Hugo-Grellier/SecondChair

Human-directed, AI-operated campaign director for tabletop GMs (PF2e + Foundry first)

https://github.com/Hugo-Grellier/SecondChair · commit 72137366607b · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/Hugo-Grellier/SecondChair
Commit: 72137366607bddc7ffca7b83610d921fbeb077eb
Generated: 2026-11-13T23:18:48+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	100	explicit	95%	100%
Code quality	72	adequate	90%	100%
Security	80	adequate	85%	100%

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

Explicitly attributed share (lower bound): 99.6%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 99.6%

AI tool	Attributed commits	Lines added
Claude Code	172	43,477

AI tooling configured in repo: claude-code, generic-agent

Current source lines last changed by AI-attributed commits: 21,699 of 21,747.

Too few lines in one group to compare finding densities.

Month	Lines added	Attributed to AI
2026-10	43,663	100%

Evidence

Claude Code: message 'Generated with Claude Code' (72137366607b)
Claude Code: message 'Generated with Claude Code' (d171bd9c0f1d)
Claude Code: message 'Generated with Claude Code' (8ecaa0989241)
Claude Code: message 'Generated with Claude Code' (be4d53c8e29b)
Claude Code: message 'Generated with Claude Code' (3c8cb5061b4b)
Claude Code: message 'Generated with Claude Code' (19df48765047)
Claude Code: message 'Generated with Claude Code' (a17e7fd0a108)
Claude Code: message 'Generated with Claude Code' (161dcf09b65d)
Claude Code: message 'Generated with Claude Code' (2957407e1cd9)
Claude Code: message 'Generated with Claude Code' (985150b63fbc)
Claude Code: message 'Generated with Claude Code' (04ff7c06c1f5)
Claude Code: message 'Generated with Claude Code' (bf48df1ea0b8)
Claude Code: message 'Generated with Claude Code' (9a98cf28cb09)
Claude Code: message 'Generated with Claude Code' (754a60487e19)
Claude Code: message 'Generated with Claude Code' (082d6bd7b4a4)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.91, CI runs tests; 30% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	41
Duplication	96
Code smells (Opengrep)	69
Tests and CI	100
Documentation	65
Type safety	1
Process (Scorecard review/maintenance)	n/a

Functions: 1,266; mean complexity 4.8, 90th percentile 11; 70 complex and 9 long functions
Duplicated lines: 0.6% of 17,204 compared
Tests: 19,704 test lines for 21,747 source lines (ratio 0.91); CI test commands: pytest; 100% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is adequate: 6 known vulnerabilities in 3 dependencies; 7 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	97
Static analysis (Opengrep)	76
Vulnerable dependencies (OSV)	79
CI workflows (zizmor)	100
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	n/a

Known vulnerabilities: 6 in 3 packages (critical 0, high 1, medium 3, low 2)
Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates

Top findings

Severity	Finding	Location
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	foundry/secondchair-foundry/scripts/main.js:217
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `content.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	foundry/secondchair-foundry/scripts/main.js:217
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	src/secondchair/bench/harness.py:155
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	src/secondchair/bench/s2.py:55
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	src/secondchair/core/index.py:684
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	src/secondchair/runner.py:174
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	src/secondchair/transcribe.py:201
high	`osv/GHSA-cx6f-vjhg-g3cc`: [email protected] (PyPI) is affected by GHSA-cx6f-vjhg-g3cc	uv.lock
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry-pf2e/scripts/main.js:341
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	foundry/secondchair-foundry/scripts/actions.js:159
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	foundry/secondchair-foundry/scripts/actions.js:190
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	foundry/secondchair-foundry/scripts/actions.js:195
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:145
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:146
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:150
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:161
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:161
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:171
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:180
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:180
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:180
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:181
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:190
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:192
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	foundry/secondchair-foundry/scripts/desk.js:197

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 21,747; test lines: 19,704

Language	Lines
Python	33,583
JavaScript	7,648
TypeScript	220

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Hugo-Grellier/SecondChair/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Hugo-Grellier/SecondChair/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Hugo-Grellier/SecondChair/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Hugo-Grellier/SecondChair/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Hugo-Grellier/SecondChair/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Hugo-Grellier/SecondChair/)