RepoTrust

Leaderboard github.com

Leksat/mp

  • View repository ↗
  • TypeScript
  • ★ 0
  • commit 8ba0bf571874
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

possible

Confidence
51%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

72/100

adequate

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

66/100

weak

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

0% possible

Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence).

How the score is built

  • Explicitly attributed share0%
  • Unattributed share in AI-pace bursts0%
  • Estimated AI-generated share0%
  • AI tool configuration files1
  • Work sessions at AI pace0
  • Releases at AI pacenot measured
  • Coding-style index (1.0+ means possible)2.41

Lines added per month all AI-attributed share

  1. 2026-093,382 · 0% AI
  2. 2026-10281 · 0% AI

Evidence by analyzer

Explicit AI attributionok
attributed_commit_share
0.0%
attributed_commits
0
attributed_loc
0
attributed_loc_share
0.0%
commits
43
effective_loc
3,663
tools_detected
0
AI tool configurationok1 item
artifacts
1
earliest_adoption
2026-09-21
tools_configured
1
workflow_agents
0
Commit velocityok
excluded_import_loc
0
flagged_loc
0
flagged_loc_share
0.0%
flagged_units
0
max_loc_per_hour
199.14
measured_loc
3,663
median_loc_per_hour
70.25
pr_timed_units
0
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
11
Release velocityskipped
Coding styleok
count:assistant_voice
0
count:emoji_in_code
11
count:narrated_steps
0
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
1
files:narrated_steps
0
files:placeholder
0
index
2.41
lines_scanned
2,283
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
4.82
per_kloc:narrated_steps
0
per_kloc:placeholder
0

Code quality

72 adequate

Code quality is adequate: test-to-source ratio 0.24, no CI test run detected; 0% of function code in complex or long functions; 1% duplicated lines. Weakest area: docs.

How the score is built

  • Complexity100
  • Duplication95
  • Lint and smells80
  • Tests and CI57
  • Documentation20
  • Type safety40
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok
complex_functions
0
function_nloc
1,140
functions
232
long_functions
0
many_param_functions
0
mean_ccn
1.47
p90_ccn
3
risky_nloc_share
0.0%
Duplication (jscpd)ok1 item
compared_lines
1,471
duplicated_lines
12
duplicated_share
0.8%
files
49
Lintok
category:best-practice
2
findings
2
scanned_lines
2,283
weighted_findings
2
Tests and CIok1 item
  • CI config: .github/workflows/deploy.yml .github/workflows/deploy.yml
check:ci_present
yes
check:ci_runs_lint
no
check:ci_runs_tests
no
check:has_tests
yes
check:test_ratio
no
check:tests_cochange
yes
ci_files
1
cochange_commits
37
cochange_share
29.7%
source_lines
2,283
test_lines
538
test_ratio
0.24
Documentationok1 item
  • README.md README.md
check:changelog
no
check:contributing
no
check:license
no
check:readme
no
readme_lines
3
Type safetyok
check:low_escape_density
yes
check:strict_config
no
escapes
0
escapes_per_kloc
0

Security

66 weak

Security posture is weak: 21 known vulnerabilities in 10 dependencies; 6 high-severity workflow issues. Weakest area: posture.

How the score is built

  • Secrets100
  • Static analysis (SAST)96
  • Vulnerable dependencies44
  • CI workflows30
  • Security posture20
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
14
declared
14
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
1
findings_high
0
findings_low
0
findings_medium
1
parse_errors
0
scanned_lines
2,283
weighted_findings
0.25
Dependencies (osv-scanner)ok
penalty
50
vulnerabilities
21
vulnerable_packages
10
vulns_critical
1
vulns_high
3
vulns_low
5
vulns_medium
12
vulns_unknown
0
CI workflows (zizmor)ok
findings
7
findings_high
6
findings_low
0
findings_medium
1
penalty
73.20
workflows
1
Security postureok
check:dependency_updates
no
check:lockfiles
yes
check:security_policy
no
check:signed_commits
yes
signed_commit_share
100.0%
unpinned_manifests
0
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

1 critical9 high16 medium5 low

SeverityRuleLocationMessageTool
critical osv/GHSA-f2ph-cmg5-wxc8 package-lock.json [email protected] (npm) is affected by GHSA-f2ph-cmg5-wxc8 Dependencies (osv-scanner)
high zizmor/excessive-permissions .github/workflows/deploy.yml:16 overly broad permissions [confidence high] CI workflows (zizmor)
high zizmor/excessive-permissions .github/workflows/deploy.yml:17 overly broad permissions [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/deploy.yml:27 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/deploy.yml:28 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/deploy.yml:34 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/deploy.yml:46 unpinned action reference [confidence high] CI workflows (zizmor)
high osv/GHSA-587h-7wmj-h5pm package-lock.json [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm Dependencies (osv-scanner)
high osv/GHSA-68fv-2mgg-jv7q package-lock.json [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q Dependencies (osv-scanner)
high osv/GHSA-px85-f4q5-jh77 package-lock.json [email protected] (npm) is affected by GHSA-px85-f4q5-jh77 Dependencies (osv-scanner)
medium opengrep/typescript.react.best-practice.react-props-spreading src/components/icons.tsx:14 It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious... Lint
medium opengrep/typescript.react.best-practice.react-props-in-state src/useDrill.ts:39 Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state. Lint
medium zizmor/artipacked .github/workflows/deploy.yml:27 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium osv/GHSA-3g3m-2fjr-6pw4 package-lock.json [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 Dependencies (osv-scanner)
medium osv/GHSA-3g3m-2fjr-6pw4 package-lock.json [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 Dependencies (osv-scanner)
medium osv/GHSA-698v-4r3x-3vcv package-lock.json [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 package-lock.json [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-gcqx-w48m-w2h4 package-lock.json [email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4 Dependencies (osv-scanner)
medium osv/GHSA-qxg6-89mg-rqv8 package-lock.json @vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8 Dependencies (osv-scanner)
medium osv/GHSA-r825-w8mm-5pxw package-lock.json [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw Dependencies (osv-scanner)
medium osv/GHSA-rq7h-c2jc-7f22 package-lock.json [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 Dependencies (osv-scanner)
medium osv/GHSA-vfpm-58rq-9qcg package-lock.json [email protected] (npm) is affected by GHSA-vfpm-58rq-9qcg Dependencies (osv-scanner)
medium osv/GHSA-w74x-v6f9-j3xg package-lock.json [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg Dependencies (osv-scanner)
medium osv/GHSA-wjr9-j795-jxcr package-lock.json [email protected] (npm) is affected by GHSA-wjr9-j795-jxcr Dependencies (osv-scanner)
medium osv/GHSA-xp26-3454-mjgp package-lock.json @vitest/[email protected] (npm) is affected by GHSA-xp26-3454-mjgp Dependencies (osv-scanner)
medium opengrep/javascript.lang.security.html-in-template-string scripts/generate-icons.mjs:102 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
low osv/GHSA-333x-w4r6-6crp package-lock.json [email protected] (npm) is affected by GHSA-333x-w4r6-6crp Dependencies (osv-scanner)
low osv/GHSA-9jrq-w75r-8gcw package-lock.json [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw Dependencies (osv-scanner)
low osv/GHSA-gfhx-hw2g-v5hg package-lock.json [email protected] (npm) is affected by GHSA-gfhx-hw2g-v5hg Dependencies (osv-scanner)
low osv/GHSA-m5mm-p8h7-m29v package-lock.json [email protected] (npm) is affected by GHSA-m5mm-p8h7-m29v Dependencies (osv-scanner)
low osv/GHSA-xhq7-xmqj-769h package-lock.json [email protected] (npm) is affected by GHSA-xhq7-xmqj-769h Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceskipped—0
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-40
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b4142
Tests and CICode qualityok—0
Type safetyCode qualityok—0
CI workflows (zizmor)Securityokzizmor 1.32.07
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.121
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b4141
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

Scores from different scoring versions aren't directly comparable.

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-148ba0bf571874prov-5+qual-2+sec-20%7266
2026-11-148ba0bf571874prov-4+qual-2+sec-20%7266

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Leksat/mp/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Leksat/mp/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Leksat/mp/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Leksat/mp/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Leksat/mp/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Leksat/mp/)
Full text report
  • Repository: https://github.com/Leksat/mp
  • Commit: 8ba0bf5718743686e6cda9b4cecf3783b6690b13
  • Generated: 2026-11-14T14:52:00+00:00
  • Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 possible 51% 100%
Code quality 72 adequate 90% 100%
Security 66 weak 85% 100%

AI provenance

Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence).

  • Explicitly attributed share (lower bound): 0.0%

  • Unattributed share in AI-consistent velocity bursts: 0.0%

  • Estimated AI-generated share: 0.0%

  • AI tooling configured in repo: claude-code

  • Stylometry index: 2.41 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 11). Reported as a signal, not scored.

Month Lines added Attributed to AI
2026-09 3,382 0%
2026-10 281 0%

Evidence

  • CLAUDE.md (claude-code configuration) (CLAUDE.md)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.24, no CI test run detected; 0% of function code in complex or long functions; 1% duplicated lines. Weakest area: docs.

Area Score
Complexity (lizard) 100
Duplication 95
Code smells (Opengrep) 80
Tests and CI 57
Documentation 20
Type safety 40
Process (Scorecard review/maintenance) n/a
  • Functions: 232; mean complexity 1.5, 90th percentile 3; 0 complex and 0 long functions
  • Duplicated lines: 0.8% of 1,471 compared
  • Tests: 538 test lines for 2,283 source lines (ratio 0.24); CI test commands: none detected; 30% of recent source commits also change tests
  • Docs missing or thin: readme, license, contributing, changelog

Security

Security posture is weak: 21 known vulnerabilities in 10 dependencies; 6 high-severity workflow issues. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 96
Vulnerable dependencies (OSV) 44
CI workflows (zizmor) 30
Posture (policy, updates, signing, lockfiles) 20
OpenSSF Scorecard n/a

  • Known vulnerabilities: 21 in 10 packages (critical 1, high 3, medium 12, low 5)

  • Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates

Top findings

Severity Finding Location
critical osv/GHSA-f2ph-cmg5-wxc8: [email protected] (npm) is affected by GHSA-f2ph-cmg5-wxc8 package-lock.json
high osv/GHSA-68fv-2mgg-jv7q: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q package-lock.json
high osv/GHSA-px85-f4q5-jh77: [email protected] (npm) is affected by GHSA-px85-f4q5-jh77 package-lock.json
high osv/GHSA-587h-7wmj-h5pm: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm package-lock.json
high zizmor/excessive-permissions: overly broad permissions [confidence high] .github/workflows/deploy.yml:16
high zizmor/excessive-permissions: overly broad permissions [confidence high] .github/workflows/deploy.yml:17
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/deploy.yml:27
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/deploy.yml:28
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/deploy.yml:34
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/deploy.yml:46
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] scripts/generate-icons.mjs:102
medium osv/GHSA-qxg6-89mg-rqv8: @vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8 package-lock.json
medium osv/GHSA-xp26-3454-mjgp: @vitest/[email protected] (npm) is affected by GHSA-xp26-3454-mjgp package-lock.json
medium osv/GHSA-gcqx-w48m-w2h4: [email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4 package-lock.json
medium osv/GHSA-w74x-v6f9-j3xg: [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg package-lock.json
medium osv/GHSA-wjr9-j795-jxcr: [email protected] (npm) is affected by GHSA-wjr9-j795-jxcr package-lock.json
medium osv/GHSA-3g3m-2fjr-6pw4: [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 package-lock.json
medium osv/GHSA-3g3m-2fjr-6pw4: [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 package-lock.json
medium osv/GHSA-g3hv-75wg-m249: [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 package-lock.json
medium osv/GHSA-698v-4r3x-3vcv: [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv package-lock.json
medium osv/GHSA-r825-w8mm-5pxw: [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw package-lock.json
medium osv/GHSA-rq7h-c2jc-7f22: [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 package-lock.json
medium osv/GHSA-vfpm-58rq-9qcg: [email protected] (npm) is affected by GHSA-vfpm-58rq-9qcg package-lock.json
medium zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] .github/workflows/deploy.yml:27
low osv/GHSA-333x-w4r6-6crp: [email protected] (npm) is affected by GHSA-333x-w4r6-6crp package-lock.json

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 2,283; test lines: 538
Language Lines
TypeScript 2,713
JavaScript 108