google-gemini/glanceboard

https://github.com/google-gemini/glanceboard · commit 14db572628b7 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/google-gemini/glanceboard
Commit: 14db572628b70312025ee19c5de6228cc4ad7c27
Generated: 2026-11-13T23:52:01+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	40%	100%
Code quality	28	poor	90%	100%
Security	52	weak	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
Stylometry index: 14.02 per 1,000 lines (narrated steps 8, placeholders 0, assistant phrasing 0, emoji 231). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-07	8,811	0%

Evidence

step-by-step narration comment: // Step 1: API Key → Next (web/src/main)
step-by-step narration comment: // Step 1: Skip (web/src/main)
step-by-step narration comment: // Step 2: Calendar/iCal → Next (web/src/main)
step-by-step narration comment: // Step 2: Back (web/src/main)
step-by-step narration comment: // Step 4: Geocode location (web/src/main)
step-by-step narration comment: // Step 3: Next → Summary (web/src/main)
step-by-step narration comment: // Step 3: Back (web/src/main)
step-by-step narration comment: // Step 5: Finish (web/src/main)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 34% of function code in complex or long functions; 37% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	36
Duplication	11
Code smells (Opengrep)	44
Tests and CI	0
Documentation	80
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 308; mean complexity 5.2, 90th percentile 13; 19 complex and 5 long functions
Duplicated lines: 36.9% of 6,817 compared
Tests: 0 test lines for 8,811 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: changelog

Most complex functions:

Security

Security posture is weak: 139 known vulnerabilities in 11 dependencies; 32 high-severity SAST findings. Weakest area: dependencies.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	28
Vulnerable dependencies (OSV)	24
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	40
OpenSSF Scorecard	n/a

Known vulnerabilities: 139 in 11 packages (critical 12, high 81, medium 38, low 5)
Posture checks passed: security policy, lockfiles; missing: dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-5x8w-8jj5-q52h`: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h	functions/requirements.txt
critical	`osv/GHSA-8g5g-8vmr-9782`: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782	functions/requirements.txt
critical	`osv/GHSA-xvh5-g6gv-559v`: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v	functions/requirements.txt
critical	`osv/GHSA-3f63-hfp8-52jq`: [email protected] (PyPI) is affected by PYSEC-2026-457, GHSA-3f63-hfp8-52jq	functions/requirements.txt
critical	`osv/GHSA-332p-7hrc-92wf`: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf	functions/requirements.txt
critical	`osv/GHSA-w889-685w-c8fh`: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh	functions/requirements.txt
critical	`osv/GHSA-5x8w-8jj5-q52h`: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h	server/requirements.txt
critical	`osv/GHSA-8g5g-8vmr-9782`: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782	server/requirements.txt
critical	`osv/GHSA-v9pv-5gc8-w2m6`: [email protected] (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6	server/requirements.txt
critical	`osv/GHSA-xvh5-g6gv-559v`: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v	server/requirements.txt
critical	`osv/GHSA-332p-7hrc-92wf`: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf	server/requirements.txt
critical	`osv/GHSA-w889-685w-c8fh`: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh	server/requirements.txt
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:562
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `$("#latest-image-container").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:562
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:776
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tray.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:776
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:827
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `el.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:827
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:888
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `ghost.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:888
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:943
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `ghost.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:943
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:1050
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:1050
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	web/src/main.js:1130

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 8,811; test lines: 0

Language	Lines
Python	6,036
JavaScript	2,376
Shell	399

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/google-gemini/glanceboard/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/google-gemini/glanceboard/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/google-gemini/glanceboard/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/google-gemini/glanceboard/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/google-gemini/glanceboard/security.svg)](https://repotrust.synapticcyber.com/r/github.com/google-gemini/glanceboard/)