Leaderboard github.com

LEstradioto/greendefense

Tower Defense GAME (100% Vibe-coded Gaming Experience)

View repository ↗
JavaScript
★ 0
commit cd6befcd1651
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

possible

Confidence: 49%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

51/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

80/100

adequate

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% possible

Weak signals consistent with AI-assisted development.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts28%
Estimated AI-generated share0%
AI tool configuration files1
Work sessions at AI pace2
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.26

Lines added per month all AI-attributed share

2025-0317,097 · 0% AI
2025-045,031 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 34
effective_loc: 22,128
tools_detected: 0

AI tool configurationok1 item

CLAUDE.md (claude-code configuration)

artifacts: 1
earliest_adoption: 2025-03-28
tools_configured: 1
workflow_agents: 0

Commit velocityok2 items

excluded_import_loc: 6,606
flagged_loc: 6,162
flagged_loc_share: 39.7%
flagged_units: 2
max_loc_per_hour: 1,028.81
measured_loc: 15,522
median_loc_per_hour: 336.05
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 15

Release velocityskipped

Coding styleok2 items

count:assistant_voice: 0
count:emoji_in_code: 2
count:narrated_steps: 1
count:placeholder: 1
files:assistant_voice: 0
files:emoji_in_code: 2
files:narrated_steps: 1
files:placeholder: 1
index: 0.26
lines_scanned: 15,252
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.13
per_kloc:narrated_steps: 0.07
per_kloc:placeholder: 0.07

Code quality

51 weak

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 25% of function code in complex or long functions; 5% duplicated lines. Weakest area: testing.

How the score is built

Complexity47
Duplication76
Lint and smells95
Tests and CI0
Documentation85
Type safetynot measured
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 24
function_nloc: 10,047
functions: 612
long_functions: 9
many_param_functions: 6
mean_ccn: 3.81
p90_ccn: 9
risky_nloc_share: 25.2%

Duplication (jscpd)ok10 items

compared_lines: 10,832
duplicated_lines: 490
duplicated_share: 4.5%
files: 19

Lintok

category:best-practice: 2
category:correctness: 4
findings: 6
scanned_lines: 15,252
weighted_findings: 3

Tests and CIok

check:ci_present: no
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: no
check:test_ratio: no
check:tests_cochange: no
ci_files: 0
cochange_commits: 25
cochange_share: 0.0%
source_lines: 15,252
test_lines: 0
test_ratio: 0

Documentationok3 items

README.md README.md
LICENSE LICENSE
HISTORY.md HISTORY.md

check:changelog: yes
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 48

Type safetyskipped

Security

80 adequate

Security posture is adequate: 1 high-severity SAST findings. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)96
Vulnerable dependenciesnot measured
CI workflowsnot measured
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 7
declared: 7
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 2
findings_high: 1
findings_low: 1
findings_medium: 0
parse_errors: 0
scanned_lines: 15,252
weighted_findings: 1.86

Dependencies (osv-scanner)skipped

CI workflows (zizmor)skipped

Security postureok1 item

package.json has no lockfile alongside it (unpinned dependencies) package.json

check:dependency_updates: no
check:lockfiles: no
check:security_policy: no
check:signed_commits: no
signed_commit_share: 2.9%
unpinned_manifests: 1

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

1 high2 medium5 low

Severity	Rule	Location	Message	Tool
high	`opengrep/dockerfile.security.missing-user`	Dockerfile:33	By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.best-practice.javascript-alert`	src/game.js:2133	found alert() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-alert`	src/game.js:2136	found alert() call; should this be in production code?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/renderer.js:2168	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/renderer.js:2168	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/tcg-integration.js:184	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/tcg-integration.js:184	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	src/managers/TowerInstanceManager.js:188	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	6
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	skipped	`—`	0
Dependencies (osv-scanner)	Security	skipped	`—`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	2
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`cd6befcd1651`	`prov-5+qual-2+sec-2`	0%	51	80
2026-11-14	`cd6befcd1651`	`prov-4+qual-2+sec-2`	0%	51	80

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/LEstradioto/greendefense/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/LEstradioto/greendefense/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/LEstradioto/greendefense/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/LEstradioto/greendefense/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/LEstradioto/greendefense/security.svg)](https://repotrust.synapticcyber.com/r/github.com/LEstradioto/greendefense/)

Full text report

Repository: https://github.com/LEstradioto/greendefense
Commit: cd6befcd165150199b07492a57294f7bab178cc5
Generated: 2026-11-14T14:52:00+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	49%	100%
Code quality	51	weak	90%	100%
Security	80	adequate	85%	100%

AI provenance

Weak signals consistent with AI-assisted development.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 27.9%
Estimated AI-generated share: 0.0%
AI tooling configured in repo: claude-code
Stylometry index: 0.26 per 1,000 lines (narrated steps 1, placeholders 1, assistant phrasing 0, emoji 2). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2025-03	17,097	0%
2025-04	5,031	0%

Evidence

CLAUDE.md (claude-code configuration) (CLAUDE.md)
4,267 lines of first-party code in ~4.1h (1,029 lines/hour, 3 commit session) (cd6befcd1651)
1,895 lines of first-party code in ~2.2h (878 lines/hour, 1 commit session) (5c2ebd17e8b9)
placeholder or demo-only phrasing: // In a real implementation, this would draw from the player's shuffled deck (src/tcg-inte)
step-by-step narration comment: // First, remove the old preview (src/ui.js:47)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 25% of function code in complex or long functions; 5% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	47
Duplication	76
Code smells (Opengrep)	95
Tests and CI	0
Documentation	85
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 612; mean complexity 3.8, 90th percentile 9; 24 complex and 9 long functions
Duplicated lines: 4.5% of 10,832 compared
Tests: 0 test lines for 15,252 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: contributing

Most complex functions:

Security

Security posture is adequate: 1 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	96
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Severity	Finding	Location
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	Dockerfile:33
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`: Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]	src/managers/TowerInstanceManager.js:188

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 15,252; test lines: 0

Language	Lines
JavaScript	15,252