Leksat/mp","description":null,"stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":390,"primary_language":"TypeScript","license_spdx":null,"created_at":"2026-09-17T12:10:53Z","pushed_at":"2026-10-01T18:57:41Z","security_policy_url":null,"distribution":{"owner_created_at":"2011-08-18T15:48:27Z","owner_type":"User","release_assets":[]}},"commit_sha":"8ba0bf5718743686e6cda9b4cecf3783b6690b13","profile":{"lines_by_language":{"TypeScript":2713,"JavaScript":108},"files_by_category":{"source":49,"config":7,"binary":4,"other":3,"test":3,"docs":2,"generated":1},"source_lines":2283,"test_lines":538},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.51,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":1.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":2.409},"summary":"Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence)."},"quality":{"score":71.7,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":100.0,"duplication":95.2,"lint":80.3,"testing":56.8,"docs":20.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.24, no CI test run detected; 0% of function code in complex or long functions; 1% duplicated lines. Weakest area: docs."},"security":{"score":66.0,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":96.2,"dependencies":43.5,"ci_actions":29.5,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 21 known vulnerabilities in 10 dependencies; 6 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":14.0,"checked":14.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":43.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":3663.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-09":{"loc":3382,"attributed_loc":0},"2026-10":{"loc":281,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1790018380.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/Leksat/mp/blob/8ba0bf5718743686e6cda9b4cecf3783b6690b13/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1790018380}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":11.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":3663.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":199.1353001017294,"median_loc_per_hour":70.25,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":2283.0,"index":2.409,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":11.0,"per_kloc:emoji_in_code":4.818,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1.0,"findings_high":0.0,"findings_medium":1.0,"findings_low":0.0,"weighted_findings":0.25,"scanned_lines":2283.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/generate-icons.mjs","line":102,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/generate-icons.mjs:102"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":10.0,"vulnerabilities":21.0,"vulns_critical":1.0,"vulns_high":3.0,"vulns_medium":12.0,"vulns_low":5.0,"vulns_unknown":0.0,"penalty":50.0},"findings":[{"rule_id":"osv/GHSA-f2ph-cmg5-wxc8","severity":"critical","message":"storybook@10.6.0 (npm) is affected by GHSA-f2ph-cmg5-wxc8","path":"package-lock.json","line":null,"fingerprint":"storybook@10.6.0 (npm):GHSA-f2ph-cmg5-wxc8"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-px85-f4q5-jh77","severity":"high","message":"storybook@10.6.0 (npm) is affected by GHSA-px85-f4q5-jh77","path":"package-lock.json","line":null,"fingerprint":"storybook@10.6.0 (npm):GHSA-px85-f4q5-jh77"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@8.3.0 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@8.3.0 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@5.0.1 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@5.0.1 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-xp26-3454-mjgp","severity":"medium","message":"@vitest/mocker@5.0.1 (npm) is affected by GHSA-xp26-3454-mjgp","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@5.0.1 (npm):GHSA-xp26-3454-mjgp"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"package-lock.json","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.8 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-wjr9-j795-jxcr","severity":"medium","message":"fast-uri@3.1.8 (npm) is affected by GHSA-wjr9-j795-jxcr","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-wjr9-j795-jxcr"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@11.1.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@11.1.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@13.0.6 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@13.0.6 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@8.3.0 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@8.3.0 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@8.3.0 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@8.3.0 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@8.3.0 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@8.3.0 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-vfpm-58rq-9qcg","severity":"medium","message":"vite@8.3.0 (npm) is affected by GHSA-vfpm-58rq-9qcg","path":"package-lock.json","line":null,"fingerprint":"vite@8.3.0 (npm):GHSA-vfpm-58rq-9qcg"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.8 (npm) is affected by GHSA-333x-w4r6-6crp","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.8 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"package-lock.json","line":null,"fingerprint":"fast-uri@3.1.8 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-gfhx-hw2g-v5hg","severity":"low","message":"serialize-javascript@7.1.1 (npm) is affected by GHSA-gfhx-hw2g-v5hg","path":"package-lock.json","line":null,"fingerprint":"serialize-javascript@7.1.1 (npm):GHSA-gfhx-hw2g-v5hg"},{"rule_id":"osv/GHSA-m5mm-p8h7-m29v","severity":"low","message":"serialize-javascript@7.1.1 (npm) is affected by GHSA-m5mm-p8h7-m29v","path":"package-lock.json","line":null,"fingerprint":"serialize-javascript@7.1.1 (npm):GHSA-m5mm-p8h7-m29v"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@8.3.0 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@8.3.0 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":7.0,"findings_high":6.0,"findings_medium":1.0,"findings_low":0.0,"penalty":73.2},"findings":[{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/deploy.yml","line":16,"fingerprint":"excessive-permissions:.github/workflows/deploy.yml:16"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/deploy.yml","line":17,"fingerprint":"excessive-permissions:.github/workflows/deploy.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":28,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:28"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":34,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:34"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy.yml","line":46,"fingerprint":"unpinned-uses:.github/workflows/deploy.yml:46"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/deploy.yml","line":27,"fingerprint":"artipacked:.github/workflows/deploy.yml:27"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":1.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":232.0,"function_nloc":1140.0,"mean_ccn":1.47,"p90_ccn":3.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1471.0,"duplicated_lines":12.0,"duplicated_share":0.0082,"files":49.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/screens/CardScreen.stories.tsx:10 and src/screens/PreviewScreen.stories.tsx:11","ref":"src/screens/CardScreen.stories.tsx","url":"https://github.com/Leksat/mp/blob/8ba0bf5718743686e6cda9b4cecf3783b6690b13/src/screens/CardScreen.stories.tsx#L10","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"weighted_findings":2.0,"scanned_lines":2283.0,"category:best-practice":2.0},"findings":[{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"src/components/icons.tsx","line":14,"fingerprint":"typescript.react.best-practice.react-props-spreading:src/components/icons.tsx:14"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"src/useDrill.ts","line":39,"fingerprint":"typescript.react.best-practice.react-props-in-state:src/useDrill.ts:39"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.4713,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":538.0,"source_lines":2283.0,"test_ratio":0.2357,"ci_files":1.0,"cochange_share":0.2973,"cochange_commits":37.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/deploy.yml","ref":".github/workflows/deploy.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":0.5,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":3.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}