Leaderboard github.com

FortAwesome/Font-Awesome

The iconic SVG, font, and CSS toolkit

View repository ↗
JavaScript
★ 77,038
commit 14c65a3747d0
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

possible

Confidence: 46%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

32/100

poor

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

38/100

poor

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% possible

Weak signals consistent with AI-assisted development.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts2%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace1
Releases at AI pace0
Coding-style index (1.0+ means possible)0.00

Lines added per month all AI-attributed share

2025-07192,244 · 0% AI
2025-09197 · 0% AI
2025-104,196 · 0% AI
2025-110 · 0% AI
2025-120 · 0% AI
2026-026,394 · 0% AI
2026-066,914 · 0% AI
2026-07390 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 23
effective_loc: 210,335
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok1 item

3,534 lines of first-party code in ~5.4h (653 lines/hour, PR #21465)

excluded_import_loc: 157,214
flagged_loc: 3,534
flagged_loc_share: 53.7%
flagged_units: 1
max_loc_per_hour: 653.37
measured_loc: 6,583
median_loc_per_hour: 104.49
pr_timed_units: 5
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 5

Release velocityok

flagged_releases: 0
max_loc_per_day: 144.80
releases: 5

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 147,977
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

32 poor

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 60% of function code in complex or long functions; 76% duplicated lines. Weakest area: testing.

How the score is built

Complexity16
Duplication1
Lint and smells99
Tests and CI0
Documentation100
Type safety40
Review process20

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 33
function_nloc: 37,323
functions: 1,950
long_functions: 15
many_param_functions: 0
mean_ccn: 2.86
p90_ccn: 6
risky_nloc_share: 60.4%

Duplication (jscpd)ok10 items

compared_lines: 144,207
duplicated_lines: 109,974
duplicated_share: 76.3%
files: 5,782

Lintok

category:correctness: 18
findings: 18
scanned_lines: 163,069
weighted_findings: 4.50

Tests and CIok

check:ci_present: no
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: no
check:test_ratio: no
check:tests_cochange: no
ci_files: 0
cochange_commits: 6
cochange_share: 0.0%
source_lines: 163,069
test_lines: 0
test_ratio: 0

Documentationok4 items

README.md README.md
LICENSE.txt LICENSE.txt
CONTRIBUTING.md CONTRIBUTING.md
CHANGELOG.md CHANGELOG.md

check:changelog: yes
check:contributing: yes
check:license: yes
check:readme: yes
readme_lines: 60

Type safetyok

check:low_escape_density: yes
check:strict_config: no
escapes: 2
escapes_per_kloc: 0.05

Security

38 poor

Security posture is poor: 5 possible secret(s) in the tree, 6 only in history; 35 high-severity SAST findings. Weakest area: secrets.

How the score is built

Secrets5
Static analysis (SAST)94
Vulnerable dependenciesnot measured
CI workflowsnot measured
Security posture20
OpenSSF Scorecard25

Evidence by analyzer

OpenSSF Scorecardok9 items

aggregate: 2.50
check:Binary-Artifacts: yes
check:CII-Best-Practices: no
check:Code-Review: yes
check:Fuzzing: no
check:License: yes
check:Maintained: no
check:SAST: no
check:Security-Policy: no
check:Signed-Releases: no

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 5
secrets_history: 6
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 45
findings_high: 35
findings_low: 0
findings_medium: 10
parse_errors: 0
scanned_lines: 163,069
weighted_findings: 28.75

Dependencies (osv-scanner)skipped

CI workflows (zizmor)skipped

Security postureok7 items

composer.json has no lockfile alongside it (unpinned dependencies) composer.json
js-packages/@fortawesome/fontawesome-common-types/package.json has no lockfile alongside it (unpinned dependencies) js-packages/@fortawesome/fontawesome-common-types/package.json
js-packages/@fortawesome/fontawesome-free/package.json has no lockfile alongside it (unpinned dependencies) js-packages/@fortawesome/fontawesome-free/package.json
js-packages/@fortawesome/fontawesome-svg-core/package.json has no lockfile alongside it (unpinned dependencies) js-packages/@fortawesome/fontawesome-svg-core/package.json
js-packages/@fortawesome/free-brands-svg-icons/package.json has no lockfile alongside it (unpinned dependencies) js-packages/@fortawesome/free-brands-svg-icons/package.json
js-packages/@fortawesome/free-regular-svg-icons/package.json has no lockfile alongside it (unpinned dependencies) js-packages/@fortawesome/free-regular-svg-icons/package.json
js-packages/@fortawesome/free-solid-svg-icons/package.json has no lockfile alongside it (unpinned dependencies) js-packages/@fortawesome/free-solid-svg-icons/package.json

check:dependency_updates: no
check:lockfiles: no
check:security_policy: no
check:signed_commits: yes
signed_commit_share: 82.6%
unpinned_manifests: 7

Release downloadsok5 items

binary_assets: 20
signals: 1
suspicious: 0

Findings

40 high16 medium18 low

Severity	Rule	Location	Message	Tool
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:1421	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:1421	User controlled data in a `style.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:2324	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:2324	User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:2703	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:2703	User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:3359	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/index.js:1412	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-svg-core/index.js:1412	User controlled data in a `style.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/index.js:2281	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-svg-core/index.js:2281	User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/index.js:2660	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-svg-core/index.js:2660	User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/index.js:3316	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:1406	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:1406	User controlled data in a `style.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:2275	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:2275	User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:2654	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:2654	User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:3310	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:1495	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:1495	User controlled data in a `style.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:2270	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:2270	User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:2649	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:2649	User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:3305	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`gitleaks/linkedin-client-id`	js-packages/@fortawesome/free-brands-svg-icons/faLinkedin.d.ts:3	Possible linkedin-client-id secret in the current tree	Secrets (gitleaks)
high	`gitleaks/linkedin-client-id`	js-packages/@fortawesome/free-brands-svg-icons/faLinkedinIn.d.ts:3	Possible linkedin-client-id secret in the current tree	Secrets (gitleaks)
high	`gitleaks/linkedin-client-id`	js-packages/@fortawesome/free-brands-svg-icons/faSquareLinkedin.d.ts:3	Possible linkedin-client-id secret in the current tree	Secrets (gitleaks)
high	`gitleaks/linkedin-client-id`	js-packages/@fortawesome/free-brands-svg-icons/index.d.ts:251	Possible linkedin-client-id secret in the current tree	Secrets (gitleaks)
high	`gitleaks/linkedin-client-secret`	js-packages/@fortawesome/free-brands-svg-icons/index.js:3926	Possible linkedin-client-secret secret in the current tree	Secrets (gitleaks)
high	`opengrep/javascript.browser.security.insecure-document-method`	js/fontawesome.js:1421	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js/fontawesome.js:1421	User controlled data in a `style.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js/fontawesome.js:2324	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js/fontawesome.js:2324	User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js/fontawesome.js:2703	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	js/fontawesome.js:2703	User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	js/fontawesome.js:3359	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`gitleaks/linkedin-client-id`	advanced-options/use-with-node-js/fontawesome-free-brands/index.d.ts:178	Possible linkedin-client-id secret in history (commit 24d46179c6); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/linkedin-client-id`	advanced-options/use-with-node-js/free-brands-svg-icons/faLinkedin.d.ts:3	Possible linkedin-client-id secret in history (commit 4092d1e1a3); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/linkedin-client-id`	advanced-options/use-with-node-js/free-brands-svg-icons/faLinkedinIn.d.ts:3	Possible linkedin-client-id secret in history (commit 4092d1e1a3); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/linkedin-client-id`	advanced-options/use-with-node-js/free-brands-svg-icons/index.d.ts:200	Possible linkedin-client-id secret in history (commit 4092d1e1a3); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`gitleaks/linkedin-client-id`	free/js-packages/@fortawesome/free-brands-svg-icons/index.d.ts:81	Possible linkedin-client-id secret in history (commit 8302f1cca7); removed from the current tree but still retrievable	Secrets (gitleaks)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:207	RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:207	RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js-packages/@fortawesome/fontawesome-svg-core/index.js:210	RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js-packages/@fortawesome/fontawesome-svg-core/index.js:210	RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:204	RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:204	RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:199	RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:199	RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js/fontawesome.js:207	RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	js/fontawesome.js:207	RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`gitleaks/sumologic-access-token`	src/_layouts/base.html:73	Possible sumologic-access-token secret in history (commit c6c3a26003); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-free/js/brands.js:88	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-free/js/conflict-detection.js:84	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:196	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-free/js/regular.js:88	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-free/js/solid.js:88	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-free/js/v4-shims.js:91	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-svg-core/import.macro.js:1	`const` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-svg-core/import.macro.js:2	`const` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-svg-core/import.macro.js:3	`const` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-svg-core/index.js:199	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:193	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js-packages/@fortawesome/fontawesome-svg-core/plugins.mjs:188	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js/brands.js:88	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js/conflict-detection.js:84	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js/fontawesome.js:196	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js/regular.js:88	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js/solid.js:88	`t` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	js/v4-shims.js:91	`t` is assigned twice; the first assignment is useless	Lint

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	18
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	skipped	`—`	0
Dependencies (osv-scanner)	Security	skipped	`—`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	45
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	11

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`14c65a3747d0`	`prov-5+qual-2+sec-2`	0%	32	38

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/FortAwesome/Font-Awesome/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/FortAwesome/Font-Awesome/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/FortAwesome/Font-Awesome/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/FortAwesome/Font-Awesome/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/FortAwesome/Font-Awesome/security.svg)](https://repotrust.synapticcyber.com/r/github.com/FortAwesome/Font-Awesome/)

Full text report

Repository: https://github.com/FortAwesome/Font-Awesome
Commit: 14c65a3747d0f3b751f15831fc719236aea8729d
Generated: 2026-11-14T15:40:41+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	46%	100%
Code quality	32	poor	90%	100%
Security	38	poor	85%	100%

AI provenance

Weak signals consistent with AI-assisted development.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 1.7%
Estimated AI-generated share: 0.0%

Month	Lines added	Attributed to AI
2025-07	192,244	0%
2025-09	197	0%
2025-10	4,196	0%
2026-02	6,394	0%
2026-06	6,914	0%
2026-07	390	0%

Evidence

3,534 lines of first-party code in ~5.4h (653 lines/hour, PR #21465) (337dd2045d56)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 60% of function code in complex or long functions; 76% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	16
Duplication	1
Code smells (Opengrep)	99
Tests and CI	0
Documentation	100
Type safety	40
Process (Scorecard review/maintenance)	20

Functions: 1,950; mean complexity 2.9, 90th percentile 6; 33 complex and 15 long functions
Duplicated lines: 76.3% of 144,207 compared
Tests: 0 test lines for 163,069 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: none

Most complex functions:

Security

Security posture is poor: 5 possible secret(s) in the tree, 6 only in history; 35 high-severity SAST findings. Weakest area: secrets.

Area	Score
Secrets (gitleaks, tree + history)	5
Static analysis (Opengrep)	94
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	25

Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles
OpenSSF Scorecard aggregate: 2.5/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
high	`gitleaks/linkedin-client-id`: Possible linkedin-client-id secret in the current tree	js-packages/@fortawesome/free-brands-svg-icons/faLinkedinIn.d.ts:3
high	`gitleaks/linkedin-client-id`: Possible linkedin-client-id secret in the current tree	js-packages/@fortawesome/free-brands-svg-icons/faLinkedin.d.ts:3
high	`gitleaks/linkedin-client-id`: Possible linkedin-client-id secret in the current tree	js-packages/@fortawesome/free-brands-svg-icons/faSquareLinkedin.d.ts:3
high	`gitleaks/linkedin-client-id`: Possible linkedin-client-id secret in the current tree	js-packages/@fortawesome/free-brands-svg-icons/index.d.ts:251
high	`gitleaks/linkedin-client-secret`: Possible linkedin-client-secret secret in the current tree	js-packages/@fortawesome/free-brands-svg-icons/index.js:3926
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:1421
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `style.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:1421
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:2324
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:2324
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:2703
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:2703
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-free/js/fontawesome.js:3359
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.js:1412
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `style.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.js:1412
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.js:2281
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.js:2281
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.js:2660
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.js:2660
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.js:3316
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:1406
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `style.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:1406
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:2275
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:2275
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:2654
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `node.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	js-packages/@fortawesome/fontawesome-svg-core/index.mjs:2654

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release 7.3.1 ships fontawesome-free-7.3.1-desktop.zip (19051 downloads)
binary-release-asset: release 7.3.1 ships fontawesome-free-7.3.1-web.zip (4709 downloads)
binary-release-asset: release 7.3.0 ships fontawesome-free-7.3.0-desktop.zip (5481 downloads)
binary-release-asset: release 7.3.0 ships fontawesome-free-7.3.0-web.zip (1003 downloads)
binary-release-asset: release 7.2.0 ships fontawesome-free-7.2.0-desktop.zip (16781 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 163,069; test lines: 0

Language	Lines
JavaScript	125,737
TypeScript	37,332