ds-sebastian/pricecious

AI Price Tracker

https://github.com/ds-sebastian/pricecious · commit a086bb9696af · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/ds-sebastian/pricecious
Commit: a086bb9696af822d8352f5a20ca441fb4c0fd5fe
Generated: 2026-11-13T23:58:22+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	25	explicit	95%	100%
Code quality	72	adequate	90%	100%
Security	67	weak	85%	100%

AI provenance

Explicit AI attribution on 25% of first-party code added; an estimated 25% including velocity signals.

Explicitly attributed share (lower bound): 25.3%
Unattributed share in AI-consistent velocity bursts: 24.8%
Estimated AI-generated share: 25.3%

AI tool	Attributed commits	Lines added
GitHub Copilot coding agent	21	353
Claude Code	18	7,709

Current source lines last changed by AI-attributed commits: 5,705 of 6,426.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	2.98	0.0	n/a
Security	0.526	0.0	n/a

Month	Lines added	Attributed to AI
2025-11	11,378	0%
2025-12	9,826	0%
2026-02	52	100%
2026-03	874	34%
2026-05	1,159	0%
2026-06	3	0%
2026-07	804	0%
2026-09	7,709	100%
2026-11	13	0%

Evidence

Claude Code: author email [email protected] (b92eecfc5fad)
Claude Code: author email [email protected] (0daa26a54a5f)
Claude Code: trailer 'Co-authored-by: Claude' (a675cd19eceb)
Claude Code: author email [email protected] (1ea5aca4cea8)
Claude Code: author email [email protected] (00a9a8f283aa)
Claude Code: author email [email protected] (275e865d8164)
Claude Code: author email [email protected] (baa4976bc9e6)
Claude Code: author email [email protected] (eb3378f8cca5)
Claude Code: author email [email protected] (e3cf5b2effa2)
Claude Code: author email [email protected] (0efb796a5750)
Claude Code: author email [email protected] (2e5ba512a674)
Claude Code: author email [email protected] (a0dcc9987c86)
Claude Code: author email [email protected] (3ba40dfcf76e)
Claude Code: author email [email protected] (eaf42990cc9b)
Claude Code: author email [email protected] (62300c584575)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.31, CI runs tests; 21% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	54
Duplication	95
Code smells (Opengrep)	55
Tests and CI	90
Documentation	85
Type safety	0
Process (Scorecard review/maintenance)	n/a

Functions: 404; mean complexity 2.7, 90th percentile 6; 3 complex and 5 long functions
Duplicated lines: 0.8% of 4,805 compared
Tests: 1,980 test lines for 6,426 source lines (ratio 0.31); CI test commands: pytest; 78% of recent source commits also change tests
Docs missing or thin: contributing

Most complex functions:

Security

Security posture is weak: 15 known vulnerabilities in 3 dependencies; 5 high-severity SAST findings; 15 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	70
Vulnerable dependencies (OSV)	73
CI workflows (zizmor)	5
Posture (policy, updates, signing, lockfiles)	60
OpenSSF Scorecard	n/a

Known vulnerabilities: 15 in 3 packages (critical 0, high 2, medium 10, low 3)
Posture checks passed: dependency updates, signed commits, lockfiles; missing: security policy

Top findings

Severity	Finding	Location
high	`opengrep/javascript.lang.security.detect-insecure-websocket`: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]	.env.example:5
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	Dockerfile:19
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	Dockerfile:21
high	`opengrep/javascript.lang.security.detect-insecure-websocket`: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]	app/scraper.py:24
high	`opengrep/javascript.lang.security.detect-insecure-websocket`: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]	app/scraper.py:343
high	`osv/GHSA-v4x8-3wr5-3wq8`: [email protected] (PyPI) is affected by GHSA-v4x8-3wr5-3wq8	uv.lock
high	`osv/GHSA-3jp2-3mrg-2vxc`: [email protected] (PyPI) is affected by GHSA-3jp2-3mrg-2vxc	uv.lock
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:35
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:36
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:53
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:54
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:73
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:77
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:80
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:84
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:92
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:103
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:128
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:131
high	`zizmor/cache-poisoning`: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	.github/workflows/ci.yml:36
high	`zizmor/cache-poisoning`: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	.github/workflows/ci.yml:54
high	`zizmor/bot-conditions`: spoofable bot actor check [confidence high]	.github/workflows/dependabot-auto-merge.yml:12
medium	`opengrep/python.flask.security.audit.directly-returned-format-string`: Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. [confidence medium]	app/main.py:64
medium	`osv/GHSA-6627-m3xw-93mp`: [email protected] (PyPI) is affected by GHSA-6627-m3xw-93mp	uv.lock
medium	`osv/GHSA-69hj-f68j-2879`: [email protected] (PyPI) is affected by GHSA-69hj-f68j-2879	uv.lock

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 6,426; test lines: 1,980

Language	Lines
Python	5,190
JavaScript	3,216

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/ds-sebastian/pricecious/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/ds-sebastian/pricecious/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/ds-sebastian/pricecious/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/ds-sebastian/pricecious/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/ds-sebastian/pricecious/security.svg)](https://repotrust.synapticcyber.com/r/github.com/ds-sebastian/pricecious/)