Leaderboard github.com

CyC2018/CS-Notes

:books: 技术面试必备基础知识、Leetcode、计算机操作系统、计算机网络、系统设计

View repository ↗
JavaScript
★ 186,509
commit cb9f180fb26d
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

explicit

Confidence: 95%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

62/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

68/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% explicit

Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace0
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.34

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	43	0	2026-10-22	2026-10-22
OpenAI Codex	1	0	2026-10-27	2026-10-27

Lines added per month all AI-attributed share

2018-0214,926 · 0% AI
2018-030 · 0% AI
2018-040 · 0% AI
2018-050 · 0% AI
2018-060 · 0% AI
2018-070 · 0% AI
2018-080 · 0% AI
2018-090 · 0% AI
2018-100 · 0% AI
2018-110 · 0% AI
2018-1223,967 · 0% AI
2019-010 · 0% AI
2019-020 · 0% AI
2019-030 · 0% AI
2019-043 · 0% AI
2019-050 · 0% AI
2019-0614 · 0% AI
2019-070 · 0% AI
2019-080 · 0% AI
2019-090 · 0% AI
2019-100 · 0% AI
2019-110 · 0% AI
2019-120 · 0% AI
2020-010 · 0% AI
2020-020 · 0% AI
2020-030 · 0% AI
2020-040 · 0% AI
2020-050 · 0% AI
2020-070 · 0% AI
2020-080 · 0% AI
2020-090 · 0% AI
2020-100 · 0% AI
2020-110 · 0% AI
2021-030 · 0% AI
2021-040 · 0% AI
2021-070 · 0% AI
2022-020 · 0% AI
2023-070 · 0% AI
2026-101,938 · 0% AI
2026-112,140 · 0% AI

Findings in AI-attributed lines vs the rest

From git blame: 0 lines trace to AI-attributed commits, 16,362 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	—	0.61	—
Security	—	4.22	—

Evidence by analyzer

Explicit AI attributionok27 items

attributed_commit_share: 1.0%
attributed_commits: 44
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 4,397
effective_loc: 42,988
tools_detected: 2

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok

excluded_import_loc: 0
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 2,761.50
measured_loc: 21,468
median_loc_per_hour: 286.33
pr_timed_units: 1
pre_ai_era_burst_loc: 17,373
pre_ai_era_bursts: 3
pre_ai_era_measured_loc: 17,390
work_units: 28

Release velocityskipped

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 11
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 3
files:narrated_steps: 0
files:placeholder: 0
index: 0.34
lines_scanned: 16,362
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.67
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 0
blame_failures: 0
files_blamed: 198
other_lines: 16,362
quality:ai_findings: 0
quality:other_findings: 10
quality:other_per_kloc: 0.61
security:ai_findings: 0
security:other_findings: 69
security:other_per_kloc: 4.22

Code quality

62 weak

Code quality is weak: test-to-source ratio 0.07, CI runs tests; 27% of function code in complex or long functions; 3% duplicated lines. Weakest area: type safety.

How the score is built

Complexity45
Duplication85
Lint and smells86
Tests and CI59
Documentation55
Type safety40
Review process50

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 22
function_nloc: 9,763
functions: 795
long_functions: 11
many_param_functions: 0
mean_ccn: 3.56
p90_ccn: 8
risky_nloc_share: 26.7%

Duplication (jscpd)ok9 items

compared_lines: 11,597
duplicated_lines: 321
duplicated_share: 2.8%
files: 198

Lintok

category:best-practice: 1
category:correctness: 9
findings: 10
scanned_lines: 16,362
weighted_findings: 10.25

Tests and CIok2 items

CI config: .github/workflows/website.yml .github/workflows/website.yml
CI runs tests (npm test)

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: no
ci_files: 1
cochange_commits: 50
cochange_share: 0.0%
source_lines: 16,362
test_lines: 1,165
test_ratio: 0.07

Documentationok2 items

README.md README.md
CONTRIBUTING.md CONTRIBUTING.md

check:changelog: no
check:contributing: yes
check:license: no
check:readme: yes
readme_lines: 113

Type safetyok

check:low_escape_density: yes
check:strict_config: no
escapes: 0
escapes_per_kloc: 0

Security

68 weak

Security posture is weak: 1 known vulnerabilities in 1 dependencies; 29 high-severity SAST findings. Weakest area: posture.

How the score is built

Secrets74
Static analysis (SAST)50
Vulnerable dependencies95
CI workflows100
Security posture0
OpenSSF Scorecard54

Evidence by analyzer

OpenSSF Scorecardok12 items

aggregate: 5
check:Binary-Artifacts: yes
check:Branch-Protection: no
check:CII-Best-Practices: no
check:Code-Review: no
check:Dangerous-Workflow: yes
check:Fuzzing: no
check:License: no
check:Maintained: yes
check:Pinned-Dependencies: yes
check:SAST: no
check:Security-Policy: no
check:Token-Permissions: yes

Package registriesok

checked: 12
declared: 12
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 9

Static analysis (opengrep)ok

findings: 69
findings_high: 29
findings_low: 0
findings_medium: 40
parse_errors: 0
scanned_lines: 16,362
weighted_findings: 32.10

Dependencies (osv-scanner)ok

penalty: 3
vulnerabilities: 1
vulnerable_packages: 1
vulns_critical: 0
vulns_high: 0
vulns_low: 0
vulns_medium: 1
vulns_unknown: 0

CI workflows (zizmor)ok

findings: 0
findings_high: 0
findings_low: 0
findings_medium: 0
penalty: 0
workflows: 1

Security postureok2 items

docs/_style/prism-master/composer.json has no lockfile alongside it (unpinned dependencies) docs/_style/prism-master/composer.json
docs/_style/prism-master/package.json has no lockfile alongside it (unpinned dependencies) docs/_style/prism-master/package.json

check:dependency_updates: no
check:lockfiles: no
check:security_policy: no
check:signed_commits: no
signed_commit_share: 0.5%
unpinned_manifests: 2

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

31 high44 medium14 low

Severity	Rule	Location	Message	Tool
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	website/builder/site_assets.py:197	Using 'temporary.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'temporary.name' is used. Use '.flush()' or close the file before using 'temporary.name'.	Lint
high	`opengrep/python.lang.correctness.tempfile.tempfile-without-flush`	website/deploy/package_site.py:19	Using 'temporary.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'temporary.name' is used. Use '.flush()' or close the file before using 'temporary.name'.	Lint
high	`opengrep/javascript.browser.security.insecure-document-method`	docs/_style/prism-master/components/prism-core.js:237	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	docs/_style/prism-master/components/prism-core.js:237	User controlled data in a `env.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	docs/_style/prism-master/components/prism-core.js:255	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	docs/_style/prism-master/components/prism-core.js:255	User controlled data in a `env.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	docs/_style/prism-master/examples.js:150	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	docs/_style/prism-master/examples.js:150	User controlled data in a `examples[id].innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	docs/_style/prism-master/plugins/command-line/prism-command-line.js:123	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	docs/_style/prism-master/plugins/command-line/prism-command-line.js:123	User controlled data in a `prompt.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	docs/_style/prism-master/plugins/line-numbers/prism-line-numbers.js:109	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	docs/_style/prism-master/plugins/line-numbers/prism-line-numbers.js:109	User controlled data in a `lineNumbersWrapper.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:185	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:185	User controlled data in a `env.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	docs/_style/prism-master/plugins/previewers/prism-previewers.js:354	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	docs/_style/prism-master/plugins/previewers/prism-previewers.js:354	User controlled data in a `this._elt.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	website/builder/build.py:322	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	website/builder/verify_updates.py:23	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	website/refresh.py:39	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	website/refresh.py:61	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	website/refresh.py:62	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	website/templates/search.js:391	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	website/templates/search.js:391	User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	website/templates/site.js:440	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	website/templates/site.js:440	User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	website/templates/site.js:618	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	website/templates/site.js:618	User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	website/templates/site.js:707	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	website/templates/site.js:707	User controlled data in a `meta.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	website/templates/site.js:758	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	website/templates/site.js:758	User controlled data in a `a.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	docs/_style/prism-master/components/index.js:61	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	website/builder/test_search.cjs:175	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	website/builder/test_search.cjs:176	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-require`	docs/_style/prism-master/components/index.js:61	Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	docs/_style/prism-master/components/prism-core.js:303	RegExp() called with a `grammar` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	docs/_style/prism-master/components/prism-http.js:67	RegExp() called with a `Prism` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	docs/_style/prism-master/components/prism-lisp.js:10	RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	docs/_style/prism-master/components/prism-lisp.js:6	RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	docs/_style/prism-master/components/prism-pure.js:68	RegExp() called with a `lang` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment`	docs/_style/prism-master/download.js:139	Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This...	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/_style/prism-master/download.js:212	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/_style/prism-master/download.js:221	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/_style/prism-master/download.js:399	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/_style/prism-master/download.js:417	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:63	RegExp() called with a `spaces` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:83	RegExp() called with a `input` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	docs/_style/prism-master/plugins/previewers/prism-previewers.js:217	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.browser.security.raw-html-concat`	docs/_style/prism-master/plugins/previewers/prism-previewers.js:354	User controlled data in a HTML string may result in XSS [confidence medium]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	docs/_style/prism-master/plugins/previewers/prism-previewers.js:508	RegExp() called with a `type` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.regex_dos`	website/builder/build.py:38	Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	website/builder/static_notes.cjs:125	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	website/builder/static_notes.cjs:133	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	website/builder/static_notes.cjs:159	Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	website/builder/static_notes.cjs:159	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	website/builder/static_notes.cjs:168	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	website/builder/static_notes.cjs:170	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	website/builder/static_notes.cjs:170	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	website/builder/static_notes.cjs:172	Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	website/builder/static_notes.cjs:172	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	website/builder/static_notes.cjs:178	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	website/builder/static_notes.cjs:179	Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	website/builder/static_notes.cjs:183	Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	website/builder/static_notes.cjs:183	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	website/builder/static_notes.cjs:183	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	website/builder/static_notes.cjs:184	Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	website/builder/static_notes.cjs:184	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal`	website/builder/static_notes.cjs:184	Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	website/builder/static_notes.cjs:50	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	website/builder/static_notes.cjs:57	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	website/builder/static_notes.cjs:65	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`osv/GHSA-g3hv-75wg-m249`	website/deploy/package-lock.json	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	website/templates/search.js:352	RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	website/templates/search.js:48	RegExp() called with a `term` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	website/templates/search.js:78	RegExp() called with a `word` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.eqeq-is-bad`	docs/_style/prism-master/components/prism-core.js:395	Detected a useless comparison operation `delNum == delNum` or `delNum != delNum`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex.	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	docs/_style/prism-master/plugins/previewers/prism-previewers.js:138	`this.firstChild.style.backgroundImage` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	docs/_style/prism-master/plugins/previewers/prism-previewers.js:271	`this.style.backgroundColor` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	website/builder/static_notes.cjs:88	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	website/builder/static_notes.cjs:88	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`gitleaks/generic-api-key`	README.md:106	Possible generic-api-key secret in history (commit b403735305); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	docs/index.html.dump:53	Possible generic-api-key secret in history (commit e9e604e6a7); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	docs/index.html:53	Possible generic-api-key secret in history (commit 10ca0b75df); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	docs1/docs/index.html:33	Possible generic-api-key secret in history (commit 8c7aa37313); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/jwt`	notes/HTTP.md:500	Possible jwt secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	notes/HTTP.md:571	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	other/Group.md:4	Possible generic-api-key secret in history (commit cb02ca7cf4); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	website/deploy/deploy.test.mjs:137	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	相关内容.md:6	Possible generic-api-key secret in history (commit 348f6335eb); removed from the current tree but still retrievable	Secrets (gitleaks)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	10
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	0
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	1
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	69
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	9

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`cb9f180fb26d`	`prov-5+qual-2+sec-2`	0%	62	68

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/CyC2018/CS-Notes/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/CyC2018/CS-Notes/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/CyC2018/CS-Notes/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/CyC2018/CS-Notes/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/CyC2018/CS-Notes/security.svg)](https://repotrust.synapticcyber.com/r/github.com/CyC2018/CS-Notes/)

Full text report

Repository: https://github.com/CyC2018/CS-Notes
Commit: cb9f180fb26da7b7100fde250a5dd137455b3a02
Generated: 2026-11-14T15:20:08+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	explicit	95%	100%
Code quality	62	weak	90%	100%
Security	68	weak	85%	100%

AI provenance

Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%

AI tool	Attributed commits	Lines added
Claude Code	43	0
OpenAI Codex	1	0

Current source lines last changed by AI-attributed commits: 0 of 16,362.

Too few lines in one group to compare finding densities.

Stylometry index: 0.34 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 11). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2018-02	14,926	0%
2018-12	23,967	0%
2019-04	3	0%
2019-06	14	0%
2026-10	1,938	0%
2026-11	2,140	0%

Evidence

OpenAI Codex: on merged branch (fb83a173e9) (f702b72924ac)
Claude Code: trailer 'Co-Authored-By: Claude' (67ed9c34e6ff)
Claude Code: trailer 'Co-Authored-By: Claude' (c6f1a5b8f041)
Claude Code: trailer 'Co-Authored-By: Claude' (ffef13f0450e)
Claude Code: trailer 'Co-Authored-By: Claude' (ef47be84b9c3)
Claude Code: trailer 'Co-Authored-By: Claude' (3986b77ef405)
Claude Code: trailer 'Co-Authored-By: Claude' (97ed6381d708)
Claude Code: trailer 'Co-Authored-By: Claude' (359581e1a379)
Claude Code: trailer 'Co-Authored-By: Claude' (af66bd701ec5)
Claude Code: trailer 'Co-Authored-By: Claude' (1fa68a2c06d0)
Claude Code: trailer 'Co-Authored-By: Claude' (77f2319e35f4)
Claude Code: trailer 'Co-Authored-By: Claude' (4eb6dfbdfea6)
Claude Code: trailer 'Co-Authored-By: Claude' (cc0ab9b863b2)
Claude Code: trailer 'Co-Authored-By: Claude' (28ff86d41313)
Claude Code: trailer 'Co-Authored-By: Claude' (effd5d958e3a)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.07, CI runs tests; 27% of function code in complex or long functions; 3% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	45
Duplication	85
Code smells (Opengrep)	86
Tests and CI	59
Documentation	55
Type safety	40
Process (Scorecard review/maintenance)	50

Functions: 795; mean complexity 3.6, 90th percentile 8; 22 complex and 11 long functions
Duplicated lines: 2.8% of 11,597 compared
Tests: 1,165 test lines for 16,362 source lines (ratio 0.07); CI test commands: npm test; 0% of recent source commits also change tests
Docs missing or thin: license, changelog

Most complex functions:

Security

Security posture is weak: 1 known vulnerabilities in 1 dependencies; 29 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	74
Static analysis (Opengrep)	50
Vulnerable dependencies (OSV)	95
CI workflows (zizmor)	100
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	54

Known vulnerabilities: 1 in 1 packages (critical 0, high 0, medium 1, low 0)
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
OpenSSF Scorecard aggregate: 5.0/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/components/prism-core.js:237
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `env.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/components/prism-core.js:237
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/components/prism-core.js:255
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `env.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/components/prism-core.js:255
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/examples.js:150
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `examples[id].innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/examples.js:150
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/plugins/command-line/prism-command-line.js:123
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `prompt.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/plugins/command-line/prism-command-line.js:123
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/plugins/line-numbers/prism-line-numbers.js:109
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `lineNumbersWrapper.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/plugins/line-numbers/prism-line-numbers.js:109
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:185
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `env.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:185
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/plugins/previewers/prism-previewers.js:354
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `this._elt.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	docs/_style/prism-master/plugins/previewers/prism-previewers.js:354
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	website/builder/build.py:322
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	website/builder/verify_updates.py:23
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	website/refresh.py:39
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	website/refresh.py:61
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	website/refresh.py:62
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	website/templates/search.js:391
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	website/templates/search.js:391
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	website/templates/site.js:440
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	website/templates/site.js:440
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	website/templates/site.js:618
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	website/templates/site.js:618

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 16,362; test lines: 1,165

Language	Lines
JavaScript	16,307
Python	1,220