Leaderboard github.com
Ovid/tramp-freighter
Not Firefly.
AI provenance
19%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
65/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
60/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
19% explicit
Explicit AI attribution on 19% of first-party code added; an estimated 19% including velocity signals.
How the score is built
- Explicitly attributed share19%
- Unattributed share in AI-pace bursts55%
- Estimated AI-generated share19%
- AI tool configuration files4
- Work sessions at AI pace43
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)0.27
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 638 | 48,068 | 2026-02-18 | 2026-05-20 |
| GitHub Copilot coding agent | 2 | 0 | 2026-02-19 | 2026-02-19 |
Lines added per month all AI-attributed share
- 2025-12162,391 · 0% AI
- 2026-0234,217 · 97% AI
- 2026-0350,107 · 29% AI
- 2026-042,222 · 8% AI
- 2026-052 · 100% AI
- 2026-060 · 0% AI
Findings in AI-attributed lines vs the rest
From git blame: 11,803 lines trace to AI-attributed commits, 31,102 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.03 | 0.00× |
| Security | 0.00 | 0.35 | 0.00× |
Evidence by analyzer
Explicit AI attributionok27 items
- Claude Code: 638 attributed commits, 48,068 lines added
- GitHub Copilot coding agent: 2 attributed commits, 0 lines added
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 35.0%
- attributed_commits
- 640
- attributed_loc
- 48,068
- attributed_loc_share
- 19.3%
- commits
- 1,827
- effective_loc
- 248,939
- tools_detected
- 2
AI tool configurationok4 items
- .claude/skills/ovid-uat/SKILL.md (claude-code configuration)
- CLAUDE.md (claude-code configuration)
- AGENTS.md (generic-agent configuration)
- .github/copilot-instructions.md (github-copilot configuration)
- artifacts
- 4
- earliest_adoption
- 2025-12-27
- tools_configured
- 3
- workflow_agents
- 0
Commit velocityok15 items
- 12,841 lines of first-party code in ~3.4h (3,801 lines/hour, 11 commit session)
- 3,853 lines of first-party code in ~1.3h (2,950 lines/hour, 2 commit session)
- 3,706 lines of first-party code in ~1.6h (2,383 lines/hour, 5 commit session)
- 6,885 lines of first-party code in ~3.0h (2,301 lines/hour, 12 commit session)
- 1,708 lines of first-party code in ~1.0h (1,657 lines/hour, 2 commit session)
- 1,700 lines of first-party code in ~1.0h (1,630 lines/hour, 5 commit session)
- 4,162 lines of first-party code in ~2.8h (1,507 lines/hour, 17 commit session)
- 5,408 lines of first-party code in ~3.6h (1,504 lines/hour, 15 commit session)
- 1,435 lines of first-party code in ~1.0h (1,439 lines/hour, 3 commit session)
- 1,540 lines of first-party code in ~1.1h (1,439 lines/hour, 2 commit session)
- 3,631 lines of first-party code in ~2.6h (1,376 lines/hour, 11 commit session)
- 1,393 lines of first-party code in ~1.0h (1,361 lines/hour, 1 commit session)
- 3,530 lines of first-party code in ~2.6h (1,352 lines/hour, 11 commit session)
- 2,685 lines of first-party code in ~2.0h (1,343 lines/hour, 6 commit session)
- 4,534 lines of first-party code in ~3.5h (1,288 lines/hour, 13 commit session)
- excluded_import_loc
- 20,165
- flagged_loc
- 158,685
- flagged_loc_share
- 69.4%
- flagged_units
- 43
- max_loc_per_hour
- 3,800.99
- measured_loc
- 228,774
- median_loc_per_hour
- 312.43
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 170
Release velocityskipped
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 23
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 7
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0.27
- lines_scanned
- 42,905
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.54
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 11,803
- blame_failures
- 0
- files_blamed
- 176
- other_lines
- 31,102
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 1
- quality:other_per_kloc
- 0.03
- quality:ratio
- 0
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 11
- security:other_per_kloc
- 0.35
- security:ratio
- 0
Code quality
65 adequate
Code quality is adequate: test-to-source ratio 2.02, no CI test run detected; 24% of function code in complex or long functions; 6% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity48
- Duplication71
- Lint and smells99
- Tests and CI55
- Documentation65
- Type safetynot measured
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- validateStateStructure in src/game/state/state-validators.js: complexity 88, 201 lines
- addStateDefaults in src/game/state/state-validators.js: complexity 48, 219 lines
- completeMission in src/game/state/managers/mission.js: complexity 38, 161 lines
- App in src/App.jsx: complexity 35, 233 lines
- applyEncounterOutcome in src/features/danger/applyEncounterOutcome.js: complexity 34, 155 lines
- DistressCallPanel in src/features/danger/DistressCallPanel.jsx: complexity 32, 245 lines
- evaluateCondition in src/game/event-conditions.js: complexity 31, 68 lines
- TradePanel in src/features/trade/TradePanel.jsx: complexity 28, 229 lines
- MechanicalFailurePanel in src/features/danger/MechanicalFailurePanel.jsx: complexity 26, 254 lines
- DangerWarningDialog in src/features/danger/DangerWarningDialog.jsx: complexity 25, 153 lines
- complex_functions
- 30
- function_nloc
- 21,972
- functions
- 2,047
- long_functions
- 21
- many_param_functions
- 4
- mean_ccn
- 2.56
- p90_ccn
- 5
- risky_nloc_share
- 24.4%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: eslint.config.mjs:29 and eslint.config.mjs:69
- 6+ duplicated lines: src/features/cargo/CargoManifestPanel.jsx:171 and src/features/danger/MechanicalFailurePanel.jsx:374
- 6+ duplicated lines: src/features/danger/CombatPanel.jsx:36 and src/features/danger/PirateEncounterPanel.jsx:37
- 6+ duplicated lines: src/features/danger/CombatPanel.jsx:53 and src/features/danger/CombatPanel.jsx:65
- 6+ duplicated lines: src/features/danger/CombatPanel.jsx:78 and src/features/danger/MechanicalFailurePanel.jsx:34
- 6+ duplicated lines: src/features/danger/CombatPanel.jsx:456 and src/features/danger/InspectionPanel.jsx:380
- 6+ duplicated lines: src/features/danger/CombatPanel.jsx:457 and src/features/danger/NegotiationPanel.jsx:359
- 6+ duplicated lines: src/features/danger/DistressCallPanel.jsx:482 and src/features/danger/InspectionPanel.jsx:431
- 6+ duplicated lines: src/features/danger/InspectionPanel.jsx:82 and src/features/danger/MechanicalFailurePanel.jsx:78
- 6+ duplicated lines: src/features/danger/InspectionPanel.jsx:329 and src/features/danger/NegotiationPanel.jsx:284
- compared_lines
- 29,579
- duplicated_lines
- 1,714
- duplicated_share
- 5.8%
- files
- 176
Lintok
- category:best-practice
- 1
- findings
- 1
- scanned_lines
- 42,905
- weighted_findings
- 1
Tests and CIok
- check:ci_present
- no
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 0
- cochange_commits
- 175
- cochange_share
- 41.1%
- source_lines
- 42,905
- test_lines
- 86,696
- test_ratio
- 2.02
Documentationok2 items
- README.md
README.md - LICENSE.md
LICENSE.md
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 54
Type safetyskipped
Security
60 weak
Security posture is weak: 60 known vulnerabilities in 25 dependencies. Weakest area: posture.
How the score is built
- Secrets97
- Static analysis (SAST)99
- Vulnerable dependencies5
- CI workflowsnot measured
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 20
- declared
- 20
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 1
Static analysis (opengrep)ok
- findings
- 11
- findings_high
- 0
- findings_low
- 8
- findings_medium
- 3
- parse_errors
- 0
- scanned_lines
- 42,905
- weighted_findings
- 1.25
Dependencies (osv-scanner)ok
- penalty
- 177
- vulnerabilities
- 60
- vulnerable_packages
- 25
- vulns_critical
- 3
- vulns_high
- 29
- vulns_low
- 3
- vulns_medium
- 25
- vulns_unknown
- 0
CI workflows (zizmor)skipped
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 1.0%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
3 critical29 high29 medium12 low
73 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-5gmw-xhrv-c9v3 |
package-lock.json | [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3 | Dependencies (osv-scanner) |
| critical | osv/GHSA-5xrq-8626-4rwp |
package-lock.json | [email protected] (npm) is affected by GHSA-5xrq-8626-4rwp | Dependencies (osv-scanner) |
| critical | osv/GHSA-85c8-ppgw-ccpr |
package-lock.json | [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr | Dependencies (osv-scanner) |
| high | osv/GHSA-23c5-xmqv-rm74 |
package-lock.json | [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 | Dependencies (osv-scanner) |
| high | osv/GHSA-25h7-pfq9-p65f |
package-lock.json | [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
package-lock.json | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-28wg-ghj8-5hjv |
package-lock.json | [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv | Dependencies (osv-scanner) |
| high | osv/GHSA-2v37-7h3g-55p8 |
package-lock.json | [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
package-lock.json | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp | Dependencies (osv-scanner) |
| high | osv/GHSA-3ppc-4f35-3m26 |
package-lock.json | [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 | Dependencies (osv-scanner) |
| high | osv/GHSA-52cp-r559-cp3m |
package-lock.json | [email protected] (npm) is affected by GHSA-52cp-r559-cp3m | Dependencies (osv-scanner) |
| high | osv/GHSA-587h-7wmj-h5pm |
package-lock.json | [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
package-lock.json | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj | Dependencies (osv-scanner) |
| high | osv/GHSA-68fv-2mgg-jv7q |
package-lock.json | [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q | Dependencies (osv-scanner) |
| high | osv/GHSA-6g55-p6wh-862q |
package-lock.json | [email protected] (npm) is affected by GHSA-6g55-p6wh-862q | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-73wf-gq98-2v4g |
package-lock.json | [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g | Dependencies (osv-scanner) |
| high | osv/GHSA-7r86-cg39-jmmj |
package-lock.json | [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj | Dependencies (osv-scanner) |
| high | osv/GHSA-7w5x-hrqm-74c2 |
package-lock.json | [email protected] (npm) is affected by GHSA-7w5x-hrqm-74c2 | Dependencies (osv-scanner) |
| high | osv/GHSA-96hv-2xvq-fx4p |
package-lock.json | [email protected] (npm) is affected by GHSA-96hv-2xvq-fx4p | Dependencies (osv-scanner) |
| high | osv/GHSA-c2c7-rcm5-vvqj |
package-lock.json | [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj | Dependencies (osv-scanner) |
| high | osv/GHSA-c2c7-rcm5-vvqj |
package-lock.json | [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj | Dependencies (osv-scanner) |
| high | osv/GHSA-c83g-rgw3-j3cx |
package-lock.json | [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx | Dependencies (osv-scanner) |
| high | osv/GHSA-hmw2-7cc7-3qxx |
package-lock.json | [email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
package-lock.json | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-mrhx-c7xc-m3w5 |
package-lock.json | [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 | Dependencies (osv-scanner) |
| high | osv/GHSA-mw96-cpmx-2vgc |
package-lock.json | [email protected] (npm) is affected by GHSA-mw96-cpmx-2vgc | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-r28c-9q8g-f849 |
package-lock.json | [email protected] (npm) is affected by GHSA-r28c-9q8g-f849 | Dependencies (osv-scanner) |
| high | osv/GHSA-rf6f-7fwh-wjgh |
package-lock.json | [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
package-lock.json | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| high | osv/GHSA-xwg4-73v4-xw9w |
package-lock.json | [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.best-practice.javascript-confirm |
src/main.jsx:115 | found confirm() call; should this be in production code? | Lint |
| medium | osv/GHSA-2g4f-4pwh-qvx6 |
package-lock.json | [email protected] (npm) is affected by GHSA-2g4f-4pwh-qvx6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3v7f-55p6-f55p |
package-lock.json | [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p | Dependencies (osv-scanner) |
| medium | osv/GHSA-3v7f-55p6-f55p |
package-lock.json | [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p | Dependencies (osv-scanner) |
| medium | osv/GHSA-4mjr-xmp4-gh2g |
package-lock.json | [email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g | Dependencies (osv-scanner) |
| medium | osv/GHSA-4w7w-66w2-5vf9 |
package-lock.json | [email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-58qx-3vcg-4xpx |
package-lock.json | [email protected] (npm) is affected by GHSA-58qx-3vcg-4xpx | Dependencies (osv-scanner) |
| medium | osv/GHSA-67mh-4wv8-2f99 |
package-lock.json | [email protected] (npm) is affected by GHSA-67mh-4wv8-2f99 | Dependencies (osv-scanner) |
| medium | osv/GHSA-698v-4r3x-3vcv |
package-lock.json | [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-6pq8-jhm2-2vcw |
package-lock.json | [email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw | Dependencies (osv-scanner) |
| medium | osv/GHSA-6rw7-vpxm-498p |
package-lock.json | [email protected] (npm) is affected by GHSA-6rw7-vpxm-498p | Dependencies (osv-scanner) |
| medium | osv/GHSA-f886-m6hf-6m8v |
package-lock.json | [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v | Dependencies (osv-scanner) |
| medium | osv/GHSA-fx2h-pf6j-xcff |
package-lock.json | [email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff | Dependencies (osv-scanner) |
| medium | osv/GHSA-fxqj-rqcc-2cmp |
package-lock.json | [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp | Dependencies (osv-scanner) |
| medium | osv/GHSA-h67p-54hq-rp68 |
package-lock.json | [email protected] (npm) is affected by GHSA-h67p-54hq-rp68 | Dependencies (osv-scanner) |
| medium | osv/GHSA-p498-v437-472g |
package-lock.json | @humanfs/[email protected] (npm) is affected by GHSA-p498-v437-472g | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-q8mj-m7cp-5q26 |
package-lock.json | [email protected] (npm) is affected by GHSA-q8mj-m7cp-5q26 | Dependencies (osv-scanner) |
| medium | osv/GHSA-qx2v-qp2m-jg93 |
package-lock.json | [email protected] (npm) is affected by GHSA-qx2v-qp2m-jg93 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r4q5-vmmm-2653 |
package-lock.json | [email protected] (npm) is affected by GHSA-r4q5-vmmm-2653 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r4xh-jqrq-34v2 |
package-lock.json | [email protected] (npm) is affected by GHSA-r4xh-jqrq-34v2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-r825-w8mm-5pxw |
package-lock.json | [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw | Dependencies (osv-scanner) |
| medium | osv/GHSA-rq7h-c2jc-7f22 |
package-lock.json | [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 | Dependencies (osv-scanner) |
| medium | osv/GHSA-v3rj-xjv7-4jmq |
package-lock.json | [email protected] (npm) is affected by GHSA-v3rj-xjv7-4jmq | Dependencies (osv-scanner) |
| medium | osv/GHSA-v6wh-96g9-6wx3 |
package-lock.json | [email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w5vr-8v7q-w6rv |
package-lock.json | [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
src/features/navigation/CameraControls.jsx:97 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment |
src/game/state/managers/trading.js:221 | Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method |
src/hooks/useGameEvent.js:79 | Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] | Static analysis (opengrep) |
| low | gitleaks/generic-api-key |
js/vendor/three/examples/jsm/libs/chevrotain.module.min.js:84 | Possible generic-api-key secret in history (commit b2ea69c2cb); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | osv/GHSA-4x5r-pxfx-6jf8 |
package-lock.json | @babel/[email protected] (npm) is affected by GHSA-4x5r-pxfx-6jf8 | Dependencies (osv-scanner) |
| low | osv/GHSA-9jrq-w75r-8gcw |
package-lock.json | [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw | Dependencies (osv-scanner) |
| low | osv/GHSA-w7fw-mjwx-w883 |
package-lock.json | [email protected] (npm) is affected by GHSA-w7fw-mjwx-w883 | Dependencies (osv-scanner) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
src/features/dev-admin/DevPanelPreview.jsx:43 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
src/game/game-dialogue.js:196 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
src/game/game-dialogue.js:323 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
src/game/game-dialogue.js:330 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
src/game/state/managers/base-manager.js:40 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
src/game/state/managers/base-manager.js:50 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
src/game/state/managers/base-manager.js:59 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
src/game/state/managers/event-system.js:98 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 1 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | skipped | — | 0 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 60 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 11 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 1 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | c63dee38ca79 | prov-5+qual-2+sec-2 | 19% | 65 | 60 |
| 2026-11-14 | c63dee38ca79 | prov-4+qual-2+sec-2 | 19% | 65 | 60 |
Full text report
- Repository: https://github.com/Ovid/tramp-freighter
- Commit:
c63dee38ca794d83de0d331179ab3888acad8bf7 - Generated: 2026-11-14T14:52:01+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 19 | explicit | 95% | 100% |
| Code quality | 65 | adequate | 90% | 100% |
| Security | 60 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 19% of first-party code added; an estimated 19% including velocity signals.
- Explicitly attributed share (lower bound): 19.3%
- Unattributed share in AI-consistent velocity bursts: 54.9%
- Estimated AI-generated share: 19.3%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 638 | 48,068 |
| GitHub Copilot coding agent | 2 | 0 |
- AI tooling configured in repo: claude-code, generic-agent, github-copilot
Current source lines last changed by AI-attributed commits: 11,803 of 42,905.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.032 | 0.0x |
| Security | 0.0 | 0.354 | 0.0x |
- Stylometry index: 0.27 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 23). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 162,391 | 0% |
| 2026-02 | 34,217 | 97% |
| 2026-03 | 50,107 | 29% |
| 2026-04 | 2,222 | 8% |
| 2026-05 | 2 | 100% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (89f6be33e2d8)
- Claude Code: trailer 'Co-Authored-By: Claude' (b11eb8e65490)
- Claude Code: trailer 'Co-Authored-By: Claude' (d6957462a398)
- Claude Code: trailer 'Co-Authored-By: Claude' (4abf92c84b04)
- Claude Code: trailer 'Co-Authored-By: Claude' (8597fcd2d344)
- Claude Code: trailer 'Co-Authored-By: Claude' (ab4c094febe1)
- Claude Code: trailer 'Co-Authored-By: Claude' (d9e67eaffdae)
- Claude Code: trailer 'Co-Authored-By: Claude' (de20b5655355)
- Claude Code: trailer 'Co-Authored-By: Claude' (e6c1f33c86ed)
- Claude Code: trailer 'Co-Authored-By: Claude' (1d7cf7926802)
- Claude Code: trailer 'Co-Authored-By: Claude' (0e29d6c1e9e7)
- Claude Code: trailer 'Co-Authored-By: Claude' (46aa302252d7)
- Claude Code: trailer 'Co-Authored-By: Claude' (a77e91f84c85)
- Claude Code: trailer 'Co-Authored-By: Claude' (bca12855defa)
- Claude Code: trailer 'Co-Authored-By: Claude' (a416987ee78e)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 2.02, no CI test run detected; 24% of function code in complex or long functions; 6% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 48 |
| Duplication | 71 |
| Code smells (Opengrep) | 99 |
| Tests and CI | 55 |
| Documentation | 65 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,047; mean complexity 2.6, 90th percentile 5; 30 complex and 21 long functions
- Duplicated lines: 5.8% of 29,579 compared
- Tests: 86,696 test lines for 42,905 source lines (ratio 2.02); CI test commands: none detected; 41% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- validateStateStructure in src/game/state/state-validators.js: complexity 88, 201 lines
- addStateDefaults in src/game/state/state-validators.js: complexity 48, 219 lines
- completeMission in src/game/state/managers/mission.js: complexity 38, 161 lines
- App in src/App.jsx: complexity 35, 233 lines
- applyEncounterOutcome in src/features/danger/applyEncounterOutcome.js: complexity 34, 155 lines
Security
Security posture is weak: 60 known vulnerabilities in 25 dependencies. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 99 |
| Vulnerable dependencies (OSV) | 5 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 60 in 25 packages (critical 3, high 29, medium 25, low 3)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-5gmw-xhrv-c9v3: [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3 |
package-lock.json |
| critical | osv/GHSA-85c8-ppgw-ccpr: [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr |
package-lock.json |
| critical | osv/GHSA-5xrq-8626-4rwp: [email protected] (npm) is affected by GHSA-5xrq-8626-4rwp |
package-lock.json |
| high | osv/GHSA-3jxr-9vmj-r5cp: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp |
package-lock.json |
| high | osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p |
package-lock.json |
| high | osv/GHSA-mh99-v99m-4gvg: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg |
package-lock.json |
| high | osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 |
package-lock.json |
| high | osv/GHSA-rgw5-rvv9-x895: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 |
package-lock.json |
| high | osv/GHSA-73wf-gq98-2v4g: [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g |
package-lock.json |
| high | osv/GHSA-c83g-rgw3-j3cx: [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx |
package-lock.json |
| high | osv/GHSA-25h7-pfq9-p65f: [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f |
package-lock.json |
| high | osv/GHSA-rf6f-7fwh-wjgh: [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh |
package-lock.json |
| high | osv/GHSA-hmw2-7cc7-3qxx: [email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx |
package-lock.json |
| high | osv/GHSA-2883-xcg3-v3hh: [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh |
package-lock.json |
| high | osv/GHSA-52cp-r559-cp3m: [email protected] (npm) is affected by GHSA-52cp-r559-cp3m |
package-lock.json |
| high | osv/GHSA-5p4m-2wfm-xmqj: [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj |
package-lock.json |
| high | osv/GHSA-23c5-xmqv-rm74: [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 |
package-lock.json |
| high | osv/GHSA-3ppc-4f35-3m26: [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 |
package-lock.json |
| high | osv/GHSA-7r86-cg39-jmmj: [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj |
package-lock.json |
| high | osv/GHSA-28wg-ghj8-5hjv: [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv |
package-lock.json |
| high | osv/GHSA-2v37-7h3g-55p8: [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 |
package-lock.json |
| high | osv/GHSA-xwg4-73v4-xw9w: [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w |
package-lock.json |
| high | osv/GHSA-c2c7-rcm5-vvqj: [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj |
package-lock.json |
| high | osv/GHSA-c2c7-rcm5-vvqj: [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj |
package-lock.json |
| high | osv/GHSA-6g55-p6wh-862q: [email protected] (npm) is affected by GHSA-6g55-p6wh-862q |
package-lock.json |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 42,905; test lines: 86,696
| Language | Lines |
|---|---|
| JavaScript | 129,564 |
| Shell | 37 |