RepoTrust

Leaderboard github.com

bryceosterhaus/quickread

Vibe coded epub reader for "speed read training"

  • View repository ↗
  • JavaScript
  • ★ 0
  • commit 423181cf40eb
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

none-detected

Confidence
41%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

47/100

poor

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

64/100

weak

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

  • Explicitly attributed share0%
  • Unattributed share in AI-pace bursts0%
  • Estimated AI-generated share0%
  • AI tool configuration files0
  • Work sessions at AI pace0
  • Releases at AI pacenot measured
  • Coding-style index (1.0+ means possible)0.00

Lines added per month all AI-attributed share

  1. 2026-011,224 · 0% AI

Evidence by analyzer

Explicit AI attributionok
attributed_commit_share
0.0%
attributed_commits
0
attributed_loc
0
attributed_loc_share
0.0%
commits
2
effective_loc
1,224
tools_detected
0
AI tool configurationok
artifacts
0
tools_configured
0
workflow_agents
0
Commit velocityok
excluded_import_loc
0
flagged_loc
0
flagged_loc_share
0.0%
flagged_units
0
max_loc_per_hour
306
measured_loc
1,224
median_loc_per_hour
306
pr_timed_units
0
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
1
Release velocityskipped
Coding styleok
count:assistant_voice
0
count:emoji_in_code
0
count:narrated_steps
0
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
0
files:narrated_steps
0
files:placeholder
0
index
0
lines_scanned
1,224
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0
per_kloc:narrated_steps
0
per_kloc:placeholder
0

Code quality

47 poor

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 18% of function code in complex or long functions; 5% duplicated lines. Weakest area: testing.

How the score is built

  • Complexity59
  • Duplication73
  • Lint and smells100
  • Tests and CI0
  • Documentation20
  • Type safetynot measured
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok1 item
complex_functions
1
function_nloc
1,015
functions
120
long_functions
1
many_param_functions
0
mean_ccn
2.32
p90_ccn
5
risky_nloc_share
17.7%
Duplication (jscpd)ok1 item
compared_lines
833
duplicated_lines
44
duplicated_share
5.3%
files
4
Lintok
findings
0
scanned_lines
1,224
weighted_findings
0
Tests and CIok
check:ci_present
no
check:ci_runs_lint
no
check:ci_runs_tests
no
check:has_tests
no
check:test_ratio
no
check:tests_cochange
no
ci_files
0
cochange_commits
1
cochange_share
0.0%
source_lines
1,224
test_lines
0
test_ratio
0
Documentationok1 item
  • README.md README.md
check:changelog
no
check:contributing
no
check:license
no
check:readme
no
readme_lines
10
Type safetyskipped

Security

64 weak

Security posture is weak: 98 known vulnerabilities in 30 dependencies. Weakest area: dependencies.

How the score is built

  • Secrets100
  • Static analysis (SAST)100
  • Vulnerable dependencies3
  • CI workflowsnot measured
  • Security posture20
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
13
declared
13
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
0
findings_high
0
findings_low
0
findings_medium
0
parse_errors
0
scanned_lines
1,224
weighted_findings
0
Dependencies (osv-scanner)ok
penalty
203
vulnerabilities
98
vulnerable_packages
30
vulns_critical
0
vulns_high
65
vulns_low
5
vulns_medium
28
vulns_unknown
0
CI workflows (zizmor)skipped
Security postureok
check:dependency_updates
no
check:lockfiles
yes
check:security_policy
no
check:signed_commits
yes
signed_commit_share
100.0%
unpinned_manifests
0
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

65 high28 medium5 low

SeverityRuleLocationMessageTool
high osv/GHSA-23c5-xmqv-rm74 bun.lock [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 Dependencies (osv-scanner)
high osv/GHSA-23c5-xmqv-rm74 bun.lock [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 Dependencies (osv-scanner)
high osv/GHSA-23c5-xmqv-rm74 bun.lock [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 Dependencies (osv-scanner)
high osv/GHSA-25h7-pfq9-p65f bun.lock [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f Dependencies (osv-scanner)
high osv/GHSA-27p8-2357-5qqv bun.lock @xmldom/[email protected] (npm) is affected by GHSA-27p8-2357-5qqv Dependencies (osv-scanner)
high osv/GHSA-2883-xcg3-v3hh bun.lock [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh Dependencies (osv-scanner)
high osv/GHSA-28wg-ghj8-5hjv bun.lock [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv Dependencies (osv-scanner)
high osv/GHSA-2v35-w6hq-6mfw bun.lock @xmldom/[email protected] (npm) is affected by GHSA-2v35-w6hq-6mfw Dependencies (osv-scanner)
high osv/GHSA-2v37-7h3g-55p8 bun.lock [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 Dependencies (osv-scanner)
high osv/GHSA-3jxr-9vmj-r5cp bun.lock [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp Dependencies (osv-scanner)
high osv/GHSA-3jxr-9vmj-r5cp bun.lock [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp Dependencies (osv-scanner)
high osv/GHSA-3ppc-4f35-3m26 bun.lock [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 Dependencies (osv-scanner)
high osv/GHSA-3ppc-4f35-3m26 bun.lock [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 Dependencies (osv-scanner)
high osv/GHSA-3ppc-4f35-3m26 bun.lock [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 Dependencies (osv-scanner)
high osv/GHSA-4c8g-83qw-93j6 bun.lock [email protected] (npm) is affected by GHSA-4c8g-83qw-93j6 Dependencies (osv-scanner)
high osv/GHSA-4w3w-2rp5-g8jm bun.lock @xmldom/[email protected] (npm) is affected by GHSA-4w3w-2rp5-g8jm Dependencies (osv-scanner)
high osv/GHSA-52cp-r559-cp3m bun.lock [email protected] (npm) is affected by GHSA-52cp-r559-cp3m Dependencies (osv-scanner)
high osv/GHSA-587h-7wmj-h5pm bun.lock [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm Dependencies (osv-scanner)
high osv/GHSA-5c6j-r48x-rmvq bun.lock [email protected] (npm) is affected by GHSA-5c6j-r48x-rmvq Dependencies (osv-scanner)
high osv/GHSA-5p4m-2wfm-xmqj bun.lock [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj Dependencies (osv-scanner)
high osv/GHSA-68fv-2mgg-jv7q bun.lock [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q Dependencies (osv-scanner)
high osv/GHSA-6g55-p6wh-862q bun.lock [email protected] (npm) is affected by GHSA-6g55-p6wh-862q Dependencies (osv-scanner)
high osv/GHSA-6j4f-fj2g-mc7p bun.lock [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p Dependencies (osv-scanner)
high osv/GHSA-6j4f-fj2g-mc7p bun.lock [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p Dependencies (osv-scanner)
high osv/GHSA-73wf-gq98-2v4g bun.lock [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g Dependencies (osv-scanner)
high osv/GHSA-7h2j-956f-4vf2 bun.lock @isaacs/[email protected] (npm) is affected by GHSA-7h2j-956f-4vf2 Dependencies (osv-scanner)
high osv/GHSA-7p8r-x3mc-p8w7 bun.lock [email protected] (npm) is affected by GHSA-7p8r-x3mc-p8w7 Dependencies (osv-scanner)
high osv/GHSA-7r86-cg39-jmmj bun.lock [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj Dependencies (osv-scanner)
high osv/GHSA-7r86-cg39-jmmj bun.lock [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj Dependencies (osv-scanner)
high osv/GHSA-7r86-cg39-jmmj bun.lock [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj Dependencies (osv-scanner)
high osv/GHSA-8344-3jmq-59r6 bun.lock @xmldom/[email protected] (npm) is affected by GHSA-8344-3jmq-59r6 Dependencies (osv-scanner)
high osv/GHSA-93r5-fhx6-vmg9 bun.lock @xmldom/[email protected] (npm) is affected by GHSA-93r5-fhx6-vmg9 Dependencies (osv-scanner)
high osv/GHSA-965w-775f-mr7g bun.lock @xmldom/[email protected] (npm) is affected by GHSA-965w-775f-mr7g Dependencies (osv-scanner)
high osv/GHSA-c2c7-rcm5-vvqj bun.lock [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj Dependencies (osv-scanner)
high osv/GHSA-c2c7-rcm5-vvqj bun.lock [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj Dependencies (osv-scanner)
high osv/GHSA-c7q8-3ch8-vqpv bun.lock @xmldom/[email protected] (npm) is affected by GHSA-c7q8-3ch8-vqpv Dependencies (osv-scanner)
high osv/GHSA-c83g-rgw3-j3cx bun.lock [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx Dependencies (osv-scanner)
high osv/GHSA-f65p-4m7j-42xc bun.lock [email protected] (npm) is affected by GHSA-f65p-4m7j-42xc Dependencies (osv-scanner)
high osv/GHSA-f6ww-3ggp-fr8h bun.lock @xmldom/[email protected] (npm) is affected by GHSA-f6ww-3ggp-fr8h Dependencies (osv-scanner)
high osv/GHSA-fv7c-fp4j-7gwp bun.lock @babel/[email protected] (npm) is affected by GHSA-fv7c-fp4j-7gwp Dependencies (osv-scanner)
high osv/GHSA-j759-j44w-7fr8 bun.lock @xmldom/[email protected] (npm) is affected by GHSA-j759-j44w-7fr8 Dependencies (osv-scanner)
high osv/GHSA-jqff-g426-hqxp bun.lock [email protected] (npm) is affected by GHSA-jqff-g426-hqxp Dependencies (osv-scanner)
high osv/GHSA-mh99-v99m-4gvg bun.lock [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg Dependencies (osv-scanner)
high osv/GHSA-mh99-v99m-4gvg bun.lock [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg Dependencies (osv-scanner)
high osv/GHSA-mrhx-c7xc-m3w5 bun.lock [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 Dependencies (osv-scanner)
high osv/GHSA-mw96-cpmx-2vgc bun.lock [email protected] (npm) is affected by GHSA-mw96-cpmx-2vgc Dependencies (osv-scanner)
high osv/GHSA-mw96-cpmx-2vgc bun.lock [email protected] (npm) is affected by GHSA-mw96-cpmx-2vgc Dependencies (osv-scanner)
high osv/GHSA-p9ff-h696-f583 bun.lock [email protected] (npm) is affected by GHSA-p9ff-h696-f583 Dependencies (osv-scanner)
high osv/GHSA-q3j6-qgpj-74h6 bun.lock [email protected] (npm) is affected by GHSA-q3j6-qgpj-74h6 Dependencies (osv-scanner)
high osv/GHSA-qhr7-859c-m2p7 bun.lock [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 Dependencies (osv-scanner)
high osv/GHSA-qhr7-859c-m2p7 bun.lock [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 Dependencies (osv-scanner)
high osv/GHSA-qw65-cvwx-89v3 bun.lock [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 Dependencies (osv-scanner)
high osv/GHSA-r28c-9q8g-f849 bun.lock [email protected] (npm) is affected by GHSA-r28c-9q8g-f849 Dependencies (osv-scanner)
high osv/GHSA-r5fr-rjxr-66jc bun.lock [email protected] (npm) is affected by GHSA-r5fr-rjxr-66jc Dependencies (osv-scanner)
high osv/GHSA-rf6f-7fwh-wjgh bun.lock [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh Dependencies (osv-scanner)
high osv/GHSA-rgw5-rvv9-x895 bun.lock [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 Dependencies (osv-scanner)
high osv/GHSA-rgw5-rvv9-x895 bun.lock [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 Dependencies (osv-scanner)
high osv/GHSA-v2hh-gcrm-f6hx bun.lock [email protected] (npm) is affected by GHSA-v2hh-gcrm-f6hx Dependencies (osv-scanner)
high osv/GHSA-v2wj-q39q-566r bun.lock [email protected] (npm) is affected by GHSA-v2wj-q39q-566r Dependencies (osv-scanner)
high osv/GHSA-v39h-62p7-jpjc bun.lock [email protected] (npm) is affected by GHSA-v39h-62p7-jpjc Dependencies (osv-scanner)
high osv/GHSA-w2rr-34g9-rvrj bun.lock @xmldom/[email protected] (npm) is affected by GHSA-w2rr-34g9-rvrj Dependencies (osv-scanner)
high osv/GHSA-wh4c-j3r5-mjhp bun.lock @xmldom/[email protected] (npm) is affected by GHSA-wh4c-j3r5-mjhp Dependencies (osv-scanner)
high osv/GHSA-x4fp-j954-r2f4 bun.lock @xmldom/[email protected] (npm) is affected by GHSA-x4fp-j954-r2f4 Dependencies (osv-scanner)
high osv/GHSA-x6wf-f3px-wcqx bun.lock @xmldom/[email protected] (npm) is affected by GHSA-x6wf-f3px-wcqx Dependencies (osv-scanner)
high osv/GHSA-xwg4-73v4-xw9w bun.lock [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w Dependencies (osv-scanner)
medium osv/GHSA-2g4f-4pwh-qvx6 bun.lock [email protected] (npm) is affected by GHSA-2g4f-4pwh-qvx6 Dependencies (osv-scanner)
medium osv/GHSA-2g4f-4pwh-qvx6 bun.lock [email protected] (npm) is affected by GHSA-2g4f-4pwh-qvx6 Dependencies (osv-scanner)
medium osv/GHSA-3g3m-2fjr-6pw4 bun.lock [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 Dependencies (osv-scanner)
medium osv/GHSA-3v7f-55p6-f55p bun.lock [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p Dependencies (osv-scanner)
medium osv/GHSA-3v7f-55p6-f55p bun.lock [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p Dependencies (osv-scanner)
medium osv/GHSA-4w7w-66w2-5vf9 bun.lock [email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9 Dependencies (osv-scanner)
medium osv/GHSA-698v-4r3x-3vcv bun.lock [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv Dependencies (osv-scanner)
medium osv/GHSA-6gmq-8vp8-gcm6 bun.lock @xmldom/[email protected] (npm) is affected by GHSA-6gmq-8vp8-gcm6 Dependencies (osv-scanner)
medium osv/GHSA-6h8r-xr42-gp59 bun.lock @xmldom/[email protected] (npm) is affected by GHSA-6h8r-xr42-gp59 Dependencies (osv-scanner)
medium osv/GHSA-f886-m6hf-6m8v bun.lock [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v Dependencies (osv-scanner)
medium osv/GHSA-f886-m6hf-6m8v bun.lock [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v Dependencies (osv-scanner)
medium osv/GHSA-fx2h-pf6j-xcff bun.lock [email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff Dependencies (osv-scanner)
medium osv/GHSA-fxqj-rqcc-2cmp bun.lock [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 bun.lock [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-gcqx-w48m-w2h4 bun.lock [email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4 Dependencies (osv-scanner)
medium osv/GHSA-h67p-54hq-rp68 bun.lock [email protected] (npm) is affected by GHSA-h67p-54hq-rp68 Dependencies (osv-scanner)
medium osv/GHSA-hrr3-gc8f-f4qj bun.lock [email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj Dependencies (osv-scanner)
medium osv/GHSA-p498-v437-472g bun.lock @humanfs/[email protected] (npm) is affected by GHSA-p498-v437-472g Dependencies (osv-scanner)
medium osv/GHSA-q2hr-2g5m-vwhr bun.lock [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr Dependencies (osv-scanner)
medium osv/GHSA-q2hr-2g5m-vwhr bun.lock [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr Dependencies (osv-scanner)
medium osv/GHSA-qj8w-gfj5-8c6v bun.lock [email protected] (npm) is affected by GHSA-qj8w-gfj5-8c6v Dependencies (osv-scanner)
medium osv/GHSA-qx2v-qp2m-jg93 bun.lock [email protected] (npm) is affected by GHSA-qx2v-qp2m-jg93 Dependencies (osv-scanner)
medium osv/GHSA-r825-w8mm-5pxw bun.lock [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw Dependencies (osv-scanner)
medium osv/GHSA-rq7h-c2jc-7f22 bun.lock [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 Dependencies (osv-scanner)
medium osv/GHSA-v6wh-96g9-6wx3 bun.lock [email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3 Dependencies (osv-scanner)
medium osv/GHSA-w5vr-8v7q-w6rv bun.lock [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv Dependencies (osv-scanner)
medium osv/GHSA-w74x-v6f9-j3xg bun.lock [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg Dependencies (osv-scanner)
medium osv/GHSA-xxjr-mmjv-4gpg bun.lock [email protected] (npm) is affected by GHSA-xxjr-mmjv-4gpg Dependencies (osv-scanner)
low osv/GHSA-333x-w4r6-6crp bun.lock [email protected] (npm) is affected by GHSA-333x-w4r6-6crp Dependencies (osv-scanner)
low osv/GHSA-4x5r-pxfx-6jf8 bun.lock @babel/[email protected] (npm) is affected by GHSA-4x5r-pxfx-6jf8 Dependencies (osv-scanner)
low osv/GHSA-9jrq-w75r-8gcw bun.lock [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw Dependencies (osv-scanner)
low osv/GHSA-m5mm-p8h7-m29v bun.lock [email protected] (npm) is affected by GHSA-m5mm-p8h7-m29v Dependencies (osv-scanner)
low osv/GHSA-xhq7-xmqj-769h bun.lock [email protected] (npm) is affected by GHSA-xhq7-xmqj-769h Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceskipped—0
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-40
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b4140
Tests and CICode qualityok—0
Type safetyCode qualityskipped—0
CI workflows (zizmor)Securityskipped—0
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.198
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b4140
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

Scores from different scoring versions aren't directly comparable.

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-14423181cf40ebprov-5+qual-2+sec-20%4764
2026-11-14423181cf40ebprov-4+qual-2+sec-20%4764

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/bryceosterhaus/quickread/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/bryceosterhaus/quickread/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/bryceosterhaus/quickread/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/bryceosterhaus/quickread/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/bryceosterhaus/quickread/security.svg)](https://repotrust.synapticcyber.com/r/github.com/bryceosterhaus/quickread/)
Full text report

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 none-detected 41% 100%
Code quality 47 poor 90% 100%
Security 64 weak 85% 100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

  • Explicitly attributed share (lower bound): 0.0%
  • Unattributed share in AI-consistent velocity bursts: 0.0%
  • Estimated AI-generated share: 0.0%
Month Lines added Attributed to AI
2026-01 1,224 0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 18% of function code in complex or long functions; 5% duplicated lines. Weakest area: testing.

Area Score
Complexity (lizard) 59
Duplication 73
Code smells (Opengrep) 100
Tests and CI 0
Documentation 20
Type safety n/a
Process (Scorecard review/maintenance) n/a
  • Functions: 120; mean complexity 2.3, 90th percentile 5; 1 complex and 1 long functions
  • Duplicated lines: 5.3% of 833 compared
  • Tests: 0 test lines for 1,224 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
  • Docs missing or thin: readme, license, contributing, changelog

Most complex functions:

Security

Security posture is weak: 98 known vulnerabilities in 30 dependencies. Weakest area: dependencies.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 100
Vulnerable dependencies (OSV) 3
CI workflows (zizmor) n/a
Posture (policy, updates, signing, lockfiles) 20
OpenSSF Scorecard n/a

  • Known vulnerabilities: 98 in 30 packages (critical 0, high 65, medium 28, low 5)

  • Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates

Top findings

Severity Finding Location
high osv/GHSA-fv7c-fp4j-7gwp: @babel/[email protected] (npm) is affected by GHSA-fv7c-fp4j-7gwp bun.lock
high osv/GHSA-7h2j-956f-4vf2: @isaacs/[email protected] (npm) is affected by GHSA-7h2j-956f-4vf2 bun.lock
high osv/GHSA-27p8-2357-5qqv: @xmldom/[email protected] (npm) is affected by GHSA-27p8-2357-5qqv bun.lock
high osv/GHSA-2v35-w6hq-6mfw: @xmldom/[email protected] (npm) is affected by GHSA-2v35-w6hq-6mfw bun.lock
high osv/GHSA-4w3w-2rp5-g8jm: @xmldom/[email protected] (npm) is affected by GHSA-4w3w-2rp5-g8jm bun.lock
high osv/GHSA-8344-3jmq-59r6: @xmldom/[email protected] (npm) is affected by GHSA-8344-3jmq-59r6 bun.lock
high osv/GHSA-93r5-fhx6-vmg9: @xmldom/[email protected] (npm) is affected by GHSA-93r5-fhx6-vmg9 bun.lock
high osv/GHSA-965w-775f-mr7g: @xmldom/[email protected] (npm) is affected by GHSA-965w-775f-mr7g bun.lock
high osv/GHSA-c7q8-3ch8-vqpv: @xmldom/[email protected] (npm) is affected by GHSA-c7q8-3ch8-vqpv bun.lock
high osv/GHSA-f6ww-3ggp-fr8h: @xmldom/[email protected] (npm) is affected by GHSA-f6ww-3ggp-fr8h bun.lock
high osv/GHSA-j759-j44w-7fr8: @xmldom/[email protected] (npm) is affected by GHSA-j759-j44w-7fr8 bun.lock
high osv/GHSA-w2rr-34g9-rvrj: @xmldom/[email protected] (npm) is affected by GHSA-w2rr-34g9-rvrj bun.lock
high osv/GHSA-wh4c-j3r5-mjhp: @xmldom/[email protected] (npm) is affected by GHSA-wh4c-j3r5-mjhp bun.lock
high osv/GHSA-x4fp-j954-r2f4: @xmldom/[email protected] (npm) is affected by GHSA-x4fp-j954-r2f4 bun.lock
high osv/GHSA-x6wf-f3px-wcqx: @xmldom/[email protected] (npm) is affected by GHSA-x6wf-f3px-wcqx bun.lock
high osv/GHSA-3jxr-9vmj-r5cp: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp bun.lock
high osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p bun.lock
high osv/GHSA-mh99-v99m-4gvg: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg bun.lock
high osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 bun.lock
high osv/GHSA-rgw5-rvv9-x895: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 bun.lock
high osv/GHSA-3jxr-9vmj-r5cp: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp bun.lock
high osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p bun.lock
high osv/GHSA-mh99-v99m-4gvg: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg bun.lock
high osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 bun.lock
high osv/GHSA-rgw5-rvv9-x895: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 bun.lock

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 1,224; test lines: 0
Language Lines
JavaScript 1,224