{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:02.992768Z","repo":{"ref":{"host":"github.com","owner":"bendc","name":"sprint"},"default_branch":"master","clone_url":"https://github.com/bendc/sprint.git","html_url":"https://github.com/bendc/sprint","description":"A tiny, lightning fast jQuery-like library for modern browsers.","stars":4177,"forks":159,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":787,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2014-08-27T09:26:21Z","pushed_at":"2016-12-21T04:18:43Z","security_policy_url":null,"distribution":{"owner_created_at":"2009-02-04T09:34:28Z","owner_type":"User","release_assets":[]}},"commit_sha":"a220796dc6470cc928726a3f15192ca5389af36c","profile":{"lines_by_language":{"JavaScript":1407},"files_by_category":{"docs":2,"config":1,"source":1,"vendored":1},"source_lines":1407,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":59.4,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":69.9,"duplication":100.0,"lint":100.0,"testing":0.0,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 12% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing."},"security":{"score":66.2,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":57.1,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 2 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":151.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":3607.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2014-08":{"loc":560,"attributed_loc":0},"2014-09":{"loc":248,"attributed_loc":0},"2014-10":{"loc":700,"attributed_loc":0},"2014-11":{"loc":831,"attributed_loc":0},"2014-12":{"loc":759,"attributed_loc":0},"2015-01":{"loc":509,"attributed_loc":0},"2015-04":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":0.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":0.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":0.0,"median_loc_per_hour":0.0,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":1407.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":5.0,"findings_high":2.0,"findings_medium":3.0,"findings_low":0.0,"weighted_findings":2.25,"scanned_lines":1407.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"sprint.js","line":920,"fingerprint":"javascript.browser.security.insecure-document-method:sprint.js:920"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"sprint.js","line":920,"fingerprint":"javascript.browser.security.insecure-innerhtml:sprint.js:920"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"sprint.js","line":184,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:sprint.js:184"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"sprint.js","line":479,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:sprint.js:479"},{"rule_id":"opengrep/javascript.jquery.security.audit.prohibit-jquery-html","severity":"medium","message":"JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]","path":"sprint.js","line":916,"fingerprint":"javascript.jquery.security.audit.prohibit-jquery-html:sprint.js:916"}],"evidence":[],"data":{"rulesets":["javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":173.0,"function_nloc":1422.0,"mean_ccn":2.62,"p90_ccn":6.0,"complex_functions":1.0,"long_functions":1.0,"many_param_functions":0.0,"risky_nloc_share":0.1195},"findings":[],"evidence":[{"kind":"complex-function","description":"sanitize in sprint.js: complexity 18, 29 lines","ref":"sprint.js","url":"https://github.com/bendc/sprint/blob/a220796dc6470cc928726a3f15192ca5389af36c/sprint.js#L400","weight":0.3},{"kind":"complex-function","description":"(anonymous) in sprint.js: complexity 2, 141 lines","ref":"sprint.js","url":"https://github.com/bendc/sprint/blob/a220796dc6470cc928726a3f15192ca5389af36c/sprint.js#L12","weight":0.03333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1003.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":1.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":1407.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":1407.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":142.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":114.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE.txt","ref":"LICENSE.txt","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}