RepoTrust

Leaderboard github.com

jarirantala/ai-marketplace

Collection of Finnish and european AI services

  • View repository ↗
  • TypeScript
  • ★ 0
  • commit 13d02189442a
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

none-detected

Confidence
61%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

30/100

poor

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

48/100

poor

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

  • Explicitly attributed share0%
  • Unattributed share in AI-pace bursts0%
  • Estimated AI-generated share0%
  • AI tool configuration files0
  • Work sessions at AI pace0
  • Releases at AI pacenot measured
  • Coding-style index (1.0+ means possible)0.00

Lines added per month all AI-attributed share

  1. 2025-06876 · 0% AI
  2. 2025-08334 · 0% AI

Evidence by analyzer

Explicit AI attributionok
attributed_commit_share
0.0%
attributed_commits
0
attributed_loc
0
attributed_loc_share
0.0%
commits
84
effective_loc
1,210
tools_detected
0
AI tool configurationok
artifacts
0
tools_configured
0
workflow_agents
0
Commit velocityok
excluded_import_loc
0
flagged_loc
0
flagged_loc_share
0.0%
flagged_units
0
max_loc_per_hour
83.50
measured_loc
1,210
median_loc_per_hour
57.68
pr_timed_units
0
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
13
Release velocityskipped
Coding styleok
count:assistant_voice
0
count:emoji_in_code
0
count:narrated_steps
0
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
0
files:narrated_steps
0
files:placeholder
0
index
0
lines_scanned
736
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0
per_kloc:narrated_steps
0
per_kloc:placeholder
0

Code quality

30 poor

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 34% of function code in complex or long functions; 17% duplicated lines. Weakest area: testing.

How the score is built

  • Complexity36
  • Duplication37
  • Lint and smells37
  • Tests and CI0
  • Documentation60
  • Type safety60
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok2 items
complex_functions
1
function_nloc
524
functions
55
long_functions
1
many_param_functions
0
mean_ccn
2.35
p90_ccn
4
risky_nloc_share
34.2%
Duplication (jscpd)ok2 items
compared_lines
539
duplicated_lines
90
duplicated_share
16.7%
files
12
Lintok
category:best-practice
4
findings
4
scanned_lines
736
weighted_findings
4
Tests and CIok
check:ci_present
no
check:ci_runs_lint
no
check:ci_runs_tests
no
check:has_tests
no
check:test_ratio
no
check:tests_cochange
no
ci_files
0
cochange_commits
49
cochange_share
0.0%
source_lines
736
test_lines
0
test_ratio
0
Documentationok3 items
  • README.md README.md
  • LICENSE LICENSE
  • CONTRIBUTING.md CONTRIBUTING.md
check:changelog
no
check:contributing
yes
check:license
yes
check:readme
no
readme_lines
3
Type safetyok1 item
  • TypeScript strict type checking: tsconfig.json tsconfig.json
check:low_escape_density
no
check:strict_config
yes
escapes
8
escapes_per_kloc
8

Security

48 poor

Security posture is poor: 159 known vulnerabilities in 54 dependencies; 2 high-severity SAST findings. Weakest area: posture.

How the score is built

  • Secrets97
  • Static analysis (SAST)59
  • Vulnerable dependencies0
  • CI workflowsnot measured
  • Security posture0
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
25
declared
25
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
1
secrets_nonprod
0
Static analysis (opengrep)ok
findings
2
findings_high
2
findings_low
0
findings_medium
0
parse_errors
0
scanned_lines
736
weighted_findings
1.50
Dependencies (osv-scanner)ok
penalty
397
vulnerabilities
159
vulnerable_packages
54
vulns_critical
7
vulns_high
82
vulns_low
19
vulns_medium
51
vulns_unknown
0
CI workflows (zizmor)skipped
Security postureok
check:dependency_updates
no
check:lockfiles
yes
check:security_policy
no
check:signed_commits
no
signed_commit_share
1.2%
unpinned_manifests
0
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

7 critical84 high55 medium20 low

SeverityRuleLocationMessageTool
critical osv/GHSA-2w6w-674q-4c4q package-lock.json [email protected] (npm) is affected by GHSA-2w6w-674q-4c4q Dependencies (osv-scanner)
critical osv/GHSA-5rq4-664w-9x2c package-lock.json [email protected] (npm) is affected by GHSA-5rq4-664w-9x2c Dependencies (osv-scanner)
critical osv/GHSA-8r5x-fm3f-whwj package-lock.json [email protected] (npm) is affected by GHSA-8r5x-fm3f-whwj Dependencies (osv-scanner)
critical osv/GHSA-jqcg-44mw-7w3h package-lock.json [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h Dependencies (osv-scanner)
critical osv/GHSA-m7jm-9gc2-mpf2 package-lock.json [email protected] (npm) is affected by GHSA-m7jm-9gc2-mpf2 Dependencies (osv-scanner)
critical osv/GHSA-p8wg-vrv2-v86f package-lock.json [email protected] (npm) is affected by GHSA-p8wg-vrv2-v86f Dependencies (osv-scanner)
critical osv/GHSA-wf6x-7x77-mvgw package-lock.json [email protected] (npm) is affected by GHSA-wf6x-7x77-mvgw Dependencies (osv-scanner)
high osv/GHSA-23c5-xmqv-rm74 package-lock.json [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 Dependencies (osv-scanner)
high osv/GHSA-23c5-xmqv-rm74 package-lock.json [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 Dependencies (osv-scanner)
high osv/GHSA-23c5-xmqv-rm74 package-lock.json [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 Dependencies (osv-scanner)
high osv/GHSA-23c5-xmqv-rm74 package-lock.json [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 Dependencies (osv-scanner)
high osv/GHSA-25h7-pfq9-p65f package-lock.json [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f Dependencies (osv-scanner)
high osv/GHSA-27r3-jxmh-p828 package-lock.json [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 Dependencies (osv-scanner)
high osv/GHSA-2883-xcg3-v3hh package-lock.json [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh Dependencies (osv-scanner)
high osv/GHSA-28wg-ghj8-5hjv package-lock.json [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv Dependencies (osv-scanner)
high osv/GHSA-2v37-7h3g-55p8 package-lock.json [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 Dependencies (osv-scanner)
high osv/GHSA-3f6p-5ww8-9rcr package-lock.json [email protected] (npm) is affected by GHSA-3f6p-5ww8-9rcr Dependencies (osv-scanner)
high osv/GHSA-3jxr-9vmj-r5cp package-lock.json [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp Dependencies (osv-scanner)
high osv/GHSA-3jxr-9vmj-r5cp package-lock.json [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp Dependencies (osv-scanner)
high osv/GHSA-3mfm-83xf-c92r package-lock.json [email protected] (npm) is affected by GHSA-3mfm-83xf-c92r Dependencies (osv-scanner)
high osv/GHSA-3ppc-4f35-3m26 package-lock.json [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 Dependencies (osv-scanner)
high osv/GHSA-3ppc-4f35-3m26 package-lock.json [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 Dependencies (osv-scanner)
high osv/GHSA-3ppc-4f35-3m26 package-lock.json [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 Dependencies (osv-scanner)
high osv/GHSA-3ppc-4f35-3m26 package-lock.json [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 Dependencies (osv-scanner)
high osv/GHSA-4c8g-83qw-93j6 package-lock.json [email protected] (npm) is affected by GHSA-4c8g-83qw-93j6 Dependencies (osv-scanner)
high osv/GHSA-52cp-r559-cp3m package-lock.json [email protected] (npm) is affected by GHSA-52cp-r559-cp3m Dependencies (osv-scanner)
high osv/GHSA-587h-7wmj-h5pm package-lock.json [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm Dependencies (osv-scanner)
high osv/GHSA-5j98-mcp5-4vw2 package-lock.json [email protected] (npm) is affected by GHSA-5j98-mcp5-4vw2 Dependencies (osv-scanner)
high osv/GHSA-5j98-mcp5-4vw2 package-lock.json [email protected] (npm) is affected by GHSA-5j98-mcp5-4vw2 Dependencies (osv-scanner)
high osv/GHSA-5p4m-2wfm-xmqj package-lock.json [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj Dependencies (osv-scanner)
high osv/GHSA-68fv-2mgg-jv7q package-lock.json [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q Dependencies (osv-scanner)
high osv/GHSA-6g55-p6wh-862q package-lock.json [email protected] (npm) is affected by GHSA-6g55-p6wh-862q Dependencies (osv-scanner)
high osv/GHSA-6j4f-fj2g-mc7p package-lock.json [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p Dependencies (osv-scanner)
high osv/GHSA-6j4f-fj2g-mc7p package-lock.json [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p Dependencies (osv-scanner)
high osv/GHSA-6v7q-wjvx-w8wg package-lock.json [email protected] (npm) is affected by GHSA-6v7q-wjvx-w8wg Dependencies (osv-scanner)
high osv/GHSA-73wf-gq98-2v4g package-lock.json [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g Dependencies (osv-scanner)
high osv/GHSA-7mx3-vvmw-hjmv package-lock.json @graphql-tools/[email protected] (npm) is affected by GHSA-7mx3-vvmw-hjmv Dependencies (osv-scanner)
high osv/GHSA-7mx3-vvmw-hjmv package-lock.json @graphql-tools/[email protected] (npm) is affected by GHSA-7mx3-vvmw-hjmv Dependencies (osv-scanner)
high osv/GHSA-7mx3-vvmw-hjmv package-lock.json @graphql-tools/[email protected] (npm) is affected by GHSA-7mx3-vvmw-hjmv Dependencies (osv-scanner)
high osv/GHSA-7mx3-vvmw-hjmv package-lock.json @graphql-tools/[email protected] (npm) is affected by GHSA-7mx3-vvmw-hjmv Dependencies (osv-scanner)
high osv/GHSA-7p8r-x3mc-p8w7 package-lock.json [email protected] (npm) is affected by GHSA-7p8r-x3mc-p8w7 Dependencies (osv-scanner)
high osv/GHSA-7r86-cg39-jmmj package-lock.json [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj Dependencies (osv-scanner)
high osv/GHSA-7r86-cg39-jmmj package-lock.json [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj Dependencies (osv-scanner)
high osv/GHSA-7r86-cg39-jmmj package-lock.json [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj Dependencies (osv-scanner)
high osv/GHSA-7r86-cg39-jmmj package-lock.json [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj Dependencies (osv-scanner)
high osv/GHSA-8gc5-j5rx-235r package-lock.json [email protected] (npm) is affected by GHSA-8gc5-j5rx-235r Dependencies (osv-scanner)
high osv/GHSA-999r-qq7v-r334 package-lock.json [email protected] (npm) is affected by GHSA-999r-qq7v-r334 Dependencies (osv-scanner)
high osv/GHSA-9cx6-37pm-9jff package-lock.json [email protected] (npm) is affected by GHSA-9cx6-37pm-9jff Dependencies (osv-scanner)
high osv/GHSA-c2c7-rcm5-vvqj package-lock.json [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj Dependencies (osv-scanner)
high osv/GHSA-c2c7-rcm5-vvqj package-lock.json [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj Dependencies (osv-scanner)
high osv/GHSA-c475-qrg2-pj4r package-lock.json [email protected] (npm) is affected by GHSA-c475-qrg2-pj4r Dependencies (osv-scanner)
high osv/GHSA-c83g-rgw3-j3cx package-lock.json [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx Dependencies (osv-scanner)
high osv/GHSA-f65p-4m7j-42xc package-lock.json [email protected] (npm) is affected by GHSA-f65p-4m7j-42xc Dependencies (osv-scanner)
high osv/GHSA-j3q9-mxjg-w52f package-lock.json [email protected] (npm) is affected by GHSA-j3q9-mxjg-w52f Dependencies (osv-scanner)
high osv/GHSA-jmr7-xgp7-cmfj package-lock.json [email protected] (npm) is affected by GHSA-jmr7-xgp7-cmfj Dependencies (osv-scanner)
high osv/GHSA-jqff-g426-hqxp package-lock.json [email protected] (npm) is affected by GHSA-jqff-g426-hqxp Dependencies (osv-scanner)
high osv/GHSA-mh99-v99m-4gvg package-lock.json [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg Dependencies (osv-scanner)
high osv/GHSA-mh99-v99m-4gvg package-lock.json [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg Dependencies (osv-scanner)
high osv/GHSA-mrhx-c7xc-m3w5 package-lock.json [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 Dependencies (osv-scanner)
high osv/GHSA-mrhx-c7xc-m3w5 package-lock.json [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 Dependencies (osv-scanner)
high osv/GHSA-mw96-cpmx-2vgc package-lock.json [email protected] (npm) is affected by GHSA-mw96-cpmx-2vgc Dependencies (osv-scanner)
high osv/GHSA-mwp4-54f8-5fhr package-lock.json [email protected] (npm) is affected by GHSA-mwp4-54f8-5fhr Dependencies (osv-scanner)
high osv/GHSA-p9ff-h696-f583 package-lock.json [email protected] (npm) is affected by GHSA-p9ff-h696-f583 Dependencies (osv-scanner)
high osv/GHSA-ph9p-34f9-6g65 package-lock.json [email protected] (npm) is affected by GHSA-ph9p-34f9-6g65 Dependencies (osv-scanner)
high osv/GHSA-q3j6-qgpj-74h6 package-lock.json [email protected] (npm) is affected by GHSA-q3j6-qgpj-74h6 Dependencies (osv-scanner)
high osv/GHSA-qhr7-859c-m2p7 package-lock.json [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 Dependencies (osv-scanner)
high osv/GHSA-qhr7-859c-m2p7 package-lock.json [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 Dependencies (osv-scanner)
high osv/GHSA-qjx8-664m-686j package-lock.json [email protected] (npm) is affected by GHSA-qjx8-664m-686j Dependencies (osv-scanner)
high osv/GHSA-qw65-cvwx-89v3 package-lock.json [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 Dependencies (osv-scanner)
high osv/GHSA-r28c-9q8g-f849 package-lock.json [email protected] (npm) is affected by GHSA-r28c-9q8g-f849 Dependencies (osv-scanner)
high osv/GHSA-r5fr-rjxr-66jc package-lock.json [email protected] (npm) is affected by GHSA-r5fr-rjxr-66jc Dependencies (osv-scanner)
high osv/GHSA-r5fr-rjxr-66jc package-lock.json [email protected] (npm) is affected by GHSA-r5fr-rjxr-66jc Dependencies (osv-scanner)
high osv/GHSA-rf6f-7fwh-wjgh package-lock.json [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh Dependencies (osv-scanner)
high osv/GHSA-rgw5-rvv9-x895 package-lock.json [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 Dependencies (osv-scanner)
high osv/GHSA-rgw5-rvv9-x895 package-lock.json [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 Dependencies (osv-scanner)
high osv/GHSA-rp42-5vxx-qpwr package-lock.json [email protected] (npm) is affected by GHSA-rp42-5vxx-qpwr Dependencies (osv-scanner)
high osv/GHSA-rpmf-866q-6p89 package-lock.json [email protected] (npm) is affected by GHSA-rpmf-866q-6p89 Dependencies (osv-scanner)
high osv/GHSA-v2hh-gcrm-f6hx package-lock.json [email protected] (npm) is affected by GHSA-v2hh-gcrm-f6hx Dependencies (osv-scanner)
high osv/GHSA-v39h-62p7-jpjc package-lock.json [email protected] (npm) is affected by GHSA-v39h-62p7-jpjc Dependencies (osv-scanner)
high osv/GHSA-v56q-mh7h-f735 package-lock.json [email protected] (npm) is affected by GHSA-v56q-mh7h-f735 Dependencies (osv-scanner)
high osv/GHSA-vcrf-j523-4mrf package-lock.json [email protected] (npm) is affected by GHSA-vcrf-j523-4mrf Dependencies (osv-scanner)
high osv/GHSA-w5hq-g745-h8pq package-lock.json [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq Dependencies (osv-scanner)
high osv/GHSA-w5hq-g745-h8pq package-lock.json [email protected] (npm) is affected by GHSA-w5hq-g745-h8pq Dependencies (osv-scanner)
high osv/GHSA-x8mw-p69m-v3mx package-lock.json @fastify/[email protected] (npm) is affected by GHSA-x8mw-p69m-v3mx Dependencies (osv-scanner)
high osv/GHSA-xhpv-hc6g-r9c6 package-lock.json [email protected] (npm) is affected by GHSA-xhpv-hc6g-r9c6 Dependencies (osv-scanner)
high osv/GHSA-xjh9-v7x6-24jw package-lock.json @fastify/[email protected] (npm) is affected by GHSA-xjh9-v7x6-24jw Dependencies (osv-scanner)
high osv/GHSA-xjpj-3mr7-gcpf package-lock.json [email protected] (npm) is affected by GHSA-xjpj-3mr7-gcpf Dependencies (osv-scanner)
high osv/GHSA-xvcm-6775-5m9r package-lock.json [email protected] (npm) is affected by GHSA-xvcm-6775-5m9r Dependencies (osv-scanner)
high osv/GHSA-xwg4-73v4-xw9w package-lock.json [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w Dependencies (osv-scanner)
high opengrep/javascript.express.security.audit.remote-property-injection server/aiapp-api.ts:41 Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low] Static analysis (opengrep)
high opengrep/javascript.express.security.audit.remote-property-injection src/express-api.ts:41 Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low] Static analysis (opengrep)
medium opengrep/javascript.lang.best-practice.javascript-alert src/App.tsx:106 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert src/App.tsx:113 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert src/App.tsx:119 found alert() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-alert src/App.tsx:138 found alert() call; should this be in production code? Lint
medium osv/GHSA-27v5-c462-wpq7 package-lock.json [email protected] (npm) is affected by GHSA-27v5-c462-wpq7 Dependencies (osv-scanner)
medium osv/GHSA-2g4f-4pwh-qvx6 package-lock.json [email protected] (npm) is affected by GHSA-2g4f-4pwh-qvx6 Dependencies (osv-scanner)
medium osv/GHSA-2g4f-4pwh-qvx6 package-lock.json [email protected] (npm) is affected by GHSA-2g4f-4pwh-qvx6 Dependencies (osv-scanner)
medium osv/GHSA-2qvq-rjwj-gvw9 package-lock.json [email protected] (npm) is affected by GHSA-2qvq-rjwj-gvw9 Dependencies (osv-scanner)
medium osv/GHSA-3g3m-2fjr-6pw4 package-lock.json [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 Dependencies (osv-scanner)
medium osv/GHSA-3g3m-2fjr-6pw4 package-lock.json [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 Dependencies (osv-scanner)
medium osv/GHSA-3v7f-55p6-f55p package-lock.json [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p Dependencies (osv-scanner)
medium osv/GHSA-3v7f-55p6-f55p package-lock.json [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p Dependencies (osv-scanner)
medium osv/GHSA-48c2-rrv3-qjmp package-lock.json [email protected] (npm) is affected by GHSA-48c2-rrv3-qjmp Dependencies (osv-scanner)
medium osv/GHSA-48c2-rrv3-qjmp package-lock.json [email protected] (npm) is affected by GHSA-48c2-rrv3-qjmp Dependencies (osv-scanner)
medium osv/GHSA-4mjr-xmp4-gh2g package-lock.json [email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g Dependencies (osv-scanner)
medium osv/GHSA-4w7w-66w2-5vf9 package-lock.json [email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9 Dependencies (osv-scanner)
medium osv/GHSA-5pm8-86m8-9m6r package-lock.json [email protected] (npm) is affected by GHSA-5pm8-86m8-9m6r Dependencies (osv-scanner)
medium osv/GHSA-698v-4r3x-3vcv package-lock.json [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv Dependencies (osv-scanner)
medium osv/GHSA-6pq8-jhm2-2vcw package-lock.json [email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw Dependencies (osv-scanner)
medium osv/GHSA-6rw7-vpxm-498p package-lock.json [email protected] (npm) is affected by GHSA-6rw7-vpxm-498p Dependencies (osv-scanner)
medium osv/GHSA-7rx3-28cr-v5wh package-lock.json [email protected] (npm) is affected by GHSA-7rx3-28cr-v5wh Dependencies (osv-scanner)
medium osv/GHSA-8988-4f7v-96qf package-lock.json @opentelemetry/[email protected] (npm) is affected by GHSA-8988-4f7v-96qf Dependencies (osv-scanner)
medium osv/GHSA-8cw4-87c7-c6xx package-lock.json [email protected] (npm) is affected by GHSA-8cw4-87c7-c6xx Dependencies (osv-scanner)
medium osv/GHSA-93m4-6634-74q7 package-lock.json [email protected] (npm) is affected by GHSA-93m4-6634-74q7 Dependencies (osv-scanner)
medium osv/GHSA-f886-m6hf-6m8v package-lock.json [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v Dependencies (osv-scanner)
medium osv/GHSA-f886-m6hf-6m8v package-lock.json [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v Dependencies (osv-scanner)
medium osv/GHSA-fx2h-pf6j-xcff package-lock.json [email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff Dependencies (osv-scanner)
medium osv/GHSA-fxqj-rqcc-2cmp package-lock.json [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 package-lock.json [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 package-lock.json [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-gh4j-gqv2-49f6 package-lock.json [email protected] (npm) is affected by GHSA-gh4j-gqv2-49f6 Dependencies (osv-scanner)
medium osv/GHSA-gxm5-99cw-xjw9 package-lock.json @fastify/[email protected] (npm) is affected by GHSA-gxm5-99cw-xjw9 Dependencies (osv-scanner)
medium osv/GHSA-h3mg-xc3c-68pw package-lock.json [email protected] (npm) is affected by GHSA-h3mg-xc3c-68pw Dependencies (osv-scanner)
medium osv/GHSA-h67p-54hq-rp68 package-lock.json [email protected] (npm) is affected by GHSA-h67p-54hq-rp68 Dependencies (osv-scanner)
medium osv/GHSA-hrr3-gc8f-f4qj package-lock.json [email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj Dependencies (osv-scanner)
medium osv/GHSA-j6r3-76f7-8jcv package-lock.json [email protected] (npm) is affected by GHSA-j6r3-76f7-8jcv Dependencies (osv-scanner)
medium osv/GHSA-jp2q-39xq-3w4g package-lock.json [email protected] (npm) is affected by GHSA-jp2q-39xq-3w4g Dependencies (osv-scanner)
medium osv/GHSA-mh29-5h37-fv8m package-lock.json [email protected] (npm) is affected by GHSA-mh29-5h37-fv8m Dependencies (osv-scanner)
medium osv/GHSA-q2hr-2g5m-vwhr package-lock.json [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr Dependencies (osv-scanner)
medium osv/GHSA-q2hr-2g5m-vwhr package-lock.json [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr Dependencies (osv-scanner)
medium osv/GHSA-q8mj-m7cp-5q26 package-lock.json [email protected] (npm) is affected by GHSA-q8mj-m7cp-5q26 Dependencies (osv-scanner)
medium osv/GHSA-qx2v-qp2m-jg93 package-lock.json [email protected] (npm) is affected by GHSA-qx2v-qp2m-jg93 Dependencies (osv-scanner)
medium osv/GHSA-r4jh-29pc-gfqr package-lock.json [email protected] (npm) is affected by GHSA-r4jh-29pc-gfqr Dependencies (osv-scanner)
medium osv/GHSA-r825-w8mm-5pxw package-lock.json [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw Dependencies (osv-scanner)
medium osv/GHSA-rgwj-5xj2-c3m3 package-lock.json [email protected] (npm) is affected by GHSA-rgwj-5xj2-c3m3 Dependencies (osv-scanner)
medium osv/GHSA-rpw4-54j3-4h4q package-lock.json [email protected] (npm) is affected by GHSA-rpw4-54j3-4h4q Dependencies (osv-scanner)
medium osv/GHSA-rq7h-c2jc-7f22 package-lock.json [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 Dependencies (osv-scanner)
medium osv/GHSA-rxp7-6hxx-x8q5 package-lock.json [email protected] (npm) is affected by GHSA-rxp7-6hxx-x8q5 Dependencies (osv-scanner)
medium osv/GHSA-v2v4-37r5-5v8g package-lock.json [email protected] (npm) is affected by GHSA-v2v4-37r5-5v8g Dependencies (osv-scanner)
medium osv/GHSA-v6wh-96g9-6wx3 package-lock.json [email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3 Dependencies (osv-scanner)
medium osv/GHSA-w74x-v6f9-j3xg package-lock.json [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg Dependencies (osv-scanner)
medium osv/GHSA-wqch-xfxh-vrr4 package-lock.json [email protected] (npm) is affected by GHSA-wqch-xfxh-vrr4 Dependencies (osv-scanner)
medium osv/GHSA-xw65-4hp5-5hc7 package-lock.json [email protected] (npm) is affected by GHSA-xw65-4hp5-5hc7 Dependencies (osv-scanner)
medium osv/GHSA-xxjr-mmjv-4gpg package-lock.json [email protected] (npm) is affected by GHSA-xxjr-mmjv-4gpg Dependencies (osv-scanner)
medium osv/GHSA-xxjr-mmjv-4gpg package-lock.json [email protected] (npm) is affected by GHSA-xxjr-mmjv-4gpg Dependencies (osv-scanner)
low osv/GHSA-333x-w4r6-6crp package-lock.json [email protected] (npm) is affected by GHSA-333x-w4r6-6crp Dependencies (osv-scanner)
low osv/GHSA-442j-39wm-28r2 package-lock.json [email protected] (npm) is affected by GHSA-442j-39wm-28r2 Dependencies (osv-scanner)
low osv/GHSA-464c-974j-9xm6 package-lock.json [email protected] (npm) is affected by GHSA-464c-974j-9xm6 Dependencies (osv-scanner)
low osv/GHSA-474x-hrwr-fgx4 package-lock.json [email protected] (npm) is affected by GHSA-474x-hrwr-fgx4 Dependencies (osv-scanner)
low osv/GHSA-4x5r-pxfx-6jf8 package-lock.json @babel/[email protected] (npm) is affected by GHSA-4x5r-pxfx-6jf8 Dependencies (osv-scanner)
low osv/GHSA-52f5-9888-hmc6 package-lock.json [email protected] (npm) is affected by GHSA-52f5-9888-hmc6 Dependencies (osv-scanner)
low osv/GHSA-6475-r3vj-m8vf package-lock.json @smithy/[email protected] (npm) is affected by GHSA-6475-r3vj-m8vf Dependencies (osv-scanner)
low osv/GHSA-6475-r3vj-m8vf package-lock.json @smithy/[email protected] (npm) is affected by GHSA-6475-r3vj-m8vf Dependencies (osv-scanner)
low osv/GHSA-6475-r3vj-m8vf package-lock.json @smithy/[email protected] (npm) is affected by GHSA-6475-r3vj-m8vf Dependencies (osv-scanner)
low osv/GHSA-73rr-hh4g-fpgx package-lock.json [email protected] (npm) is affected by GHSA-73rr-hh4g-fpgx Dependencies (osv-scanner)
low osv/GHSA-9jrq-w75r-8gcw package-lock.json [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw Dependencies (osv-scanner)
low osv/GHSA-fj3w-jwp8-x2g3 package-lock.json [email protected] (npm) is affected by GHSA-fj3w-jwp8-x2g3 Dependencies (osv-scanner)
low osv/GHSA-g4jq-h2w9-997c package-lock.json [email protected] (npm) is affected by GHSA-g4jq-h2w9-997c Dependencies (osv-scanner)
low osv/GHSA-jqfw-vq24-v9c3 package-lock.json [email protected] (npm) is affected by GHSA-jqfw-vq24-v9c3 Dependencies (osv-scanner)
low osv/GHSA-v422-hmwv-36x6 package-lock.json [email protected] (npm) is affected by GHSA-v422-hmwv-36x6 Dependencies (osv-scanner)
low osv/GHSA-v6h2-p8h4-qcjw package-lock.json [email protected] (npm) is affected by GHSA-v6h2-p8h4-qcjw Dependencies (osv-scanner)
low osv/GHSA-v6h2-p8h4-qcjw package-lock.json [email protected] (npm) is affected by GHSA-v6h2-p8h4-qcjw Dependencies (osv-scanner)
low osv/GHSA-w7fw-mjwx-w883 package-lock.json [email protected] (npm) is affected by GHSA-w7fw-mjwx-w883 Dependencies (osv-scanner)
low osv/GHSA-xhq7-xmqj-769h package-lock.json [email protected] (npm) is affected by GHSA-xhq7-xmqj-769h Dependencies (osv-scanner)
low gitleaks/generic-api-key src/App.tsx:296 Possible generic-api-key secret in history (commit 67e3116cae); removed from the current tree but still retrievable Secrets (gitleaks)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceskipped—0
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-40
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b4144
Tests and CICode qualityok—0
Type safetyCode qualityok—0
CI workflows (zizmor)Securityskipped—0
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.1159
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b4142
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.11

Score history

Scores from different scoring versions aren't directly comparable.

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-1413d02189442aprov-5+qual-2+sec-20%3048
2026-11-1413d02189442aprov-4+qual-2+sec-20%3048

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/jarirantala/ai-marketplace/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/jarirantala/ai-marketplace/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/jarirantala/ai-marketplace/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/jarirantala/ai-marketplace/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/jarirantala/ai-marketplace/security.svg)](https://repotrust.synapticcyber.com/r/github.com/jarirantala/ai-marketplace/)
Full text report

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 none-detected 61% 100%
Code quality 30 poor 90% 100%
Security 48 poor 85% 100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

  • Explicitly attributed share (lower bound): 0.0%
  • Unattributed share in AI-consistent velocity bursts: 0.0%
  • Estimated AI-generated share: 0.0%
Month Lines added Attributed to AI
2025-06 876 0%
2025-08 334 0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 34% of function code in complex or long functions; 17% duplicated lines. Weakest area: testing.

Area Score
Complexity (lizard) 36
Duplication 37
Code smells (Opengrep) 37
Tests and CI 0
Documentation 60
Type safety 60
Process (Scorecard review/maintenance) n/a
  • Functions: 55; mean complexity 2.4, 90th percentile 4; 1 complex and 1 long functions
  • Duplicated lines: 16.7% of 539 compared
  • Tests: 0 test lines for 736 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
  • Docs missing or thin: readme, changelog

Most complex functions:

Security

Security posture is poor: 159 known vulnerabilities in 54 dependencies; 2 high-severity SAST findings. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 97
Static analysis (Opengrep) 59
Vulnerable dependencies (OSV) 0
CI workflows (zizmor) n/a
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a

  • Known vulnerabilities: 159 in 54 packages (critical 7, high 82, medium 51, low 19)

  • Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity Finding Location
critical osv/GHSA-5rq4-664w-9x2c: [email protected] (npm) is affected by GHSA-5rq4-664w-9x2c package-lock.json
critical osv/GHSA-m7jm-9gc2-mpf2: [email protected] (npm) is affected by GHSA-m7jm-9gc2-mpf2 package-lock.json
critical osv/GHSA-2w6w-674q-4c4q: [email protected] (npm) is affected by GHSA-2w6w-674q-4c4q package-lock.json
critical osv/GHSA-8r5x-fm3f-whwj: [email protected] (npm) is affected by GHSA-8r5x-fm3f-whwj package-lock.json
critical osv/GHSA-p8wg-vrv2-v86f: [email protected] (npm) is affected by GHSA-p8wg-vrv2-v86f package-lock.json
critical osv/GHSA-wf6x-7x77-mvgw: [email protected] (npm) is affected by GHSA-wf6x-7x77-mvgw package-lock.json
critical osv/GHSA-jqcg-44mw-7w3h: [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h package-lock.json
high opengrep/javascript.express.security.audit.remote-property-injection: Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low] server/aiapp-api.ts:41
high opengrep/javascript.express.security.audit.remote-property-injection: Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low] src/express-api.ts:41
high osv/GHSA-x8mw-p69m-v3mx: @fastify/[email protected] (npm) is affected by GHSA-x8mw-p69m-v3mx package-lock.json
high osv/GHSA-xjh9-v7x6-24jw: @fastify/[email protected] (npm) is affected by GHSA-xjh9-v7x6-24jw package-lock.json
high osv/GHSA-7mx3-vvmw-hjmv: @graphql-tools/[email protected] (npm) is affected by GHSA-7mx3-vvmw-hjmv package-lock.json
high osv/GHSA-7mx3-vvmw-hjmv: @graphql-tools/[email protected] (npm) is affected by GHSA-7mx3-vvmw-hjmv package-lock.json
high osv/GHSA-7mx3-vvmw-hjmv: @graphql-tools/[email protected] (npm) is affected by GHSA-7mx3-vvmw-hjmv package-lock.json
high osv/GHSA-7mx3-vvmw-hjmv: @graphql-tools/[email protected] (npm) is affected by GHSA-7mx3-vvmw-hjmv package-lock.json
high osv/GHSA-999r-qq7v-r334: [email protected] (npm) is affected by GHSA-999r-qq7v-r334 package-lock.json
high osv/GHSA-vcrf-j523-4mrf: [email protected] (npm) is affected by GHSA-vcrf-j523-4mrf package-lock.json
high osv/GHSA-6v7q-wjvx-w8wg: [email protected] (npm) is affected by GHSA-6v7q-wjvx-w8wg package-lock.json
high osv/GHSA-c475-qrg2-pj4r: [email protected] (npm) is affected by GHSA-c475-qrg2-pj4r package-lock.json
high osv/GHSA-rp42-5vxx-qpwr: [email protected] (npm) is affected by GHSA-rp42-5vxx-qpwr package-lock.json
high osv/GHSA-rpmf-866q-6p89: [email protected] (npm) is affected by GHSA-rpmf-866q-6p89 package-lock.json
high osv/GHSA-27r3-jxmh-p828: [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 package-lock.json
high osv/GHSA-3jxr-9vmj-r5cp: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp package-lock.json
high osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p package-lock.json
high osv/GHSA-mh99-v99m-4gvg: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg package-lock.json

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 736; test lines: 0
Language Lines
TypeScript 569
JavaScript 167