Leaderboard github.com

HeroTransitions/Hero

Elegant transition library for iOS & tvOS

View repository ↗
Swift
★ 22,497
commit d7a72e13b034
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

none-detected

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

55/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

47/100

poor

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace0
Releases at AI pace0
Coding-style index (1.0+ means possible)0.16

Lines added per month all AI-attributed share

2016-124,549 · 0% AI
2017-013,043 · 0% AI
2017-024,038 · 0% AI
2017-03889 · 0% AI
2017-04364 · 0% AI
2017-05168 · 0% AI
2017-062,139 · 0% AI
2017-07276 · 0% AI
2017-0816 · 0% AI
2017-0944 · 0% AI
2017-1035 · 0% AI
2017-11126 · 0% AI
2018-01494 · 0% AI
2018-0227 · 0% AI
2018-0314 · 0% AI
2018-04679 · 0% AI
2018-051 · 0% AI
2018-065 · 0% AI
2018-070 · 0% AI
2018-082 · 0% AI
2018-090 · 0% AI
2018-10430 · 0% AI
2018-1114 · 0% AI
2018-1251 · 0% AI
2019-010 · 0% AI
2019-0211 · 0% AI
2019-0317 · 0% AI
2019-090 · 0% AI
2019-103,892 · 0% AI
2019-11117 · 0% AI
2019-120 · 0% AI
2020-0115 · 0% AI
2020-033 · 0% AI
2020-040 · 0% AI
2020-06157 · 0% AI
2020-0823 · 0% AI
2020-120 · 0% AI
2021-02319 · 0% AI
2021-032 · 0% AI
2021-0463 · 0% AI
2022-040 · 0% AI
2022-0526 · 0% AI
2022-070 · 0% AI
2022-0815 · 0% AI
2022-0919 · 0% AI
2022-106 · 0% AI
2023-093 · 0% AI
2024-010 · 0% AI
2024-020 · 0% AI
2024-106 · 0% AI
2025-010 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 545
effective_loc: 22,098
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok

excluded_import_loc: 3,112
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 901.50
measured_loc: 18,986
median_loc_per_hour: 44.25
pr_timed_units: 47
pre_ai_era_burst_loc: 3,606
pre_ai_era_bursts: 1
pre_ai_era_measured_loc: 18,911
work_units: 253

Release velocityok

flagged_releases: 0
max_loc_per_day: 736.40
releases: 33

Coding styleok1 item

placeholder or demo-only phrasing: // controller. In a real app, we would be passing some data correspoding to the cell

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 1
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 1
index: 0.16
lines_scanned: 12,468
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0.08

Code quality

55 weak

Code quality is weak: test-to-source ratio 0.00, CI runs tests; 10% of function code in complex or long functions; 45% duplicated lines. Weakest area: duplication.

How the score is built

Complexity74
Duplication6
Lint and smells100
Tests and CI45
Documentation85
Type safetynot measured
Review process15

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 10
function_nloc: 8,549
functions: 1,134
long_functions: 4
many_param_functions: 0
mean_ccn: 2.17
p90_ccn: 4
risky_nloc_share: 10.3%

Duplication (jscpd)ok10 items

compared_lines: 8,660
duplicated_lines: 3,935
duplicated_share: 45.4%
files: 86

Lintok

findings: 0
scanned_lines: 12,468
weighted_findings: 0

Tests and CIok7 items

CI config: .github/workflows/build.yml .github/workflows/build.yml
CI config: .github/workflows/rebase.yml .github/workflows/rebase.yml
CI config: .github/workflows/swiftlint.yml .github/workflows/swiftlint.yml
CI config: .github/workflows/test.yml .github/workflows/test.yml
CI config: .travis.yml .travis.yml
CI runs tests (swift test)
CI runs linters (swiftlint)

check:ci_present: yes
check:ci_runs_lint: yes
check:ci_runs_tests: yes
check:has_tests: no
check:test_ratio: no
check:tests_cochange: no
ci_files: 5
cochange_commits: 200
cochange_share: 0.0%
source_lines: 12,468
test_lines: 0
test_ratio: 0

Documentationok3 items

README.md README.md
LICENSE LICENSE
CHANGELOG.md CHANGELOG.md

check:changelog: yes
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 137

Type safetyskipped

Security

47 poor

Security posture is poor: 41 known vulnerabilities in 15 dependencies; 10 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)76
Vulnerable dependencies11
CI workflows10
Security posture0
OpenSSF Scorecard29

Evidence by analyzer

OpenSSF Scorecardok12 items

aggregate: 3.10
check:Binary-Artifacts: yes
check:CII-Best-Practices: no
check:Code-Review: yes
check:Dangerous-Workflow: yes
check:Fuzzing: no
check:License: yes
check:Maintained: no
check:Pinned-Dependencies: no
check:SAST: no
check:Security-Policy: no
check:Signed-Releases: no
check:Token-Permissions: no

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 40
findings_high: 0
findings_low: 0
findings_medium: 40
parse_errors: 1
scanned_lines: 12,468
weighted_findings: 10

Dependencies (osv-scanner)ok

penalty: 131
vulnerabilities: 41
vulnerable_packages: 15
vulns_critical: 3
vulns_high: 18
vulns_low: 2
vulns_medium: 17
vulns_unknown: 1

CI workflows (zizmor)ok

findings: 22
findings_high: 10
findings_low: 0
findings_medium: 12
penalty: 139.60
workflows: 4

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 35.5%
unpinned_manifests: 0

Release downloadsok4 items

binary_assets: 4
signals: 1
suspicious: 0

Findings

3 critical28 high70 medium2 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-52p9-v744-mwjj`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-52p9-v744-mwjj	Dependencies (osv-scanner)
critical	`osv/GHSA-5c5f-7vfq-3732`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-5c5f-7vfq-3732	Dependencies (osv-scanner)
critical	`osv/GHSA-69p6-wvmq-27gg`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-69p6-wvmq-27gg	Dependencies (osv-scanner)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:22	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/rebase.yml:12	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/rebase.yml:14	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/dangerous-triggers`	.github/workflows/rebase.yml:3	use of fundamentally insecure workflow trigger [confidence medium]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/swiftlint.yml:15	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/swiftlint.yml:17	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:23	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:46	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:53	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:63	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`osv/GHSA-2rxp-v6pw-ch6m`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-2rxp-v6pw-ch6m	Dependencies (osv-scanner)
high	`osv/GHSA-47m2-wp7j-p9vc`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-47m2-wp7j-p9vc	Dependencies (osv-scanner)
high	`osv/GHSA-5866-49gr-22v4`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-5866-49gr-22v4	Dependencies (osv-scanner)
high	`osv/GHSA-5cm2-9h8c-rvfx`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-5cm2-9h8c-rvfx	Dependencies (osv-scanner)
high	`osv/GHSA-6f62-3596-g6w7`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-6f62-3596-g6w7	Dependencies (osv-scanner)
high	`osv/GHSA-7627-mp87-jf6q`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-7627-mp87-jf6q	Dependencies (osv-scanner)
high	`osv/GHSA-8474-xrp6-wh69`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-8474-xrp6-wh69	Dependencies (osv-scanner)
high	`osv/GHSA-8cr8-4vfw-mr7h`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-8cr8-4vfw-mr7h	Dependencies (osv-scanner)
high	`osv/GHSA-98m9-hrrm-r99r`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-98m9-hrrm-r99r	Dependencies (osv-scanner)
high	`osv/GHSA-c32j-vqhx-rx3x`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-c32j-vqhx-rx3x	Dependencies (osv-scanner)
high	`osv/GHSA-g397-v4w5-4m79`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-g397-v4w5-4m79	Dependencies (osv-scanner)
high	`osv/GHSA-h27x-rffw-24p4`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-h27x-rffw-24p4	Dependencies (osv-scanner)
high	`osv/GHSA-h8w8-99g7-qmvj`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-h8w8-99g7-qmvj	Dependencies (osv-scanner)
high	`osv/GHSA-jxhc-q857-3j6g`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-jxhc-q857-3j6g	Dependencies (osv-scanner)
high	`osv/GHSA-pfpr-3463-c6jh`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-pfpr-3463-c6jh	Dependencies (osv-scanner)
high	`osv/GHSA-pphf-gfrm-v32r`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-pphf-gfrm-v32r	Dependencies (osv-scanner)
high	`osv/GHSA-r55c-59qm-vjw6`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-r55c-59qm-vjw6	Dependencies (osv-scanner)
high	`osv/GHSA-vmwr-mc7x-5vc3`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-vmwr-mc7x-5vc3	Dependencies (osv-scanner)
medium	`zizmor/artipacked`	.github/workflows/build.yml:21	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/build.yml:7	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/rebase.yml:12	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/archived-uses`	.github/workflows/rebase.yml:14	action or reusable workflow from archived repository [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/rebase.yml:7	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/swiftlint.yml:11	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/swiftlint.yml:15	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:16	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/test.yml:22	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:28	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:3	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/test.yml:45	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`osv/GHSA-2j26-frm8-cmj9`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-2j26-frm8-cmj9	Dependencies (osv-scanner)
medium	`osv/GHSA-2xgq-q749-89fq`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-2xgq-q749-89fq	Dependencies (osv-scanner)
medium	`osv/GHSA-33mh-2634-fwr2`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-33mh-2634-fwr2	Dependencies (osv-scanner)
medium	`osv/GHSA-48rx-c7pg-q66r`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-48rx-c7pg-q66r	Dependencies (osv-scanner)
medium	`osv/GHSA-4xqq-m2hx-25v8`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-4xqq-m2hx-25v8	Dependencies (osv-scanner)
medium	`osv/GHSA-89vf-4333-qx8v`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-89vf-4333-qx8v	Dependencies (osv-scanner)
medium	`osv/GHSA-8gmh-2hhj-2hv9`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-8gmh-2hhj-2hv9	Dependencies (osv-scanner)
medium	`osv/GHSA-9crm-g4mf-wc5j`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-9crm-g4mf-wc5j	Dependencies (osv-scanner)
medium	`osv/GHSA-9f42-57jx-vpp3`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-9f42-57jx-vpp3	Dependencies (osv-scanner)
medium	`osv/GHSA-cg4j-q9v8-6v38`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-cg4j-q9v8-6v38	Dependencies (osv-scanner)
medium	`osv/GHSA-cr5q-6q9f-rq6q`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-cr5q-6q9f-rq6q	Dependencies (osv-scanner)
medium	`osv/GHSA-j6gc-792m-qgm2`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-j6gc-792m-qgm2	Dependencies (osv-scanner)
medium	`osv/GHSA-j82w-28jv-3pmj`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-j82w-28jv-3pmj	Dependencies (osv-scanner)
medium	`osv/GHSA-pj73-v5mw-pm9j`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-pj73-v5mw-pm9j	Dependencies (osv-scanner)
medium	`osv/GHSA-qq38-m9mg-xjj5`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-qq38-m9mg-xjj5	Dependencies (osv-scanner)
medium	`osv/GHSA-r995-q44h-hr64`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-r995-q44h-hr64	Dependencies (osv-scanner)
medium	`osv/GHSA-vg3r-rm7w-2xgh`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-vg3r-rm7w-2xgh	Dependencies (osv-scanner)
medium	`osv/GHSA-wv3x-4vxv-whpp`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-wv3x-4vxv-whpp	Dependencies (osv-scanner)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/jazzy.js:30	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:1479	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:1485	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:1579	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:1586	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:1690	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:271	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:492	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:493	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:494	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:739	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:742	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:781	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:793	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:801	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:816	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:912	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:912	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:931	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/docsets/Hero.docset/Contents/Resources/Documents/js/typeahead.jquery.js:942	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/jazzy.js:30	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:1479	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:1485	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:1579	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:1586	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:1690	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:271	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:492	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:493	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:494	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:739	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:742	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	docs/js/typeahead.jquery.js:781	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	docs/js/typeahead.jquery.js:793	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`	docs/js/typeahead.jquery.js:801	JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:816	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:912	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:912	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:931	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`	docs/js/typeahead.jquery.js:942	User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
low	`osv/GHSA-539f-xcgw-2gjg`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-539f-xcgw-2gjg	Dependencies (osv-scanner)
low	`osv/GHSA-6wx8-w4f5-wwcr`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-6wx8-w4f5-wwcr	Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	0
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	22
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	41
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	40
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`d7a72e13b034`	`prov-5+qual-2+sec-2`	0%	55	47

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/HeroTransitions/Hero/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/HeroTransitions/Hero/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/HeroTransitions/Hero/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/HeroTransitions/Hero/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/HeroTransitions/Hero/security.svg)](https://repotrust.synapticcyber.com/r/github.com/HeroTransitions/Hero/)

Full text report

Repository: https://github.com/HeroTransitions/Hero
Commit: d7a72e13b034599ff694e6907f770e6bcb83f59d
Generated: 2026-11-14T15:45:54+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	65%	100%
Code quality	55	weak	90%	100%
Security	47	poor	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
Stylometry index: 0.16 per 1,000 lines (narrated steps 0, placeholders 1, assistant phrasing 0, emoji 0). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2020-03	3	0%
2020-06	157	0%
2020-08	23	0%
2021-02	319	0%
2021-03	2	0%
2021-04	63	0%
2022-05	26	0%
2022-08	15	0%
2022-09	19	0%
2022-10	6	0%
2023-09	3	0%
2024-10	6	0%

Evidence

placeholder or demo-only phrasing: // controller. In a real app, we would be passing some data correspoding to the cell (Examples/Mat)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, CI runs tests; 10% of function code in complex or long functions; 45% duplicated lines. Weakest area: duplication.

Area	Score
Complexity (lizard)	74
Duplication	6
Code smells (Opengrep)	100
Tests and CI	45
Documentation	85
Type safety	n/a
Process (Scorecard review/maintenance)	15

Functions: 1,134; mean complexity 2.2, 90th percentile 4; 10 complex and 4 long functions
Duplicated lines: 45.4% of 8,660 compared
Tests: 0 test lines for 12,468 source lines (ratio 0.00); CI test commands: swift test; 0% of recent source commits also change tests
Docs missing or thin: contributing

Most complex functions:

Security

Security posture is poor: 41 known vulnerabilities in 15 dependencies; 10 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	76
Vulnerable dependencies (OSV)	11
CI workflows (zizmor)	10
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	29

Known vulnerabilities: 41 in 15 packages (critical 3, high 18, medium 17, low 2)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
OpenSSF Scorecard aggregate: 3.1/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
critical	`osv/GHSA-69p6-wvmq-27gg`: [email protected] (RubyGems) is affected by GHSA-69p6-wvmq-27gg	Gemfile.lock
critical	`osv/GHSA-5c5f-7vfq-3732`: [email protected] (RubyGems) is affected by GHSA-5c5f-7vfq-3732	Gemfile.lock
critical	`osv/GHSA-52p9-v744-mwjj`: [email protected] (RubyGems) is affected by GHSA-52p9-v744-mwjj	Gemfile.lock
high	`osv/GHSA-8474-xrp6-wh69`: [email protected] (RubyGems) is affected by GHSA-8474-xrp6-wh69	Gemfile.lock
high	`osv/GHSA-h27x-rffw-24p4`: [email protected] (RubyGems) is affected by GHSA-h27x-rffw-24p4	Gemfile.lock
high	`osv/GHSA-jxhc-q857-3j6g`: [email protected] (RubyGems) is affected by GHSA-jxhc-q857-3j6g	Gemfile.lock
high	`osv/GHSA-7627-mp87-jf6q`: [email protected] (RubyGems) is affected by GHSA-7627-mp87-jf6q	Gemfile.lock
high	`osv/GHSA-g397-v4w5-4m79`: [email protected] (RubyGems) is affected by GHSA-g397-v4w5-4m79	Gemfile.lock
high	`osv/GHSA-h8w8-99g7-qmvj`: [email protected] (RubyGems) is affected by GHSA-h8w8-99g7-qmvj	Gemfile.lock
high	`osv/GHSA-98m9-hrrm-r99r`: [email protected] (RubyGems) is affected by GHSA-98m9-hrrm-r99r	Gemfile.lock
high	`osv/GHSA-pfpr-3463-c6jh`: [email protected] (RubyGems) is affected by GHSA-pfpr-3463-c6jh	Gemfile.lock
high	`osv/GHSA-pphf-gfrm-v32r`: [email protected] (RubyGems) is affected by GHSA-pphf-gfrm-v32r	Gemfile.lock
high	`osv/GHSA-c32j-vqhx-rx3x`: [email protected] (RubyGems) is affected by GHSA-c32j-vqhx-rx3x	Gemfile.lock
high	`osv/GHSA-2rxp-v6pw-ch6m`: [email protected] (RubyGems) is affected by GHSA-2rxp-v6pw-ch6m	Gemfile.lock
high	`osv/GHSA-5866-49gr-22v4`: [email protected] (RubyGems) is affected by GHSA-5866-49gr-22v4	Gemfile.lock
high	`osv/GHSA-8cr8-4vfw-mr7h`: [email protected] (RubyGems) is affected by GHSA-8cr8-4vfw-mr7h	Gemfile.lock
high	`osv/GHSA-r55c-59qm-vjw6`: [email protected] (RubyGems) is affected by GHSA-r55c-59qm-vjw6	Gemfile.lock
high	`osv/GHSA-vmwr-mc7x-5vc3`: [email protected] (RubyGems) is affected by GHSA-vmwr-mc7x-5vc3	Gemfile.lock
high	`osv/GHSA-47m2-wp7j-p9vc`: [email protected] (RubyGems) is affected by GHSA-47m2-wp7j-p9vc	Gemfile.lock
high	`osv/GHSA-5cm2-9h8c-rvfx`: [email protected] (RubyGems) is affected by GHSA-5cm2-9h8c-rvfx	Gemfile.lock
high	`osv/GHSA-6f62-3596-g6w7`: [email protected] (RubyGems) is affected by GHSA-6f62-3596-g6w7	Gemfile.lock
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build.yml:22
high	`zizmor/dangerous-triggers`: use of fundamentally insecure workflow trigger [confidence medium]	.github/workflows/rebase.yml:3
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/rebase.yml:12
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/rebase.yml:14

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release 1.6.4 ships Hero.framework.zip (476 downloads)
binary-release-asset: release 1.6.1 ships Hero.xcframework.zip (739 downloads)
binary-release-asset: release 1.6.0 ships Hero.framework.zip (245 downloads)
binary-release-asset: release 1.5.0 ships Hero.framework.zip (5474 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 12,468; test lines: 0

Language	Lines
Swift	8,767
JavaScript	3,684
C	17