brookshi/Hitchhiker

a Restful Api test tool

https://github.com/brookshi/Hitchhiker · commit 318bc47d4041 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/brookshi/Hitchhiker
Commit: 318bc47d4041b32d0e2ffb1716be053abd28b456
Generated: 2026-11-13T23:39:19+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	65%	100%
Code quality	50	poor	90%	100%
Security	49	poor	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
Stylometry index: 0.06 per 1,000 lines (narrated steps 2, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2017-11	12,041	0%
2017-12	2,351	0%
2018-01	1,725	0%
2018-02	105	0%
2018-03	1,023	0%
2018-04	724	0%
2018-05	1,071	0%
2018-06	829	0%
2018-07	3,960	0%
2018-08	1,079	0%
2018-09	12	0%
2018-10	1,003	0%

Evidence

step-by-step narration comment: // First, read the current file sizes in build directory. (client/scrip)
step-by-step narration comment: // Finally, by now we have certainly resolved the URL. (client/scrip)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.04, no CI test run detected; 10% of function code in complex or long functions; 9% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	74
Duplication	58
Code smells (Opengrep)	59
Tests and CI	23
Documentation	65
Type safety	0
Process (Scorecard review/maintenance)	n/a

Functions: 5,570; mean complexity 3.8, 90th percentile 6; 169 complex and 7 long functions
Duplicated lines: 9.2% of 19,510 compared
Tests: 1,337 test lines for 31,167 source lines (ratio 0.04); CI test commands: none detected; 3% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is poor: 70 known vulnerabilities in 32 dependencies; 12 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	97
Static analysis (Opengrep)	62
Vulnerable dependencies (OSV)	2
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 70 in 32 packages (critical 8, high 33, medium 21, low 4)
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Severity	Finding	Location
critical	`osv/GHSA-fjxv-7rqg-78g4`: [email protected] (npm) is affected by GHSA-fjxv-7rqg-78g4	api/yarn.lock
critical	`osv/GHSA-896r-f27r-55mw`: [email protected] (npm) is affected by GHSA-896r-f27r-55mw	api/yarn.lock
critical	`osv/GHSA-593f-38f6-jp5m`: [email protected] (npm) is affected by GHSA-593f-38f6-jp5m	api/yarn.lock
critical	`osv/GHSA-jf85-cpcp-j695`: [email protected] (npm) is affected by GHSA-jf85-cpcp-j695	api/yarn.lock
critical	`osv/GHSA-xvch-5gv4-984h`: [email protected] (npm) is affected by GHSA-xvch-5gv4-984h	api/yarn.lock
critical	`osv/GHSA-fx4w-v43j-vc45`: [email protected] (npm) is affected by GHSA-fx4w-v43j-vc45	api/yarn.lock
critical	`osv/GHSA-pf2j-9qmp-jqr2`: [email protected] (npm) is affected by GHSA-pf2j-9qmp-jqr2	api/yarn.lock
critical	`osv/GHSA-w7q7-vjp8-7jv4`: [email protected] (npm) is affected by GHSA-w7q7-vjp8-7jv4	api/yarn.lock
high	`opengrep/javascript.lang.security.detect-insecure-websocket`: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]	api/src/utils/setting.ts:116
high	`opengrep/javascript.node-crypto.security.create-de-cipher-no-iv`: The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, [confidence high]	api/src/utils/string_util.ts:24
high	`opengrep/javascript.node-crypto.security.create-de-cipher-no-iv`: The deprecated functions 'createCipher' and 'createDecipher' generate the same initialization vector every time. For counter modes such as CTR, GCM, or CCM this leads to break of both confidentiality and integrity, if the key is used more than once. Other modes are still affected in their strength, [confidence high]	api/src/utils/string_util.ts:31
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	client/public/jq.js:2
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `o.appendChild(a).innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	client/public/jq.js:2
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	client/public/jq.js:3
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `f.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	client/public/jq.js:3
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	client/public/jq.js:3
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	client/public/jq.js:3
high	`opengrep/javascript.express.security.audit.remote-property-injection`: Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low]	client/public/jq.js:4
high	`opengrep/javascript.express.security.audit.remote-property-injection`: Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low]	client/public/jq.js:4
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	deploy/docker/Dockerfile:28
high	`osv/GHSA-3jxr-9vmj-r5cp`: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp	api/yarn.lock
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	api/yarn.lock
high	`osv/GHSA-mh99-v99m-4gvg`: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	api/yarn.lock
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	api/yarn.lock
high	`osv/GHSA-rgw5-rvv9-x895`: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	api/yarn.lock

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v0.14 ships Hitchhiker.zip (1548 downloads)
binary-release-asset: release v0.13 ships Hitchhiker.zip (171 downloads)
binary-release-asset: release v0.12.1 ships Hitchhiker.zip (56 downloads)
binary-release-asset: release v0.12 ships Hitchhiker.zip (32 downloads)
binary-release-asset: release v0.10 ships Hitchhiker.zip (238 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 31,167; test lines: 1,337

Language	Lines
TypeScript	27,016
JavaScript	5,446
Shell	42

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/brookshi/Hitchhiker/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/brookshi/Hitchhiker/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/brookshi/Hitchhiker/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/brookshi/Hitchhiker/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/brookshi/Hitchhiker/security.svg)](https://repotrust.synapticcyber.com/r/github.com/brookshi/Hitchhiker/)