Leaderboard github.com

Chalarangelo/30-seconds-of-code

Coding articles to level up your development skills

View repository ↗
JavaScript
★ 129,507
commit bd756f8b2283
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

possible

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

75/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

53/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% possible

Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts5%
Estimated AI-generated share0%
AI tool configuration files1
Work sessions at AI pace3
Releases at AI pace0
Coding-style index (1.0+ means possible)0.69

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
GitHub Copilot coding agent	1	0	2025-05-21	2025-05-21

Lines added per month all AI-attributed share

2017-1143 · 0% AI
2017-121,939 · 0% AI
2018-0110,283 · 0% AI
2018-0215,188 · 0% AI
2018-031,341 · 0% AI
2018-04655 · 0% AI
2018-05215 · 0% AI
2018-069,855 · 0% AI
2018-07374 · 0% AI
2018-083,392 · 0% AI
2018-09861 · 0% AI
2018-104,836 · 0% AI
2018-114,311 · 0% AI
2018-125,615 · 0% AI
2019-014,878 · 0% AI
2019-02838 · 0% AI
2019-03210 · 0% AI
2019-0421 · 0% AI
2019-053,321 · 0% AI
2019-06221 · 0% AI
2019-07119 · 0% AI
2019-0811,291 · 0% AI
2019-091,623 · 0% AI
2019-105,606 · 0% AI
2019-115,721 · 0% AI
2019-12911 · 0% AI
2020-011,498 · 0% AI
2020-022,158 · 0% AI
2020-032,237 · 0% AI
2020-044,241 · 0% AI
2020-05770 · 0% AI
2020-061,518 · 0% AI
2020-071,316 · 0% AI
2020-082,006 · 0% AI
2020-092,131 · 0% AI
2020-10185 · 0% AI
2020-11633 · 0% AI
2020-127,733 · 0% AI
2021-012,149 · 0% AI
2021-021,312 · 0% AI
2021-03593 · 0% AI
2021-041,143 · 0% AI
2021-051,122 · 0% AI
2021-06643 · 0% AI
2021-07142 · 0% AI
2021-08277 · 0% AI
2021-09604 · 0% AI
2021-100 · 0% AI
2021-111 · 0% AI
2021-120 · 0% AI
2022-017,887 · 0% AI
2022-021,120 · 0% AI
2022-03452 · 0% AI
2022-040 · 0% AI
2022-0548 · 0% AI
2022-060 · 0% AI
2022-070 · 0% AI
2022-080 · 0% AI
2022-0980 · 0% AI
2022-1019 · 0% AI
2022-1172 · 0% AI
2022-12148 · 0% AI
2023-0188 · 0% AI
2023-02975 · 0% AI
2023-03759 · 0% AI
2023-04547 · 0% AI
2023-051,172 · 0% AI
2023-06303 · 0% AI
2023-08424 · 0% AI
2023-09370 · 0% AI
2023-102,173 · 0% AI
2023-11410 · 0% AI
2023-12575 · 0% AI
2024-014 · 0% AI
2024-020 · 0% AI
2024-030 · 0% AI
2024-0464 · 0% AI
2024-0553 · 0% AI
2024-063,075 · 0% AI
2024-073,136 · 0% AI
2024-083,873 · 0% AI
2024-0912 · 0% AI
2024-100 · 0% AI
2024-1274 · 0% AI
2025-0170 · 0% AI
2025-020 · 0% AI
2025-034,153 · 0% AI
2025-042,334 · 0% AI
2025-05184 · 0% AI
2025-0614 · 0% AI
2025-072 · 0% AI
2025-080 · 0% AI
2025-090 · 0% AI
2025-100 · 0% AI
2025-110 · 0% AI
2025-120 · 0% AI
2026-010 · 0% AI
2026-020 · 0% AI
2026-030 · 0% AI
2026-040 · 0% AI
2026-060 · 0% AI
2026-070 · 0% AI
2026-080 · 0% AI
2026-090 · 0% AI

Findings in AI-attributed lines vs the rest

From git blame: 0 lines trace to AI-attributed commits, 7,911 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	—	0.25	—
Security	—	4.55	—

Evidence by analyzer

Explicit AI attributionok2 items

GitHub Copilot coding agent: 1 attributed commits, 0 lines added
GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'

attributed_commit_share: 0.0%
attributed_commits: 1
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 10,213
effective_loc: 162,750
tools_detected: 1

AI tool configurationok1 item

.github/copilot-instructions.md (github-copilot configuration)

artifacts: 1
earliest_adoption: 2025-06-07
tools_configured: 1
workflow_agents: 0

Commit velocityok3 items

excluded_import_loc: 3,291
flagged_loc: 8,481
flagged_loc_share: 5.3%
flagged_units: 3
max_loc_per_hour: 2,242.55
measured_loc: 159,459
median_loc_per_hour: 68.06
pr_timed_units: 0
pre_ai_era_burst_loc: 33,151
pre_ai_era_bursts: 8
pre_ai_era_measured_loc: 123,765
work_units: 1,341

Release velocityok

flagged_releases: 0
max_loc_per_day: 431.90
releases: 4

Coding styleok4 items

count:assistant_voice: 0
count:emoji_in_code: 3
count:narrated_steps: 4
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 1
files:narrated_steps: 1
files:placeholder: 0
index: 0.69
lines_scanned: 7,911
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.38
per_kloc:narrated_steps: 0.51
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 0
blame_failures: 0
files_blamed: 87
other_lines: 7,911
quality:ai_findings: 0
quality:other_findings: 2
quality:other_per_kloc: 0.25
security:ai_findings: 0
security:other_findings: 36
security:other_per_kloc: 4.55

Code quality

75 adequate

Code quality is adequate: test-to-source ratio 0.23, CI runs tests; 4% of function code in complex or long functions; 0% duplicated lines. Weakest area: process.

How the score is built

Complexity89
Duplication97
Lint and smells98
Tests and CI70
Documentation80
Type safety40
Review process5

Evidence by analyzer

Complexity (lizard)ok3 items

complex_functions: 3
function_nloc: 3,258
functions: 512
long_functions: 0
many_param_functions: 0
mean_ccn: 1.84
p90_ccn: 3
risky_nloc_share: 3.8%

Duplication (jscpd)ok1 item

6+ duplicated lines: src/models/collection.js:10 and src/models/snippet.js:13

compared_lines: 5,957
duplicated_lines: 30
duplicated_share: 0.5%
files: 87

Lintok

category:correctness: 2
findings: 2
scanned_lines: 7,911
weighted_findings: 0.50

Tests and CIok5 items

CI config: .github/workflows/deploy-production.yml .github/workflows/deploy-production.yml
CI config: .github/workflows/label.yml .github/workflows/label.yml
CI config: .github/workflows/stale.yml .github/workflows/stale.yml
CI config: .github/workflows/test.yml .github/workflows/test.yml
CI runs tests (npm test)

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: no
ci_files: 4
cochange_commits: 64
cochange_share: 7.8%
source_lines: 7,911
test_lines: 1,823
test_ratio: 0.23

Documentationok3 items

README.md README.md
LICENSE LICENSE
CONTRIBUTING.md CONTRIBUTING.md

check:changelog: no
check:contributing: yes
check:license: yes
check:readme: yes
readme_lines: 17

Type safetyok

check:low_escape_density: yes
check:strict_config: no
escapes: 0
escapes_per_kloc: 0

Security

53 weak

Security posture is weak: 58 known vulnerabilities in 22 dependencies; 8 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: dependencies.

How the score is built

Secrets97
Static analysis (SAST)56
Vulnerable dependencies9
CI workflows34
Security posture60
OpenSSF Scorecard52

Evidence by analyzer

OpenSSF Scorecardok11 items

aggregate: 4.80
check:Binary-Artifacts: yes
check:CII-Best-Practices: no
check:Code-Review: no
check:Dangerous-Workflow: yes
check:Fuzzing: no
check:License: yes
check:Maintained: yes
check:Pinned-Dependencies: yes
check:SAST: yes
check:Security-Policy: yes
check:Token-Permissions: no

Package registriesok

checked: 24
declared: 24
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 1

Static analysis (opengrep)ok

findings: 36
findings_high: 8
findings_low: 0
findings_medium: 28
parse_errors: 19
scanned_lines: 7,911
weighted_findings: 13

Dependencies (osv-scanner)ok

penalty: 146
vulnerabilities: 58
vulnerable_packages: 22
vulns_critical: 3
vulns_high: 25
vulns_low: 6
vulns_medium: 24
vulns_unknown: 0

CI workflows (zizmor)ok

findings: 8
findings_high: 5
findings_low: 0
findings_medium: 3
penalty: 64.80
workflows: 4

Security postureok1 item

Security policy: SECURITY.md SECURITY.md

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: yes
check:signed_commits: yes
signed_commit_share: 86.5%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

3 critical38 high55 medium9 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-26w7-cxv4-gfx2`	package-lock.json	[email protected] (npm) is affected by GHSA-26w7-cxv4-gfx2	Dependencies (osv-scanner)
critical	`osv/GHSA-5gmw-xhrv-c9v3`	package-lock.json	[email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3	Dependencies (osv-scanner)
critical	`osv/GHSA-85c8-ppgw-ccpr`	package-lock.json	[email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr	Dependencies (osv-scanner)
high	`zizmor/unpinned-uses`	.github/workflows/deploy-production.yml:10	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/label.yml:20	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/stale.yml:21	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:17	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:19	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/javascript.browser.security.insecure-document-method`	content/components/scripts/latex-expression.mjs:23	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	content/components/scripts/latex-expression.mjs:23	User controlled data in a `figure.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`osv/GHSA-2883-xcg3-v3hh`	package-lock.json	[email protected] (npm) is affected by GHSA-2883-xcg3-v3hh	Dependencies (osv-scanner)
high	`osv/GHSA-2883-xcg3-v3hh`	package-lock.json	[email protected] (npm) is affected by GHSA-2883-xcg3-v3hh	Dependencies (osv-scanner)
high	`osv/GHSA-2v37-7h3g-55p8`	package-lock.json	[email protected] (npm) is affected by GHSA-2v37-7h3g-55p8	Dependencies (osv-scanner)
high	`osv/GHSA-52cp-r559-cp3m`	package-lock.json	[email protected] (npm) is affected by GHSA-52cp-r559-cp3m	Dependencies (osv-scanner)
high	`osv/GHSA-587h-7wmj-h5pm`	package-lock.json	[email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	Dependencies (osv-scanner)
high	`osv/GHSA-5p4m-2wfm-xmqj`	package-lock.json	[email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj	Dependencies (osv-scanner)
high	`osv/GHSA-68fv-2mgg-jv7q`	package-lock.json	[email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	package-lock.json	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	package-lock.json	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	Dependencies (osv-scanner)
high	`osv/GHSA-7w5x-hrqm-74c2`	package-lock.json	[email protected] (npm) is affected by GHSA-7w5x-hrqm-74c2	Dependencies (osv-scanner)
high	`osv/GHSA-f88m-g3jw-g9cj`	package-lock.json	[email protected] (npm) is affected by GHSA-f88m-g3jw-g9cj	Dependencies (osv-scanner)
high	`osv/GHSA-j22f-vq7h-c4qm`	package-lock.json	[email protected] (npm) is affected by GHSA-j22f-vq7h-c4qm	Dependencies (osv-scanner)
high	`osv/GHSA-mcm9-63f2-9j32`	package-lock.json	[email protected] (npm) is affected by GHSA-mcm9-63f2-9j32	Dependencies (osv-scanner)
high	`osv/GHSA-mh99-v99m-4gvg`	package-lock.json	[email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	Dependencies (osv-scanner)
high	`osv/GHSA-mh99-v99m-4gvg`	package-lock.json	[email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	Dependencies (osv-scanner)
high	`osv/GHSA-mrhx-c7xc-m3w5`	package-lock.json	[email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	package-lock.json	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	package-lock.json	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	Dependencies (osv-scanner)
high	`osv/GHSA-r9w8-h9r3-54w4`	package-lock.json	[email protected] (npm) is affected by GHSA-r9w8-h9r3-54w4	Dependencies (osv-scanner)
high	`osv/GHSA-rgj7-g3m4-5g8c`	package-lock.json	[email protected] (npm) is affected by GHSA-rgj7-g3m4-5g8c	Dependencies (osv-scanner)
high	`osv/GHSA-rgw5-rvv9-x895`	package-lock.json	[email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	Dependencies (osv-scanner)
high	`osv/GHSA-rgw5-rvv9-x895`	package-lock.json	[email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	Dependencies (osv-scanner)
high	`osv/GHSA-w27v-7q3p-w38r`	package-lock.json	[email protected] (npm) is affected by GHSA-w27v-7q3p-w38r	Dependencies (osv-scanner)
high	`osv/GHSA-wq5f-xc86-pv6w`	package-lock.json	[email protected] (npm) is affected by GHSA-wq5f-xc86-pv6w	Dependencies (osv-scanner)
high	`osv/GHSA-x5rw-q4pp-hg5g`	package-lock.json	[email protected] (npm) is affected by GHSA-x5rw-q4pp-hg5g	Dependencies (osv-scanner)
high	`opengrep/javascript.browser.security.insecure-document-method`	src/astro/scripts/omnisearch.js:78	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	src/astro/scripts/omnisearch.js:78	User controlled data in a `this.resultsSection.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	src/astro/scripts/omnisearch.js:83	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	src/astro/scripts/omnisearch.js:83	User controlled data in a `this.resultsSection.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	src/astro/scripts/omnisearch.js:86	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	src/astro/scripts/omnisearch.js:86	User controlled data in a `this.resultsSection.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`zizmor/artipacked`	.github/workflows/deploy-production.yml:10	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/deploy-production.yml:7	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/test.yml:17	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`osv/GHSA-2g4f-4pwh-qvx6`	package-lock.json	[email protected] (npm) is affected by GHSA-2g4f-4pwh-qvx6	Dependencies (osv-scanner)
medium	`osv/GHSA-376h-93r7-7g6f`	package-lock.json	[email protected] (npm) is affected by GHSA-376h-93r7-7g6f	Dependencies (osv-scanner)
medium	`osv/GHSA-3g3m-2fjr-6pw4`	package-lock.json	[email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4	Dependencies (osv-scanner)
medium	`osv/GHSA-4g3v-8h47-v7g6`	package-lock.json	[email protected] (npm) is affected by GHSA-4g3v-8h47-v7g6	Dependencies (osv-scanner)
medium	`osv/GHSA-4q55-j62x-fr9h`	package-lock.json	[email protected] (npm) is affected by GHSA-4q55-j62x-fr9h	Dependencies (osv-scanner)
medium	`osv/GHSA-4vpr-x523-8j87`	package-lock.json	[email protected] (npm) is affected by GHSA-4vpr-x523-8j87	Dependencies (osv-scanner)
medium	`osv/GHSA-698v-4r3x-3vcv`	package-lock.json	[email protected] (npm) is affected by GHSA-698v-4r3x-3vcv	Dependencies (osv-scanner)
medium	`osv/GHSA-82fw-gwwq-j7x9`	package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9	Dependencies (osv-scanner)
medium	`osv/GHSA-82fw-gwwq-j7x9`	package-lock.json	[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9	Dependencies (osv-scanner)
medium	`osv/GHSA-98hj-9722-w3j8`	package-lock.json	[email protected] (npm) is affected by GHSA-98hj-9722-w3j8	Dependencies (osv-scanner)
medium	`osv/GHSA-9rgm-9g3h-6x36`	package-lock.json	[email protected] (npm) is affected by GHSA-9rgm-9g3h-6x36	Dependencies (osv-scanner)
medium	`osv/GHSA-f48w-9m4c-m7f5`	package-lock.json	[email protected] (npm) is affected by GHSA-f48w-9m4c-m7f5	Dependencies (osv-scanner)
medium	`osv/GHSA-g3hv-75wg-m249`	package-lock.json	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249	Dependencies (osv-scanner)
medium	`osv/GHSA-h67p-54hq-rp68`	package-lock.json	[email protected] (npm) is affected by GHSA-h67p-54hq-rp68	Dependencies (osv-scanner)
medium	`osv/GHSA-hx4r-w6wj-j8fg`	package-lock.json	[email protected] (npm) is affected by GHSA-hx4r-w6wj-j8fg	Dependencies (osv-scanner)
medium	`osv/GHSA-mh29-5h37-fv8m`	package-lock.json	[email protected] (npm) is affected by GHSA-mh29-5h37-fv8m	Dependencies (osv-scanner)
medium	`osv/GHSA-p498-v437-472g`	package-lock.json	@humanfs/[email protected] (npm) is affected by GHSA-p498-v437-472g	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	package-lock.json	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	package-lock.json	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr	Dependencies (osv-scanner)
medium	`osv/GHSA-qxg6-89mg-rqv8`	package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8	Dependencies (osv-scanner)
medium	`osv/GHSA-r3h5-4585-7x3w`	package-lock.json	[email protected] (npm) is affected by GHSA-r3h5-4585-7x3w	Dependencies (osv-scanner)
medium	`osv/GHSA-r4xh-jqrq-34v2`	package-lock.json	[email protected] (npm) is affected by GHSA-r4xh-jqrq-34v2	Dependencies (osv-scanner)
medium	`osv/GHSA-r825-w8mm-5pxw`	package-lock.json	[email protected] (npm) is affected by GHSA-r825-w8mm-5pxw	Dependencies (osv-scanner)
medium	`osv/GHSA-rq7h-c2jc-7f22`	package-lock.json	[email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/astro/scripts/omnisearch.js:114	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/astro/scripts/omnisearch.js:89	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/astro/scripts/omnisearch.js:95	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	src/core/recordSet.js:7	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	src/lib/contentUtils/contentCreator.js:51	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	src/lib/contentUtils/fileHandler.js:26	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	src/lib/contentUtils/fileHandler.js:47	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/lib/contentUtils/markdownParser/codeHighlighters/utils/metaParser.js:149	RegExp() called with a `str` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/lib/contentUtils/markdownParser/codeHighlighters/utils/metaParser.js:203	RegExp() called with a `openingBracket` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/lib/contentUtils/markdownParser/codeHighlighters/utils/metaParser.js:59	RegExp() called with a `openingBracket` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/contentUtils/markdownParser/markdownParser.js:115	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/contentUtils/markdownParser/plugins/ast/embedCodepensFromLinks.js:50	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/contentUtils/markdownParser/plugins/ast/highlightCode.js:97	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/contentUtils/markdownParser/plugins/ast/transformArticleEmbeds.js:45	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.raw-html-join`	src/lib/contentUtils/markdownParser/plugins/hast/loadWebComponents.js:22	User controlled data in a HTML string may result in XSS [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/contentUtils/markdownParser/plugins/hast/loadWebComponents.js:23	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/lib/contentUtils/markdownParser/plugins/hast/transformAdmonitions.js:37	RegExp() called with a `types` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/contentUtils/tocReader.js:19	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/contentUtils/tocReader.js:49	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/contentUtils/tocReader.js:51	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/contentUtils/tocReader.js:56	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/feed.js:43	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	src/lib/preparedQueries.js:62	Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/lib/search/documentSearch.js:75	RegExp() called with a `term` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	src/lib/search/server.js:75	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.incomplete-sanitization`	src/lib/search/utils.js:14	`tkn.replace(/^['-]+\|['-]+$/g, '').replace` method will only replace the first occurrence when used with a string argument ("'"). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/lib/sitemap.js:36	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/models/contentModel.js:152	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/lib/contentUtils/componentCreator.js:24	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/lib/contentUtils/componentCreator.js:24	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`osv/GHSA-7pw4-f3q4-r2p2`	package-lock.json	[email protected] (npm) is affected by GHSA-7pw4-f3q4-r2p2	Dependencies (osv-scanner)
low	`osv/GHSA-9jrq-w75r-8gcw`	package-lock.json	[email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw	Dependencies (osv-scanner)
low	`osv/GHSA-g7r4-m6w7-qqqr`	package-lock.json	[email protected] (npm) is affected by GHSA-g7r4-m6w7-qqqr	Dependencies (osv-scanner)
low	`osv/GHSA-mh32-jxcr-mh9f`	package-lock.json	[email protected] (npm) is affected by GHSA-mh32-jxcr-mh9f	Dependencies (osv-scanner)
low	`osv/GHSA-wf3x-273g-mvxv`	package-lock.json	[email protected] (npm) is affected by GHSA-wf3x-273g-mvxv	Dependencies (osv-scanner)
low	`osv/GHSA-xffm-g5w8-qvg7`	package-lock.json	@eslint/[email protected] (npm) is affected by GHSA-xffm-g5w8-qvg7	Dependencies (osv-scanner)
low	`gitleaks/generic-api-key`	website/web/Lib/site-packages/tests/test_oauth.py:440	Possible generic-api-key secret in history (commit 5e1833c967); removed from the current tree but still retrievable	Secrets (gitleaks)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	2
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	8
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	58
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	36
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	1

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`bd756f8b2283`	`prov-5+qual-2+sec-2`	0%	75	53

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Chalarangelo/30-seconds-of-code/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Chalarangelo/30-seconds-of-code/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Chalarangelo/30-seconds-of-code/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Chalarangelo/30-seconds-of-code/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Chalarangelo/30-seconds-of-code/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Chalarangelo/30-seconds-of-code/)

Full text report

Repository: https://github.com/Chalarangelo/30-seconds-of-code
Commit: bd756f8b2283a38560efe83cb30af38324d4e9e9
Generated: 2026-11-14T15:18:40+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	65%	100%
Code quality	75	adequate	90%	100%
Security	53	weak	85%	100%

AI provenance

Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 5.2%
Estimated AI-generated share: 0.0%

AI tool	Attributed commits	Lines added
GitHub Copilot coding agent	1	0

AI tooling configured in repo: github-copilot

Current source lines last changed by AI-attributed commits: 0 of 7,911.

Too few lines in one group to compare finding densities.

Stylometry index: 0.69 per 1,000 lines (narrated steps 4, placeholders 0, assistant phrasing 0, emoji 3). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2024-05	53	0%
2024-06	3,075	0%
2024-07	3,136	0%
2024-08	3,873	0%
2024-09	12	0%
2024-12	74	0%
2025-01	70	0%
2025-03	4,153	0%
2025-04	2,334	0%
2025-05	184	0%
2025-06	14	0%
2025-07	2	0%

Evidence

GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (30f147026dc5)
2,407 lines of first-party code in ~1.1h (2,243 lines/hour, 4 commit session) (acd77db46104)
.github/copilot-instructions.md (github-copilot configuration) (.github/copi)
3,394 lines of first-party code in ~4.2h (817 lines/hour, 15 commit session) (a6ee62e35793)
2,680 lines of first-party code in ~4.5h (591 lines/hour, 24 commit session) (62e6109ef105)
step-by-step narration comment: // Step 2. (src/lib/sear)
step-by-step narration comment: // Step 3. (src/lib/sear)
step-by-step narration comment: // Step 4. (src/lib/sear)
step-by-step narration comment: // Step 5. (src/lib/sear)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.23, CI runs tests; 4% of function code in complex or long functions; 0% duplicated lines. Weakest area: process.

Area	Score
Complexity (lizard)	89
Duplication	97
Code smells (Opengrep)	98
Tests and CI	70
Documentation	80
Type safety	40
Process (Scorecard review/maintenance)	5

Functions: 512; mean complexity 1.8, 90th percentile 3; 3 complex and 0 long functions
Duplicated lines: 0.5% of 5,957 compared
Tests: 1,823 test lines for 7,911 source lines (ratio 0.23); CI test commands: npm test; 8% of recent source commits also change tests
Docs missing or thin: changelog

Most complex functions:

Security

Security posture is weak: 58 known vulnerabilities in 22 dependencies; 8 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: dependencies.

Area	Score
Secrets (gitleaks, tree + history)	97
Static analysis (Opengrep)	56
Vulnerable dependencies (OSV)	9
CI workflows (zizmor)	34
Posture (policy, updates, signing, lockfiles)	60
OpenSSF Scorecard	52

Known vulnerabilities: 58 in 22 packages (critical 3, high 25, medium 24, low 6)
Posture checks passed: security policy, signed commits, lockfiles; missing: dependency updates
OpenSSF Scorecard aggregate: 4.8/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
critical	`osv/GHSA-26w7-cxv4-gfx2`: [email protected] (npm) is affected by GHSA-26w7-cxv4-gfx2	package-lock.json
critical	`osv/GHSA-5gmw-xhrv-c9v3`: [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3	package-lock.json
critical	`osv/GHSA-85c8-ppgw-ccpr`: [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr	package-lock.json
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	content/components/scripts/latex-expression.mjs:23
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `figure.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	content/components/scripts/latex-expression.mjs:23
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/astro/scripts/omnisearch.js:78
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `this.resultsSection.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/astro/scripts/omnisearch.js:78
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/astro/scripts/omnisearch.js:83
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `this.resultsSection.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/astro/scripts/omnisearch.js:83
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/astro/scripts/omnisearch.js:86
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `this.resultsSection.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/astro/scripts/omnisearch.js:86
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	package-lock.json
high	`osv/GHSA-mh99-v99m-4gvg`: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	package-lock.json
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	package-lock.json
high	`osv/GHSA-rgw5-rvv9-x895`: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	package-lock.json
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	package-lock.json
high	`osv/GHSA-mh99-v99m-4gvg`: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	package-lock.json
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	package-lock.json
high	`osv/GHSA-rgw5-rvv9-x895`: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	package-lock.json
high	`osv/GHSA-j22f-vq7h-c4qm`: [email protected] (npm) is affected by GHSA-j22f-vq7h-c4qm	package-lock.json
high	`osv/GHSA-mcm9-63f2-9j32`: [email protected] (npm) is affected by GHSA-mcm9-63f2-9j32	package-lock.json
high	`osv/GHSA-r9w8-h9r3-54w4`: [email protected] (npm) is affected by GHSA-r9w8-h9r3-54w4	package-lock.json
high	`osv/GHSA-x5rw-q4pp-hg5g`: [email protected] (npm) is affected by GHSA-x5rw-q4pp-hg5g	package-lock.json
high	`osv/GHSA-2883-xcg3-v3hh`: [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh	package-lock.json
high	`osv/GHSA-52cp-r559-cp3m`: [email protected] (npm) is affected by GHSA-52cp-r559-cp3m	package-lock.json

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 7,911; test lines: 1,823

Language	Lines
JavaScript	9,724
TypeScript	10