Leaderboard github.com

Maxim-Mazurok/llm-eval-workbench

Local HumanEval benchmark workbench with live results for OpenAI-compatible models.

View repository ↗
TypeScript
★ 1
commit 696ff42c01da
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

explicit

Confidence: 93%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

56/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

66/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

5% explicit

Explicit AI attribution on 5% of first-party code added; an estimated 5% including velocity signals.

How the score is built

Explicitly attributed share5%
Unattributed share in AI-pace bursts30%
Estimated AI-generated share5%
AI tool configuration files2
Work sessions at AI pace4
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.00

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	3	959	2026-08-10	2026-08-11
GitHub Copilot coding agent	3	516	2026-09-10	2026-09-12

Lines added per month all AI-attributed share

2026-068,172 · 0% AI
2026-077,530 · 0% AI
2026-086,997 · 14% AI
2026-096,181 · 8% AI

Findings in AI-attributed lines vs the rest

From git blame: 550 lines trace to AI-attributed commits, 12,735 to others. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	0.00	2.75	0.00×
Security	1.82	0.71	2.57×

Evidence by analyzer

Explicit AI attributionok8 items

Claude Code: 3 attributed commits, 959 lines added
GitHub Copilot coding agent: 3 attributed commits, 516 lines added
GitHub Copilot coding agent: author copilot-swe-agent[bot]
GitHub Copilot coding agent: author copilot-swe-agent[bot]
GitHub Copilot coding agent: author Copilot
Claude Code: author email [email protected]
Claude Code: author email [email protected]
Claude Code: author email [email protected]

attributed_commit_share: 6.4%
attributed_commits: 6
attributed_loc: 1,475
attributed_loc_share: 5.1%
commits: 94
effective_loc: 28,880
tools_detected: 2

AI tool configurationok2 items

artifacts: 2
earliest_adoption: 2026-06-16
tools_configured: 2
workflow_agents: 0

Commit velocityok4 items

excluded_import_loc: 0
flagged_loc: 8,794
flagged_loc_share: 30.5%
flagged_units: 4
max_loc_per_hour: 1,299.83
measured_loc: 28,880
median_loc_per_hour: 111
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 48

Release velocityskipped

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 13,285
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 550
blame_failures: 0
files_blamed: 61
other_lines: 12,735
quality:ai_findings: 0
quality:ai_per_kloc: 0
quality:other_findings: 35
quality:other_per_kloc: 2.75
quality:ratio: 0
security:ai_findings: 1
security:ai_per_kloc: 1.82
security:other_findings: 9
security:other_per_kloc: 0.71
security:ratio: 2.57

Code quality

56 weak

Code quality is weak: test-to-source ratio 0.68, no CI test run detected; 32% of function code in complex or long functions; 5% duplicated lines. Weakest area: complexity.

How the score is built

Complexity38
Duplication75
Lint and smells61
Tests and CI55
Documentation40
Type safety100
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 32
function_nloc: 11,384
functions: 1,152
long_functions: 15
many_param_functions: 0
mean_ccn: 3.24
p90_ccn: 7
risky_nloc_share: 32.1%

Duplication (jscpd)ok10 items

compared_lines: 10,473
duplicated_lines: 499
duplicated_share: 4.8%
files: 61

Lintok

category:best-practice: 1
category:correctness: 34
findings: 35
scanned_lines: 13,285
weighted_findings: 26

Tests and CIok

check:ci_present: no
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: yes
check:test_ratio: yes
check:tests_cochange: yes
ci_files: 0
cochange_commits: 68
cochange_share: 88.2%
source_lines: 13,285
test_lines: 9,014
test_ratio: 0.68

Documentationok1 item

README.md README.md

check:changelog: no
check:contributing: no
check:license: no
check:readme: yes
readme_lines: 334

Type safetyok1 item

TypeScript strict type checking: tsconfig.json tsconfig.json

check:low_escape_density: yes
check:strict_config: yes
escapes: 0
escapes_per_kloc: 0

Security

66 weak

Security posture is weak: 43 known vulnerabilities in 12 dependencies. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)95
Vulnerable dependencies26
CI workflowsnot measured
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 17
declared: 17
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 10
findings_high: 0
findings_low: 2
findings_medium: 8
parse_errors: 1
scanned_lines: 13,285
weighted_findings: 2.12

Dependencies (osv-scanner)ok

penalty: 81
vulnerabilities: 43
vulnerable_packages: 12
vulns_critical: 1
vulns_high: 16
vulns_low: 5
vulns_medium: 21
vulns_unknown: 0

CI workflows (zizmor)skipped

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 0.0%
unpinned_manifests: 0

Release downloadsok1 item

gives an archive password README.md

binary_assets: 0
signals: 1
suspicious: 0

Findings

1 critical16 high52 medium19 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-w7jw-789q-3m8p`	package-lock.json	[email protected] (npm) is affected by GHSA-w7jw-789q-3m8p	Dependencies (osv-scanner)
high	`osv/GHSA-28wg-ghj8-5hjv`	package-lock.json	[email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv	Dependencies (osv-scanner)
high	`osv/GHSA-2m5v-pch6-74hx`	package-lock.json	[email protected] (npm) is affected by GHSA-2m5v-pch6-74hx	Dependencies (osv-scanner)
high	`osv/GHSA-2v37-7h3g-55p8`	package-lock.json	[email protected] (npm) is affected by GHSA-2v37-7h3g-55p8	Dependencies (osv-scanner)
high	`osv/GHSA-395f-4hp3-45gv`	package-lock.json	[email protected] (npm) is affected by GHSA-395f-4hp3-45gv	Dependencies (osv-scanner)
high	`osv/GHSA-4cwx-7wf7-3272`	package-lock.json	[email protected] (npm) is affected by GHSA-4cwx-7wf7-3272	Dependencies (osv-scanner)
high	`osv/GHSA-4w7w-5xrc-9h26`	package-lock.json	[email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26	Dependencies (osv-scanner)
high	`osv/GHSA-587h-7wmj-h5pm`	package-lock.json	[email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	Dependencies (osv-scanner)
high	`osv/GHSA-68fv-2mgg-jv7q`	package-lock.json	[email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q	Dependencies (osv-scanner)
high	`osv/GHSA-73wf-gq98-2v4g`	package-lock.json	[email protected] (npm) is affected by GHSA-73wf-gq98-2v4g	Dependencies (osv-scanner)
high	`osv/GHSA-c83g-rgw3-j3cx`	package-lock.json	[email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx	Dependencies (osv-scanner)
high	`osv/GHSA-mrhx-c7xc-m3w5`	package-lock.json	[email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	Dependencies (osv-scanner)
high	`osv/GHSA-qrxm-fqhp-jwvm`	package-lock.json	[email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm	Dependencies (osv-scanner)
high	`osv/GHSA-r28c-9q8g-f849`	package-lock.json	[email protected] (npm) is affected by GHSA-r28c-9q8g-f849	Dependencies (osv-scanner)
high	`osv/GHSA-rfgv-xxqx-mfg5`	package-lock.json	[email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5	Dependencies (osv-scanner)
high	`osv/GHSA-w293-vg96-wgc3`	package-lock.json	[email protected] (npm) is affected by GHSA-w293-vg96-wgc3	Dependencies (osv-scanner)
high	`osv/GHSA-xjj6-f33q-929c`	package-lock.json	[email protected] (npm) is affected by GHSA-xjj6-f33q-929c	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	scripts/analyze-benchmark-failures.mjs:291	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/migrate-loop-detection.mjs:50	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/migrate-loop-detection.mjs:50	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/migrate-provider-configs.mjs:118	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/migrate-provider-configs.mjs:118	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/reprocess-saved-results.mjs:449	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/reprocess-saved-results.mjs:449	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/benchmarks/bbehEvaluate.mjs:102	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/benchmarks/bbehEvaluate.mjs:102	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/benchmarks/bbehEvaluate.mjs:115	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/benchmarks/bbehEvaluate.mjs:115	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/benchmarks/bbehEvaluate.mjs:122	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/benchmarks/bbehEvaluate.mjs:62	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.best-practice.lazy-load-module`	scripts/server/credentialStore.mjs:52	Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/domain.mjs:301	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/domain.mjs:301	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/domain.mjs:344	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/server/domain.mjs:344	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	scripts/server/runtime.mjs:417	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/update-saved-results.mjs:26	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	scripts/update-saved-results.mjs:26	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	src/domain/prompts.ts:19	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`opengrep/javascript.lang.correctness.no-replaceall`	src/domain/prompts.ts:19	The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, "good")...	Lint
medium	`osv/GHSA-2jfj-6hjv-fm6j`	package-lock.json	[email protected] (npm) is affected by GHSA-2jfj-6hjv-fm6j	Dependencies (osv-scanner)
medium	`osv/GHSA-3wwx-pv8p-q78v`	package-lock.json	[email protected] (npm) is affected by GHSA-3wwx-pv8p-q78v	Dependencies (osv-scanner)
medium	`osv/GHSA-3xpg-4rpp-hhhm`	package-lock.json	[email protected] (npm) is affected by GHSA-3xpg-4rpp-hhhm	Dependencies (osv-scanner)
medium	`osv/GHSA-4qv8-2p9j-2685`	package-lock.json	[email protected] (npm) is affected by GHSA-4qv8-2p9j-2685	Dependencies (osv-scanner)
medium	`osv/GHSA-55wc-3pg8-jfw6`	package-lock.json	[email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6	Dependencies (osv-scanner)
medium	`osv/GHSA-698v-4r3x-3vcv`	package-lock.json	[email protected] (npm) is affected by GHSA-698v-4r3x-3vcv	Dependencies (osv-scanner)
medium	`osv/GHSA-82fw-gwwq-j7x9`	package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9	Dependencies (osv-scanner)
medium	`osv/GHSA-82fw-gwwq-j7x9`	package-lock.json	[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9	Dependencies (osv-scanner)
medium	`osv/GHSA-8xcm-r25x-g524`	package-lock.json	[email protected] (npm) is affected by GHSA-8xcm-r25x-g524	Dependencies (osv-scanner)
medium	`osv/GHSA-9fm3-97px-rjf6`	package-lock.json	[email protected] (npm) is affected by GHSA-9fm3-97px-rjf6	Dependencies (osv-scanner)
medium	`osv/GHSA-f72v-6w45-q472`	package-lock.json	[email protected] (npm) is affected by GHSA-f72v-6w45-q472	Dependencies (osv-scanner)
medium	`osv/GHSA-fxqj-rqcc-2cmp`	package-lock.json	[email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp	Dependencies (osv-scanner)
medium	`osv/GHSA-jr45-8vmc-qm54`	package-lock.json	[email protected] (npm) is affected by GHSA-jr45-8vmc-qm54	Dependencies (osv-scanner)
medium	`osv/GHSA-m8rv-5g2x-5cg5`	package-lock.json	[email protected] (npm) is affected by GHSA-m8rv-5g2x-5cg5	Dependencies (osv-scanner)
medium	`osv/GHSA-pmjh-fq2x-6v4x`	package-lock.json	[email protected] (npm) is affected by GHSA-pmjh-fq2x-6v4x	Dependencies (osv-scanner)
medium	`osv/GHSA-qxg6-89mg-rqv8`	package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8	Dependencies (osv-scanner)
medium	`osv/GHSA-r825-w8mm-5pxw`	package-lock.json	[email protected] (npm) is affected by GHSA-r825-w8mm-5pxw	Dependencies (osv-scanner)
medium	`osv/GHSA-rq7h-c2jc-7f22`	package-lock.json	[email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22	Dependencies (osv-scanner)
medium	`osv/GHSA-rx4f-c7p8-82vq`	package-lock.json	[email protected] (npm) is affected by GHSA-rx4f-c7p8-82vq	Dependencies (osv-scanner)
medium	`osv/GHSA-v3r7-h72x-cjcm`	package-lock.json	[email protected] (npm) is affected by GHSA-v3r7-h72x-cjcm	Dependencies (osv-scanner)
medium	`osv/GHSA-w5vr-8v7q-w6rv`	package-lock.json	[email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.html-in-template-string`	scripts/migrate-provider-configs.mjs:95	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	scripts/server/domain.mjs:94	RegExp() called with a `run` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	scripts/server/lmStudioModel.mjs:82	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	scripts/server/runtimeTestHarness.mjs:55	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/domain/benchmarkMentions.ts:13	RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/domain/comments.ts:131	RegExp() called with a `functionName` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/domain/comments.ts:146	RegExp() called with a `entryPoint` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/domain/comments.ts:146	RegExp() called with a `originalPrompt` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended...	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/reprocess-saved-results.mjs:305	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/reprocess-saved-results.mjs:499	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/reprocess-saved-results.mjs:499	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/server/providerStore.mjs:44	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/server/providerStore.mjs:44	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/server/runtime.mjs:221	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/server/runtime.mjs:221	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/server/testHarness.mjs:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/update-saved-results.mjs:332	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	scripts/update-saved-results.mjs:332	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/domain/passes.ts:10	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/domain/passes.ts:10	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`osv/GHSA-2gqq-gqf2-x968`	package-lock.json	[email protected] (npm) is affected by GHSA-2gqq-gqf2-x968	Dependencies (osv-scanner)
low	`osv/GHSA-8436-99hf-9mmv`	package-lock.json	[email protected] (npm) is affected by GHSA-8436-99hf-9mmv	Dependencies (osv-scanner)
low	`osv/GHSA-9jrq-w75r-8gcw`	package-lock.json	[email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw	Dependencies (osv-scanner)
low	`osv/GHSA-g7r4-m6w7-qqqr`	package-lock.json	[email protected] (npm) is affected by GHSA-g7r4-m6w7-qqqr	Dependencies (osv-scanner)
low	`osv/GHSA-r53p-7pc4-xj5r`	package-lock.json	[email protected] (npm) is affected by GHSA-r53p-7pc4-xj5r	Dependencies (osv-scanner)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	scripts/server/runtime.mjs:2072	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	scripts/server/runtime.mjs:334	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	35
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	skipped	`—`	0
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	43
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	10
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`696ff42c01da`	`prov-5+qual-2+sec-2`	5%	56	66
2026-11-14	`696ff42c01da`	`prov-4+qual-2+sec-2`	5%	56	66

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Maxim-Mazurok/llm-eval-workbench/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Maxim-Mazurok/llm-eval-workbench/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Maxim-Mazurok/llm-eval-workbench/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Maxim-Mazurok/llm-eval-workbench/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Maxim-Mazurok/llm-eval-workbench/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Maxim-Mazurok/llm-eval-workbench/)

Full text report

Repository: https://github.com/Maxim-Mazurok/llm-eval-workbench
Commit: 696ff42c01da5ac878eb6a1695e1a28093b12b48
Generated: 2026-11-14T14:52:01+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	5	explicit	93%	100%
Code quality	56	weak	90%	100%
Security	66	weak	85%	100%

AI provenance

Explicit AI attribution on 5% of first-party code added; an estimated 5% including velocity signals.

Explicitly attributed share (lower bound): 5.1%
Unattributed share in AI-consistent velocity bursts: 30.4%
Estimated AI-generated share: 5.1%

AI tool	Attributed commits	Lines added
Claude Code	3	959
GitHub Copilot coding agent	3	516

AI tooling configured in repo: claude-code, generic-agent

Current source lines last changed by AI-attributed commits: 550 of 13,285.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	0.0	2.748	0.0x
Security	1.818	0.707	2.57x

Month	Lines added	Attributed to AI
2026-06	8,172	0%
2026-07	7,530	0%
2026-08	6,997	14%
2026-09	6,181	8%

Evidence

GitHub Copilot coding agent: author copilot-swe-agent[bot] (70fdb9e1d29e)
GitHub Copilot coding agent: author copilot-swe-agent[bot] (f75b9f1e39bb)
GitHub Copilot coding agent: author Copilot (188f48a15c6f)
Claude Code: author email [email protected] (ad4d5b6de062)
Claude Code: author email [email protected] (1a4dd369d9c1)
Claude Code: author email [email protected] (8cfbbe56ab95)
.claude/launch.json (claude-code configuration) (.claude/laun)
AGENTS.md (generic-agent configuration) (AGENTS.md)
1,723 lines of first-party code in ~1.3h (1,300 lines/hour, 3 commit session) (7870784a2e02)
3,477 lines of first-party code in ~4.0h (869 lines/hour, 1 commit session) (32fef5c63829)
1,072 lines of first-party code in ~1.4h (770 lines/hour, 1 commit session) (4105bacc5eb1)
2,522 lines of first-party code in ~4.6h (550 lines/hour, 2 commit session) (61c32f0ef90f)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.68, no CI test run detected; 32% of function code in complex or long functions; 5% duplicated lines. Weakest area: complexity.

Area	Score
Complexity (lizard)	38
Duplication	75
Code smells (Opengrep)	61
Tests and CI	55
Documentation	40
Type safety	100
Process (Scorecard review/maintenance)	n/a

Functions: 1,152; mean complexity 3.2, 90th percentile 7; 32 complex and 15 long functions
Duplicated lines: 4.8% of 10,473 compared
Tests: 9,014 test lines for 13,285 source lines (ratio 0.68); CI test commands: none detected; 88% of recent source commits also change tests
Docs missing or thin: license, contributing, changelog

Most complex functions:

Security

Security posture is weak: 43 known vulnerabilities in 12 dependencies. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	95
Vulnerable dependencies (OSV)	26
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 43 in 12 packages (critical 1, high 16, medium 21, low 5)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-w7jw-789q-3m8p`: [email protected] (npm) is affected by GHSA-w7jw-789q-3m8p	package-lock.json
high	`osv/GHSA-73wf-gq98-2v4g`: [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g	package-lock.json
high	`osv/GHSA-c83g-rgw3-j3cx`: [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx	package-lock.json
high	`osv/GHSA-28wg-ghj8-5hjv`: [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv	package-lock.json
high	`osv/GHSA-2v37-7h3g-55p8`: [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8	package-lock.json
high	`osv/GHSA-r28c-9q8g-f849`: [email protected] (npm) is affected by GHSA-r28c-9q8g-f849	package-lock.json
high	`osv/GHSA-395f-4hp3-45gv`: [email protected] (npm) is affected by GHSA-395f-4hp3-45gv	package-lock.json
high	`osv/GHSA-68fv-2mgg-jv7q`: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q	package-lock.json
high	`osv/GHSA-2m5v-pch6-74hx`: [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx	package-lock.json
high	`osv/GHSA-4cwx-7wf7-3272`: [email protected] (npm) is affected by GHSA-4cwx-7wf7-3272	package-lock.json
high	`osv/GHSA-4w7w-5xrc-9h26`: [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26	package-lock.json
high	`osv/GHSA-qrxm-fqhp-jwvm`: [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm	package-lock.json
high	`osv/GHSA-rfgv-xxqx-mfg5`: [email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5	package-lock.json
high	`osv/GHSA-w293-vg96-wgc3`: [email protected] (npm) is affected by GHSA-w293-vg96-wgc3	package-lock.json
high	`osv/GHSA-xjj6-f33q-929c`: [email protected] (npm) is affected by GHSA-xjj6-f33q-929c	package-lock.json
high	`osv/GHSA-587h-7wmj-h5pm`: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	package-lock.json
high	`osv/GHSA-mrhx-c7xc-m3w5`: [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	package-lock.json
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	scripts/migrate-provider-configs.mjs:95
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `run` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]	scripts/server/domain.mjs:94
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	scripts/server/lmStudioModel.mjs:82
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	scripts/server/runtimeTestHarness.mjs:55
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]	src/domain/benchmarkMentions.ts:13
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `functionName` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-co [confidence low]	src/domain/comments.ts:131
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `entryPoint` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-cont [confidence low]	src/domain/comments.ts:146
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `originalPrompt` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user- [confidence low]	src/domain/comments.ts:146

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

readme-download-lure: gives an archive password

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 13,285; test lines: 9,014

Language	Lines
JavaScript	11,405
TypeScript	10,894