RailsApps/rails-composer
Rails Composer. The Rails generator on steroids for starter apps.
- Repository: https://github.com/RailsApps/rails-composer
- Commit:
5a9985f6ddae1cc9475568c2d1f6a7ae28c005a7 - Generated: 2026-11-13T23:28:28+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 47 | poor | 90% | 100% |
| Security | 64 | weak | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2016-08 | 4 | 0% |
| 2016-09 | 21 | 0% |
| 2016-10 | 43 | 0% |
| 2016-11 | 5 | 0% |
| 2017-01 | 1 | 0% |
| 2017-04 | 3 | 0% |
| 2017-05 | 60 | 0% |
| 2017-11 | 2 | 0% |
| 2018-01 | 2 | 0% |
| 2018-02 | 17 | 0% |
| 2018-05 | 98 | 0% |
| 2018-09 | 47 | 0% |
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 44% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 100 |
| Duplication | 7 |
| Code smells (Opengrep) | 97 |
| Tests and CI | 0 |
| Documentation | 40 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 71; mean complexity 2.1, 90th percentile 4; 0 complex and 0 long functions
- Duplicated lines: 43.5% of 4,908 compared
- Tests: 0 test lines for 6,145 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
- Docs missing or thin: license, contributing, changelog
Security
Security posture is weak: 1 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 50 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/ruby.lang.security.missing-csrf-protection: Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class. [confidence low] |
files/app/controllers/application_controller-omniauth.rb:1 |
| medium | opengrep/ruby.lang.security.dangerous-open: Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
composer-Rails3_2.rb:209 |
| medium | opengrep/ruby.lang.security.dangerous-open: Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
composer-Rails3_2.rb:214 |
| medium | opengrep/ruby.lang.security.dangerous-open: Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
composer-Rails3_2.rb:226 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer-Rails3_2.rb:2348 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer-Rails3_2.rb:2351 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer-Rails3_2.rb:2354 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer-Rails3_2.rb:2358 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer-Rails3_2.rb:2359 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer-Rails3_2.rb:2362 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer-Rails3_2.rb:2365 |
| medium | opengrep/ruby.lang.security.dangerous-open: Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
composer.rb:208 |
| medium | opengrep/ruby.lang.security.dangerous-open: Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
composer.rb:213 |
| medium | opengrep/ruby.lang.security.dangerous-open: Detected non-static command inside 'open'. Audit the input to 'open'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
composer.rb:225 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer.rb:2400 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer.rb:2403 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer.rb:2406 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer.rb:2410 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer.rb:2411 |
| medium | opengrep/ruby.rails.security.brakeman.check-secrets: Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key and a non-empty string literal value. [confidence medium] |
composer.rb:2414 |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find: Found an unscoped find(...) with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium] |
files/app/controllers/application_controller-omniauth.rb:21 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag: 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external d [confidence low] |
files/app/helpers/application_helper-simple_form.rb:5 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe: 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low] |
files/app/helpers/application_helper-simple_form.rb:12 |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute: Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] |
files/app/views/layouts/_messages-bootstrap.html.erb:3 |
| medium | opengrep/ruby.rails.security.audit.xss.templates.avoid-content-tag: 'content_tag' exhibits unintuitive escaping behavior and may accidentally expose your application to cross-site scripting. If using Rails 2, only attribute values are escaped. If using Rails 3, content and attribute values are escaped. Tag and attribute names are never escaped. Because of this, it i [confidence low] |
files/app/views/layouts/_messages-bootstrap.html.erb:5 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- readme-download-lure: gives an archive password
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 6,145; test lines: 0
| Language | Lines |
|---|---|
| Ruby | 6,133 |
| Shell | 12 |