RepoTrust

jhlee0409/claude-code-history-viewer

Desktop app and web server to browse, search and analyze your AI coding assistant history — Claude Code, Codex CLI, GitHub Copilot, Gemini CLI, Cursor, OpenCode and more. 100% offline.

https://github.com/jhlee0409/claude-code-history-viewer · commit 67979b401e93 · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

RepoTrust ai badge RepoTrust quality badge RepoTrust security badge

Dispute this score or request a re-score Full report JSON

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 76 explicit 95% 100%
Code quality 70 adequate 90% 100%
Security 44 poor 85% 100%

AI provenance

Explicit AI attribution on 76% of first-party code added; an estimated 76% including velocity signals.

AI tool Attributed commits Lines added
Claude Code 762 193,888
OpenAI Codex 46 10,943
GitHub Copilot coding agent 36 1,552
Cursor agent 3 1,314

Current source lines last changed by AI-attributed commits: 142,168 of 174,994.

Findings per 1,000 lines AI-attributed Other Ratio
Quality 0.689 1.554 0.44x
Security 0.542 0.274 1.98x
Month Lines added Attributed to AI
2025-11 829 7%
2025-12 3,512 99%
2026-01 72,583 100%
2026-02 33,723 81%
2026-03 25,451 94%
2026-04 7,016 90%
2026-05 9,865 99%
2026-06 26,534 98%
2026-07 16,210 70%
2026-08 23,635 52%
2026-09 15,043 49%
2026-10 8,909 61%

Evidence

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.17, CI runs tests; 27% of function code in complex or long functions; 11% duplicated lines. Weakest area: complexity.

Area Score
Complexity (lizard) 44
Duplication 51
Code smells (Opengrep) 83
Tests and CI 83
Documentation 85
Type safety 100
Process (Scorecard review/maintenance) n/a

Most complex functions:

Security

Security posture is poor: 74 known vulnerabilities in 45 dependencies; 77 high-severity workflow issues. Weakest area: ci actions.

Area Score
Secrets (gitleaks, tree + history) 77
Static analysis (Opengrep) 96
Vulnerable dependencies (OSV) 5
CI workflows (zizmor) 0
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a

Top findings

Severity Finding Location
critical osv/RUSTSEC-2026-0369: [email protected] (crates.io) is affected by RUSTSEC-2026-0369 src-tauri/Cargo.lock
critical osv/GHSA-m665-v7pm-7grj: [email protected] (crates.io) is affected by GHSA-m665-v7pm-7grj src-tauri/Cargo.lock
high osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p pnpm-lock.yaml
high osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 pnpm-lock.yaml
high osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p pnpm-lock.yaml
high osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 pnpm-lock.yaml
high osv/GHSA-68fv-2mgg-jv7q: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q pnpm-lock.yaml
high osv/GHSA-587h-7wmj-h5pm: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm pnpm-lock.yaml
high osv/GHSA-mrhx-c7xc-m3w5: [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 pnpm-lock.yaml
high osv/GHSA-mrhx-c7xc-m3w5: [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 pnpm-lock.yaml
high osv/RUSTSEC-2026-0194: [email protected] (crates.io) is affected by RUSTSEC-2026-0194 src-tauri/Cargo.lock
high osv/RUSTSEC-2026-0195: [email protected] (crates.io) is affected by RUSTSEC-2026-0195 src-tauri/Cargo.lock
high osv/RUSTSEC-2026-0367: [email protected] (crates.io) is affected by RUSTSEC-2026-0367 src-tauri/Cargo.lock
high osv/GHSA-q7v9-x93c-xqv3: [email protected] (crates.io) is affected by RUSTSEC-2026-0429, GHSA-q7v9-x93c-xqv3 src-tauri/Cargo.lock
high zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] .github/workflows/claude-mentions.yml:12
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/claude-mentions.yml:33
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/claude-mentions.yml:37
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/daily-pr-health.yml:25
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/daily-pr-health.yml:27
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/frontend-tests.yml:45
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/frontend-tests.yml:50
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/frontend-tests.yml:53
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/issue-to-spec.yml:17
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/pages.yml:27
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/pages.yml:30

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Language Lines
TypeScript 111,533
Rust 90,487
JavaScript 1,873
Shell 153

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/jhlee0409/claude-code-history-viewer/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/jhlee0409/claude-code-history-viewer/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/jhlee0409/claude-code-history-viewer/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/jhlee0409/claude-code-history-viewer/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/jhlee0409/claude-code-history-viewer/security.svg)](https://repotrust.synapticcyber.com/r/github.com/jhlee0409/claude-code-history-viewer/)