Leaderboard github.com

dobin/REvAId

AI Assisted Binary REversing AId

View repository ↗
Python
★ 2
commit 773676b1533f
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

possible

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

78/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

53/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% possible

Weak signals consistent with AI-assisted development.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts30%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace7
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.09

Lines added per month all AI-attributed share

2026-0831,095 · 0% AI
2026-0921,379 · 0% AI
2026-10346 · 0% AI
2026-110 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 172
effective_loc: 52,820
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok7 items

excluded_import_loc: 12,939
flagged_loc: 15,750
flagged_loc_share: 39.5%
flagged_units: 7
max_loc_per_hour: 2,973.10
measured_loc: 39,881
median_loc_per_hour: 169.51
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 72

Release velocityskipped

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 5
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 1
files:narrated_steps: 0
files:placeholder: 0
index: 0.09
lines_scanned: 29,362
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.17
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

78 adequate

Code quality is adequate: test-to-source ratio 0.56, CI runs tests; 10% of function code in complex or long functions; 10% duplicated lines. Weakest area: duplication.

How the score is built

Complexity74
Duplication56
Lint and smells68
Tests and CI100
Documentation65
Type safety100
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 12
function_nloc: 15,022
functions: 1,138
long_functions: 6
many_param_functions: 26
mean_ccn: 2.77
p90_ccn: 7
risky_nloc_share: 10.2%

Duplication (jscpd)ok10 items

compared_lines: 21,585
duplicated_lines: 2,092
duplicated_share: 9.7%
files: 264

Lintok

category:best-practice: 7
category:maintainability: 33
findings: 40
scanned_lines: 29,299
weighted_findings: 46

Tests and CIok3 items

CI config: .github/workflows/ci.yml .github/workflows/ci.yml
CI runs tests (pytest, npm run test, vitest)
CI runs linters (ruff, mypy, eslint)

check:ci_present: yes
check:ci_runs_lint: yes
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: yes
check:tests_cochange: yes
ci_files: 1
cochange_commits: 136
cochange_share: 67.7%
source_lines: 29,362
test_lines: 16,363
test_ratio: 0.56

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 119

Type safetyok2 items

Python strict type checking: backend/pyproject.toml backend/pyproject.toml
TypeScript strict type checking: frontend/tsconfig.app.json frontend/tsconfig.app.json

check:low_escape_density: yes
check:strict_config: yes
escapes: 75
escapes_per_kloc: 2.63

Security

53 weak

Security posture is weak: 64 known vulnerabilities in 22 dependencies; 10 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)87
Vulnerable dependencies6
CI workflows30
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 63
declared: 63
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 14
findings_high: 10
findings_low: 0
findings_medium: 4
parse_errors: 2
scanned_lines: 29,299
weighted_findings: 11.65

Dependencies (osv-scanner)ok

penalty: 174
vulnerabilities: 64
vulnerable_packages: 22
vulns_critical: 5
vulns_high: 18
vulns_low: 5
vulns_medium: 36
vulns_unknown: 0

CI workflows (zizmor)ok

findings: 12
findings_high: 5
findings_low: 0
findings_medium: 7
penalty: 73.20
workflows: 1

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 0.6%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

5 critical36 high84 medium5 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-6q48-6c7w-9gw2`	backend/uv.lock	[email protected] (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2	Dependencies (osv-scanner)
critical	`osv/GHSA-7hp6-4w63-5g45`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-7hp6-4w63-5g45	Dependencies (osv-scanner)
critical	`osv/GHSA-5gmw-xhrv-c9v3`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3	Dependencies (osv-scanner)
critical	`osv/GHSA-5xrq-8626-4rwp`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-5xrq-8626-4rwp	Dependencies (osv-scanner)
critical	`osv/GHSA-85c8-ppgw-ccpr`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr	Dependencies (osv-scanner)
high	`opengrep/python.lang.maintainability.useless-inner-function`	backend/src/revaid/db/engine.py:33	function `_set_sqlite_pragmas` is defined inside a function but never used	Lint
high	`opengrep/python.lang.maintainability.useless-inner-function`	backend/src/revaid_contracts/app_base.py:29	function `request_id_middleware` is defined inside a function but never used	Lint
high	`opengrep/python.lang.maintainability.useless-inner-function`	backend/src/revaid_ui/db/engine.py:24	function `set_sqlite_pragmas` is defined inside a function but never used	Lint
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:16	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:19	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:48	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:50	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:75	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	backend/src/revaid/cli/dbtools.py:21	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text`	backend/src/revaid/cli/dbtools.py:62	sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here....	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit`	backend/src/revaid/cli/ingest.py:171	Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	backend/src/revaid/db/engine.py:38	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	backend/src/revaid/db/engine.py:39	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit`	backend/src/revaid/ingestion/import_jobs.py:322	Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text`	backend/src/revaid/repositories/functions.py:468	sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here....	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text`	backend/src/revaid_ui/cli/dbtools.py:26	sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here....	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	backend/src/revaid_ui/db/engine.py:29	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`	backend/src/revaid_ui/db/engine.py:30	Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used...	Static analysis (opengrep)
high	`osv/GHSA-2g87-pp6c-29x5`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-2g87-pp6c-29x5	Dependencies (osv-scanner)
high	`osv/GHSA-5wr8-gcqf-gqf3`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-5wr8-gcqf-gqf3	Dependencies (osv-scanner)
high	`osv/GHSA-8988-9cw3-xx77`	backend/uv.lock	[email protected] (PyPI) is affected by PYSEC-2026-4175, GHSA-8988-9cw3-xx77	Dependencies (osv-scanner)
high	`osv/GHSA-9xw5-w5jj-pvcg`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-9xw5-w5jj-pvcg	Dependencies (osv-scanner)
high	`osv/GHSA-v4x8-3wr5-3wq8`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-v4x8-3wr5-3wq8	Dependencies (osv-scanner)
high	`osv/GHSA-vxq7-64xx-v4gw`	backend/uv.lock	[email protected] (PyPI) is affected by PYSEC-2026-4177, GHSA-vxq7-64xx-v4gw	Dependencies (osv-scanner)
high	`osv/GHSA-x33g-cr3x-6449`	backend/uv.lock	[email protected] (PyPI) is affected by PYSEC-2026-4183, GHSA-x33g-cr3x-6449	Dependencies (osv-scanner)
high	`osv/GHSA-2883-xcg3-v3hh`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-2883-xcg3-v3hh	Dependencies (osv-scanner)
high	`osv/GHSA-587h-7wmj-h5pm`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	Dependencies (osv-scanner)
high	`osv/GHSA-587h-7wmj-h5pm`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	Dependencies (osv-scanner)
high	`osv/GHSA-68fv-2mgg-jv7q`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	Dependencies (osv-scanner)
high	`osv/GHSA-6j4f-fj2g-mc7p`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	Dependencies (osv-scanner)
high	`osv/GHSA-mrhx-c7xc-m3w5`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	Dependencies (osv-scanner)
high	`osv/GHSA-qhr7-859c-m2p7`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	Dependencies (osv-scanner)
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/adapters/ghidra/file.py:53	Is "is_entry_point" a function or an attribute? If it is a function, you may have meant fn.is_entry_point() because fn.is_entry_point is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:150	Is "is_entry_point" a function or an attribute? If it is a function, you may have meant function.is_entry_point() because function.is_entry_point is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:151	Is "is_featured" a function or an attribute? If it is a function, you may have meant function.is_featured() because function.is_featured is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:152	Is "is_utility_effective" a function or an attribute? If it is a function, you may have meant function.is_utility_effective() because function.is_utility_effective is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:414	Is "is_entry_point" a function or an attribute? If it is a function, you may have meant dto.is_entry_point() because dto.is_entry_point is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:415	Is "is_featured" a function or an attribute? If it is a function, you may have meant function.is_featured() because function.is_featured is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:416	Is "is_utility" a function or an attribute? If it is a function, you may have meant dto.is_utility() because dto.is_utility is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:458	Is "is_writable" a function or an attribute? If it is a function, you may have meant row.item.is_writable() because row.item.is_writable is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:582	Is "is_featured" a function or an attribute? If it is a function, you may have meant Function.is_featured() because Function.is_featured is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:662	Is "is_utility_effective" a function or an attribute? If it is a function, you may have meant row.function.is_utility_effective() because row.function.is_utility_effective is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/api/routers/internal.py:665	Is "is_self" a function or an attribute? If it is a function, you may have meant row.is_self() because row.is_self is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/ingestion/pe_data/enrich.py:137	Is "is_writable" a function or an attribute? If it is a function, you may have meant i.is_writable() because i.is_writable is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/ingestion/pipeline.py:212	Is "is_entry_point" a function or an attribute? If it is a function, you may have meant raw_fn.is_entry_point() because raw_fn.is_entry_point is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/ingestion/pipeline.py:75	Is "is_entry_point" a function or an attribute? If it is a function, you may have meant raw_fn.is_entry_point() because raw_fn.is_entry_point is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/repositories/data_items.py:94	Is "is_writable" a function or an attribute? If it is a function, you may have meant i.is_writable() because i.is_writable is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/repositories/functions.py:498	Is "is_entry_point" a function or an attribute? If it is a function, you may have meant Function.is_entry_point() because Function.is_entry_point is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/repositories/neighbours.py:134	Is "is_utility_effective" a function or an attribute? If it is a function, you may have meant Function.is_utility_effective() because Function.is_utility_effective is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/repositories/neighbours.py:141	Is "is_utility_effective" a function or an attribute? If it is a function, you may have meant Function.is_utility_effective() because Function.is_utility_effective is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/repositories/neighbours.py:163	Is "is_utility_effective" a function or an attribute? If it is a function, you may have meant Function.is_utility_effective() because Function.is_utility_effective is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/schemas/function.py:88	Is "is_utility_effective" a function or an attribute? If it is a function, you may have meant fn.is_utility_effective() because fn.is_utility_effective is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/schemas/function.py:91	Is "is_entry_point" a function or an attribute? If it is a function, you may have meant fn.is_entry_point() because fn.is_entry_point is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/schemas/mcp.py:236	Is "is_entry_point" a function or an attribute? If it is a function, you may have meant base.is_entry_point() because base.is_entry_point is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/schemas/mcp.py:363	Is "is_writable" a function or an attribute? If it is a function, you may have meant item.is_writable() because item.is_writable is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/schemas/search.py:36	Is "is_utility_effective" a function or an attribute? If it is a function, you may have meant fn.is_utility_effective() because fn.is_utility_effective is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid/schemas/search.py:39	Is "is_entry_point" a function or an attribute? If it is a function, you may have meant fn.is_entry_point() because fn.is_entry_point is always true.	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	backend/src/revaid/summarization/queue.py:63	`return` only makes sense inside a function	Lint
medium	`opengrep/python.lang.maintainability.return-not-in-function`	backend/src/revaid_contracts/events.py:52	`return` only makes sense inside a function	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid_ui/services/neighbour_service.py:80	Is "is_renamed" a function or an attribute? If it is a function, you may have meant row.is_renamed() because row.is_renamed is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid_ui/services/neighbour_service.py:86	Is "is_utility" a function or an attribute? If it is a function, you may have meant row.is_utility() because row.is_utility is always true.	Lint
medium	`opengrep/python.lang.maintainability.is-function-without-parentheses`	backend/src/revaid_ui/services/neighbour_service.py:89	Is "is_self" a function or an attribute? If it is a function, you may have meant row.is_self() because row.is_self is always true.	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	frontend/src/features/neighbours/NeighbourTable.tsx:103	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	frontend/src/features/neighbours/UtilityGroup.tsx:122	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	frontend/src/features/search/FunctionSearchDialog.tsx:75	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	frontend/src/features/sidebar/Sidebar.tsx:123	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	frontend/src/features/sidebar/Sidebar.tsx:124	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-spreading`	frontend/src/features/sidebar/Sidebar.tsx:125	It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious...	Lint
medium	`opengrep/typescript.react.best-practice.react-props-in-state`	frontend/src/hooks/useDebouncedValue.ts:8	Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.	Lint
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yml:1	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yml:16	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yml:41	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yml:48	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yml:71	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yml:75	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yml:9	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`opengrep/python.lang.security.audit.formatted-sql-query`	backend/src/revaid/db/engine.py:38	Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.formatted-sql-query`	backend/src/revaid/db/engine.py:39	Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.formatted-sql-query`	backend/src/revaid_ui/db/engine.py:29	Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.formatted-sql-query`	backend/src/revaid_ui/db/engine.py:30	Detected possible formatted SQL query. Use parameterized queries instead. [confidence low]	Static analysis (opengrep)
medium	`osv/GHSA-42vr-xj54-vc7v`	backend/uv.lock	[email protected] (PyPI) is affected by PYSEC-2026-4141, GHSA-42vr-xj54-vc7v	Dependencies (osv-scanner)
medium	`osv/GHSA-494j-54xm-rwp3`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-494j-54xm-rwp3	Dependencies (osv-scanner)
medium	`osv/GHSA-54p9-h82j-f925`	backend/uv.lock	[email protected] (PyPI) is affected by PYSEC-2026-4244, GHSA-54p9-h82j-f925	Dependencies (osv-scanner)
medium	`osv/GHSA-5639-2j2p-m4mx`	backend/uv.lock	[email protected] (PyPI) is affected by PYSEC-2026-4243, GHSA-5639-2j2p-m4mx	Dependencies (osv-scanner)
medium	`osv/GHSA-6627-m3xw-93mp`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-6627-m3xw-93mp	Dependencies (osv-scanner)
medium	`osv/GHSA-69hj-f68j-2879`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-69hj-f68j-2879	Dependencies (osv-scanner)
medium	`osv/GHSA-6cjc-53gc-5rqm`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-6cjc-53gc-5rqm	Dependencies (osv-scanner)
medium	`osv/GHSA-8mx5-7m5m-r77g`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-8mx5-7m5m-r77g	Dependencies (osv-scanner)
medium	`osv/GHSA-9c4x-gm8v-wgc4`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-9c4x-gm8v-wgc4	Dependencies (osv-scanner)
medium	`osv/GHSA-cwqr-hh33-gh44`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-cwqr-hh33-gh44	Dependencies (osv-scanner)
medium	`osv/GHSA-f9xw-jh8m-3mwq`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-f9xw-jh8m-3mwq	Dependencies (osv-scanner)
medium	`osv/GHSA-fq56-3cx3-fjxp`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-fq56-3cx3-fjxp	Dependencies (osv-scanner)
medium	`osv/GHSA-gh4c-6fx4-qh6g`	backend/uv.lock	[email protected] (PyPI) is affected by PYSEC-2026-4176, GHSA-gh4c-6fx4-qh6g	Dependencies (osv-scanner)
medium	`osv/GHSA-j8f7-rjxc-mr56`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-j8f7-rjxc-mr56	Dependencies (osv-scanner)
medium	`osv/GHSA-m462-7rxw-wvpg`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-m462-7rxw-wvpg	Dependencies (osv-scanner)
medium	`osv/GHSA-mf5v-w3w3-f6cg`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-mf5v-w3w3-f6cg	Dependencies (osv-scanner)
medium	`osv/GHSA-pqxq-w44r-73xw`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-pqxq-w44r-73xw	Dependencies (osv-scanner)
medium	`osv/GHSA-rfpc-qcw5-3pc4`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-rfpc-qcw5-3pc4	Dependencies (osv-scanner)
medium	`osv/GHSA-xcq7-p3pf-p88h`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-xcq7-p3pf-p88h	Dependencies (osv-scanner)
medium	`osv/GHSA-4w7w-66w2-5vf9`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9	Dependencies (osv-scanner)
medium	`osv/GHSA-67mh-4wv8-2f99`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-67mh-4wv8-2f99	Dependencies (osv-scanner)
medium	`osv/GHSA-698v-4r3x-3vcv`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-698v-4r3x-3vcv	Dependencies (osv-scanner)
medium	`osv/GHSA-698v-4r3x-3vcv`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-698v-4r3x-3vcv	Dependencies (osv-scanner)
medium	`osv/GHSA-82fw-gwwq-j7x9`	frontend/package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9	Dependencies (osv-scanner)
medium	`osv/GHSA-82fw-gwwq-j7x9`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9	Dependencies (osv-scanner)
medium	`osv/GHSA-fx2h-pf6j-xcff`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff	Dependencies (osv-scanner)
medium	`osv/GHSA-g3hv-75wg-m249`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr	Dependencies (osv-scanner)
medium	`osv/GHSA-q2hr-2g5m-vwhr`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr	Dependencies (osv-scanner)
medium	`osv/GHSA-qxg6-89mg-rqv8`	frontend/package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8	Dependencies (osv-scanner)
medium	`osv/GHSA-r825-w8mm-5pxw`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-r825-w8mm-5pxw	Dependencies (osv-scanner)
medium	`osv/GHSA-r825-w8mm-5pxw`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-r825-w8mm-5pxw	Dependencies (osv-scanner)
medium	`osv/GHSA-rq7h-c2jc-7f22`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22	Dependencies (osv-scanner)
medium	`osv/GHSA-rq7h-c2jc-7f22`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22	Dependencies (osv-scanner)
medium	`osv/GHSA-v6wh-96g9-6wx3`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3	Dependencies (osv-scanner)
low	`osv/GHSA-567q-5qvw-pf92`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-567q-5qvw-pf92	Dependencies (osv-scanner)
low	`osv/GHSA-9vhv-jxww-xfm5`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-9vhv-jxww-xfm5	Dependencies (osv-scanner)
low	`osv/GHSA-gx76-c99x-2c96`	backend/uv.lock	[email protected] (PyPI) is affected by GHSA-gx76-c99x-2c96	Dependencies (osv-scanner)
low	`osv/GHSA-9jrq-w75r-8gcw`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw	Dependencies (osv-scanner)
low	`osv/GHSA-9jrq-w75r-8gcw`	frontend/package-lock.json	[email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw	Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	40
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	12
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	64
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	14
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`773676b1533f`	`prov-5+qual-2+sec-2`	0%	78	53
2026-11-14	`773676b1533f`	`prov-4+qual-2+sec-2`	0%	78	53

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/dobin/REvAId/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/dobin/REvAId/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/dobin/REvAId/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/dobin/REvAId/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/dobin/REvAId/security.svg)](https://repotrust.synapticcyber.com/r/github.com/dobin/REvAId/)

Full text report

Repository: https://github.com/dobin/REvAId
Commit: 773676b1533fe2e8fb9063a013bbb59abc006f38
Generated: 2026-11-14T14:52:04+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	65%	100%
Code quality	78	adequate	90%	100%
Security	53	weak	85%	100%

AI provenance

Weak signals consistent with AI-assisted development.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 29.8%
Estimated AI-generated share: 0.0%
Stylometry index: 0.09 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 5). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-08	31,095	0%
2026-09	21,379	0%
2026-10	346	0%

Evidence

2,689 lines of first-party code in ~0.9h (2,973 lines/hour, 1 commit session) (c4085947dc52)
2,568 lines of first-party code in ~1.9h (1,372 lines/hour, 2 commit session) (1ae04d86c170)
2,250 lines of first-party code in ~2.3h (962 lines/hour, 1 commit session) (79fb5c9371d4)
1,447 lines of first-party code in ~1.7h (855 lines/hour, 2 commit session) (4b816d601528)
3,033 lines of first-party code in ~4.0h (758 lines/hour, 1 commit session) (328afa6a522e)
2,559 lines of first-party code in ~4.2h (603 lines/hour, 2 commit session) (5e5f36cd7c90)
1,204 lines of first-party code in ~2.4h (510 lines/hour, 1 commit session) (a8075be31766)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.56, CI runs tests; 10% of function code in complex or long functions; 10% duplicated lines. Weakest area: duplication.

Area	Score
Complexity (lizard)	74
Duplication	56
Code smells (Opengrep)	68
Tests and CI	100
Documentation	65
Type safety	100
Process (Scorecard review/maintenance)	n/a

Functions: 1,138; mean complexity 2.8, 90th percentile 7; 12 complex and 6 long functions
Duplicated lines: 9.7% of 21,585 compared
Tests: 16,363 test lines for 29,362 source lines (ratio 0.56); CI test commands: pytest, npm run test, vitest; 68% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 64 known vulnerabilities in 22 dependencies; 10 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	87
Vulnerable dependencies (OSV)	6
CI workflows (zizmor)	30
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 64 in 22 packages (critical 5, high 18, medium 36, low 5)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-6q48-6c7w-9gw2`: [email protected] (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2	backend/uv.lock
critical	`osv/GHSA-7hp6-4w63-5g45`: [email protected] (PyPI) is affected by GHSA-7hp6-4w63-5g45	backend/uv.lock
critical	`osv/GHSA-5gmw-xhrv-c9v3`: [email protected] (npm) is affected by GHSA-5gmw-xhrv-c9v3	frontend/package-lock.json
critical	`osv/GHSA-85c8-ppgw-ccpr`: [email protected] (npm) is affected by GHSA-85c8-ppgw-ccpr	frontend/package-lock.json
critical	`osv/GHSA-5xrq-8626-4rwp`: [email protected] (npm) is affected by GHSA-5xrq-8626-4rwp	frontend/package-lock.json
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	backend/src/revaid/cli/dbtools.py:21
high	`opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text`: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]	backend/src/revaid/cli/dbtools.py:62
high	`opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit`: Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	backend/src/revaid/cli/ingest.py:171
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	backend/src/revaid/db/engine.py:38
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	backend/src/revaid/db/engine.py:39
high	`opengrep/python.lang.security.audit.dangerous-asyncio-create-exec-audit`: Detected 'create_subprocess_exec' function without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	backend/src/revaid/ingestion/import_jobs.py:322
high	`opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text`: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]	backend/src/revaid/repositories/functions.py:468
high	`opengrep/python.sqlalchemy.security.audit.avoid-sqlalchemy-text`: sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to const [confidence medium]	backend/src/revaid_ui/cli/dbtools.py:26
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	backend/src/revaid_ui/db/engine.py:29
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	backend/src/revaid_ui/db/engine.py:30
high	`osv/GHSA-2g87-pp6c-29x5`: [email protected] (PyPI) is affected by GHSA-2g87-pp6c-29x5	backend/uv.lock
high	`osv/GHSA-5wr8-gcqf-gqf3`: [email protected] (PyPI) is affected by GHSA-5wr8-gcqf-gqf3	backend/uv.lock
high	`osv/GHSA-9xw5-w5jj-pvcg`: [email protected] (PyPI) is affected by GHSA-9xw5-w5jj-pvcg	backend/uv.lock
high	`osv/GHSA-v4x8-3wr5-3wq8`: [email protected] (PyPI) is affected by GHSA-v4x8-3wr5-3wq8	backend/uv.lock
high	`osv/GHSA-x33g-cr3x-6449`: [email protected] (PyPI) is affected by PYSEC-2026-4183, GHSA-x33g-cr3x-6449	backend/uv.lock
high	`osv/GHSA-8988-9cw3-xx77`: [email protected] (PyPI) is affected by PYSEC-2026-4175, GHSA-8988-9cw3-xx77	backend/uv.lock
high	`osv/GHSA-vxq7-64xx-v4gw`: [email protected] (PyPI) is affected by PYSEC-2026-4177, GHSA-vxq7-64xx-v4gw	backend/uv.lock
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	frontend/package-lock.json
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	frontend/package-lock.json
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	frontend/package-lock.json

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 29,362; test lines: 16,363

Language	Lines
Python	28,253
TypeScript	16,589
Java	727
PowerShell	63
JavaScript	56
Shell	37