RepoTrust

Leaderboard github.com

Pixelpip/transactXL

  • View repository ↗
  • JavaScript
  • ★ 0
  • commit e7cdc3c92cc0
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

none-detected

Confidence
44%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

38/100

poor

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

47/100

poor

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

  • Explicitly attributed share0%
  • Unattributed share in AI-pace bursts0%
  • Estimated AI-generated share0%
  • AI tool configuration files0
  • Work sessions at AI pace0
  • Releases at AI pacenot measured
  • Coding-style index (1.0+ means possible)0.88

Lines added per month all AI-attributed share

  1. 2026-082,425 · 0% AI

Evidence by analyzer

Explicit AI attributionok
attributed_commit_share
0.0%
attributed_commits
0
attributed_loc
0
attributed_loc_share
0.0%
commits
14
effective_loc
2,425
tools_detected
0
AI tool configurationok
artifacts
0
tools_configured
0
workflow_agents
0
Commit velocityok
excluded_import_loc
2,038
flagged_loc
0
flagged_loc_share
0.0%
flagged_units
0
max_loc_per_hour
80.45
measured_loc
387
median_loc_per_hour
80.45
pr_timed_units
0
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
2
Release velocityskipped
Coding styleok
count:assistant_voice
0
count:emoji_in_code
4
count:narrated_steps
0
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
3
files:narrated_steps
0
files:placeholder
0
index
0.88
lines_scanned
2,278
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
1.76
per_kloc:narrated_steps
0
per_kloc:placeholder
0

Code quality

38 poor

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 11% of function code in complex or long functions; 43% duplicated lines. Weakest area: testing.

How the score is built

  • Complexity72
  • Duplication8
  • Lint and smells80
  • Tests and CI0
  • Documentation20
  • Type safety100
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok2 items
complex_functions
2
function_nloc
1,863
functions
109
long_functions
2
many_param_functions
0
mean_ccn
3.88
p90_ccn
10
risky_nloc_share
11.1%
Duplication (jscpd)ok5 items
compared_lines
1,710
duplicated_lines
736
duplicated_share
43.0%
files
4
Lintok
category:best-practice
2
findings
2
scanned_lines
2,278
weighted_findings
2
Tests and CIok
check:ci_present
no
check:ci_runs_lint
no
check:ci_runs_tests
no
check:has_tests
no
check:test_ratio
no
check:tests_cochange
no
ci_files
0
cochange_commits
4
cochange_share
0.0%
source_lines
2,278
test_lines
0
test_ratio
0
Documentationok1 item
  • README.md README.md
check:changelog
no
check:contributing
no
check:license
no
check:readme
no
readme_lines
9
Type safetyok1 item
  • TypeScript strict type checking: tsconfig.json tsconfig.json
check:low_escape_density
yes
check:strict_config
yes
escapes
0
escapes_per_kloc
0

Security

47 poor

Security posture is poor: 16 known vulnerabilities in 8 dependencies; 14 high-severity SAST findings. Weakest area: posture.

How the score is built

  • Secrets100
  • Static analysis (SAST)16
  • Vulnerable dependencies36
  • CI workflowsnot measured
  • Security posture0
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
16
declared
16
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
20
findings_high
14
findings_low
0
findings_medium
6
parse_errors
0
scanned_lines
2,278
weighted_findings
12
Dependencies (osv-scanner)ok
penalty
61
vulnerabilities
16
vulnerable_packages
8
vulns_critical
1
vulns_high
8
vulns_low
0
vulns_medium
7
vulns_unknown
0
CI workflows (zizmor)skipped
Security postureok
check:dependency_updates
no
check:lockfiles
yes
check:security_policy
no
check:signed_commits
no
signed_commit_share
35.7%
unpinned_manifests
0
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

1 critical22 high15 medium

SeverityRuleLocationMessageTool
critical osv/GHSA-jqcg-44mw-7w3h package-lock.json [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h Dependencies (osv-scanner)
high osv/GHSA-27r3-jxmh-p828 package-lock.json [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 Dependencies (osv-scanner)
high osv/GHSA-6j4f-fj2g-mc7p package-lock.json [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p Dependencies (osv-scanner)
high osv/GHSA-6j4f-fj2g-mc7p package-lock.json [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p Dependencies (osv-scanner)
high osv/GHSA-6j4f-fj2g-mc7p package-lock.json [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p Dependencies (osv-scanner)
high osv/GHSA-qhr7-859c-m2p7 package-lock.json [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 Dependencies (osv-scanner)
high osv/GHSA-qhr7-859c-m2p7 package-lock.json [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 Dependencies (osv-scanner)
high osv/GHSA-qhr7-859c-m2p7 package-lock.json [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 Dependencies (osv-scanner)
high osv/GHSA-w5hq-g745-h8pq package-lock.json [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq Dependencies (osv-scanner)
high opengrep/javascript.browser.security.insecure-document-method public/app.js:491 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/app.js:491 User controlled data in a `card.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/app.js:730 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/app.js:730 User controlled data in a `card.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/app.js:765 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/app.js:765 User controlled data in a `summaryRow.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/app.js:893 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/app.js:893 User controlled data in a `monthlySummaryBody.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/app.js:895 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/app.js:895 User controlled data in a `mobileMonthlyList.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/app.js:905 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/app.js:905 User controlled data in a `tr.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-document-method public/app.js:918 User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
high opengrep/javascript.browser.security.insecure-innerhtml public/app.js:918 User controlled data in a `card.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.best-practice.javascript-confirm public/app.js:124 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm public/app.js:130 found confirm() call; should this be in production code? Lint
medium osv/GHSA-4mjr-xmp4-gh2g package-lock.json [email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g Dependencies (osv-scanner)
medium osv/GHSA-6pq8-jhm2-2vcw package-lock.json [email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 package-lock.json [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-q2hr-2g5m-vwhr package-lock.json [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr Dependencies (osv-scanner)
medium osv/GHSA-q2hr-2g5m-vwhr package-lock.json [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr Dependencies (osv-scanner)
medium osv/GHSA-q2hr-2g5m-vwhr package-lock.json [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr Dependencies (osv-scanner)
medium osv/GHSA-x5fp-wj9c-mxmx package-lock.json [email protected] (npm) is affected by GHSA-x5fp-wj9c-mxmx Dependencies (osv-scanner)
medium opengrep/javascript.lang.security.html-in-template-string public/app.js:730 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string public/app.js:765 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string public/app.js:893 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string public/app.js:895 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string public/app.js:905 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)
medium opengrep/javascript.lang.security.html-in-template-string public/app.js:918 This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... Static analysis (opengrep)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceskipped—0
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-40
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b4142
Tests and CICode qualityok—0
Type safetyCode qualityok—0
CI workflows (zizmor)Securityskipped—0
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.116
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b41420
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

Scores from different scoring versions aren't directly comparable.

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-14e7cdc3c92cc0prov-5+qual-2+sec-20%3847
2026-11-14e7cdc3c92cc0prov-4+qual-2+sec-20%3847

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Pixelpip/transactXL/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Pixelpip/transactXL/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Pixelpip/transactXL/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Pixelpip/transactXL/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Pixelpip/transactXL/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Pixelpip/transactXL/)
Full text report
  • Repository: https://github.com/Pixelpip/transactXL
  • Commit: e7cdc3c92cc065ba45246b5171e5cf94bae4a64d
  • Generated: 2026-11-14T14:52:01+00:00
  • Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 none-detected 44% 100%
Code quality 38 poor 90% 100%
Security 47 poor 85% 100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

  • Explicitly attributed share (lower bound): 0.0%

  • Unattributed share in AI-consistent velocity bursts: 0.0%

  • Estimated AI-generated share: 0.0%

  • Stylometry index: 0.88 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 4). Reported as a signal, not scored.

Month Lines added Attributed to AI
2026-08 2,425 0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 11% of function code in complex or long functions; 43% duplicated lines. Weakest area: testing.

Area Score
Complexity (lizard) 72
Duplication 8
Code smells (Opengrep) 80
Tests and CI 0
Documentation 20
Type safety 100
Process (Scorecard review/maintenance) n/a
  • Functions: 109; mean complexity 3.9, 90th percentile 10; 2 complex and 2 long functions
  • Duplicated lines: 43.0% of 1,710 compared
  • Tests: 0 test lines for 2,278 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
  • Docs missing or thin: readme, license, contributing, changelog

Most complex functions:

Security

Security posture is poor: 16 known vulnerabilities in 8 dependencies; 14 high-severity SAST findings. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 16
Vulnerable dependencies (OSV) 36
CI workflows (zizmor) n/a
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a
  • Known vulnerabilities: 16 in 8 packages (critical 1, high 8, medium 7, low 0)

  • Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity Finding Location
critical osv/GHSA-jqcg-44mw-7w3h: [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h package-lock.json
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:491
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a card.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:491
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:730
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a card.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:730
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:765
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a summaryRow.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:765
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:893
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a monthlySummaryBody.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:893
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:895
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a mobileMonthlyList.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:895
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:905
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a tr.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:905
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:918
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a card.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] public/app.js:918
high osv/GHSA-27r3-jxmh-p828: [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 package-lock.json
high osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p package-lock.json
high osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 package-lock.json
high osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p package-lock.json
high osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 package-lock.json
high osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p package-lock.json
high osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 package-lock.json
high osv/GHSA-w5hq-g745-h8pq: [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq package-lock.json
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] public/app.js:730
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] public/app.js:765

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 2,278; test lines: 0
Language Lines
JavaScript 1,628
TypeScript 650