RepoTrust

Leaderboard github.com

leobrqz/VibedGames-benchmark

Fully vibe coded web games used as pseudo benchmarks of whatever "latest world's most powerful model" is at the moment.

  • View repository ↗
  • JavaScript
  • ★ 1
  • commit 0119784383b8
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

possible

Confidence
43%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

64/100

weak

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

58/100

weak

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

AI provenance

0% possible

Weak signals consistent with AI-assisted development.

How the score is built

  • Explicitly attributed share0%
  • Unattributed share in AI-pace bursts50%
  • Estimated AI-generated share0%
  • AI tool configuration files1
  • Work sessions at AI pace1
  • Releases at AI pacenot measured
  • Coding-style index (1.0+ means possible)0.00

Lines added per month all AI-attributed share

  1. 2026-035,690 · 0% AI

Evidence by analyzer

Explicit AI attributionok
attributed_commit_share
0.0%
attributed_commits
0
attributed_loc
0
attributed_loc_share
0.0%
commits
12
effective_loc
5,690
tools_detected
0
AI tool configurationok1 item
artifacts
1
earliest_adoption
2026-03-07
tools_configured
1
workflow_agents
0
Commit velocityok1 item
excluded_import_loc
2,715
flagged_loc
2,859
flagged_loc_share
96.1%
flagged_units
1
max_loc_per_hour
673.01
measured_loc
2,975
median_loc_per_hour
673.01
pr_timed_units
1
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
3
Release velocityskipped
Coding styleok
count:assistant_voice
0
count:emoji_in_code
0
count:narrated_steps
0
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
0
files:narrated_steps
0
files:placeholder
0
index
0
lines_scanned
5,681
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0
per_kloc:narrated_steps
0
per_kloc:placeholder
0

Code quality

64 weak

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 13% of function code in complex or long functions; 1% duplicated lines. Weakest area: testing.

How the score is built

  • Complexity67
  • Duplication94
  • Lint and smells100
  • Tests and CI15
  • Documentation80
  • Type safetynot measured
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok5 items
complex_functions
3
function_nloc
4,264
functions
370
long_functions
4
many_param_functions
1
mean_ccn
2.48
p90_ccn
5
risky_nloc_share
13.2%
Duplication (jscpd)ok2 items
compared_lines
4,055
duplicated_lines
38
duplicated_share
0.9%
files
42
Lintok
findings
0
scanned_lines
5,681
weighted_findings
0
Tests and CIok3 items
  • CI config: .github/workflows/ci.yml .github/workflows/ci.yml
  • CI config: .github/workflows/codeql.yml .github/workflows/codeql.yml
  • CI config: .github/workflows/manual-ci.yml .github/workflows/manual-ci.yml
check:ci_present
yes
check:ci_runs_lint
no
check:ci_runs_tests
no
check:has_tests
no
check:test_ratio
no
check:tests_cochange
no
ci_files
3
cochange_commits
5
cochange_share
0.0%
source_lines
5,681
test_lines
0
test_ratio
0
Documentationok3 items
  • README.md README.md
  • LICENSE LICENSE
  • CONTRIBUTING.MD CONTRIBUTING.MD
check:changelog
no
check:contributing
yes
check:license
yes
check:readme
yes
readme_lines
105
Type safetyskipped

Security

58 weak

Security posture is weak: 33 known vulnerabilities in 10 dependencies; 12 high-severity workflow issues. Weakest area: posture.

How the score is built

  • Secrets100
  • Static analysis (SAST)98
  • Vulnerable dependencies35
  • CI workflows6
  • Security posture0
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
4
declared
4
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
1
findings_high
0
findings_low
0
findings_medium
1
parse_errors
0
scanned_lines
5,681
weighted_findings
0.25
Dependencies (osv-scanner)ok
penalty
63
vulnerabilities
33
vulnerable_packages
10
vulns_critical
0
vulns_high
17
vulns_low
2
vulns_medium
14
vulns_unknown
0
CI workflows (zizmor)ok
findings
26
findings_high
12
findings_low
0
findings_medium
14
penalty
170.40
workflows
3
Security postureok
check:dependency_updates
no
check:lockfiles
yes
check:security_policy
no
check:signed_commits
no
signed_commit_share
41.7%
unpinned_manifests
0
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

29 high29 medium2 low

SeverityRuleLocationMessageTool
high zizmor/unpinned-uses .github/workflows/ci.yml:17 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci.yml:20 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci.yml:40 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/ci.yml:43 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/codeql.yml:29 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/codeql.yml:32 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/codeql.yml:38 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/manual-ci.yml:12 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/manual-ci.yml:15 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/manual-ci.yml:36 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/manual-ci.yml:69 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/manual-ci.yml:72 unpinned action reference [confidence high] CI workflows (zizmor)
high osv/GHSA-25h7-pfq9-p65f package-lock.json [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f Dependencies (osv-scanner)
high osv/GHSA-28wg-ghj8-5hjv package-lock.json [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv Dependencies (osv-scanner)
high osv/GHSA-2v37-7h3g-55p8 package-lock.json [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 Dependencies (osv-scanner)
high osv/GHSA-3jxr-9vmj-r5cp package-lock.json [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp Dependencies (osv-scanner)
high osv/GHSA-587h-7wmj-h5pm package-lock.json [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm Dependencies (osv-scanner)
high osv/GHSA-68fv-2mgg-jv7q package-lock.json [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q Dependencies (osv-scanner)
high osv/GHSA-6g55-p6wh-862q package-lock.json [email protected] (npm) is affected by GHSA-6g55-p6wh-862q Dependencies (osv-scanner)
high osv/GHSA-6j4f-fj2g-mc7p package-lock.json [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p Dependencies (osv-scanner)
high osv/GHSA-c2c7-rcm5-vvqj package-lock.json [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj Dependencies (osv-scanner)
high osv/GHSA-mh99-v99m-4gvg package-lock.json [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg Dependencies (osv-scanner)
high osv/GHSA-p9ff-h696-f583 package-lock.json [email protected] (npm) is affected by GHSA-p9ff-h696-f583 Dependencies (osv-scanner)
high osv/GHSA-qhr7-859c-m2p7 package-lock.json [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 Dependencies (osv-scanner)
high osv/GHSA-r28c-9q8g-f849 package-lock.json [email protected] (npm) is affected by GHSA-r28c-9q8g-f849 Dependencies (osv-scanner)
high osv/GHSA-rf6f-7fwh-wjgh package-lock.json [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh Dependencies (osv-scanner)
high osv/GHSA-rgw5-rvv9-x895 package-lock.json [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 Dependencies (osv-scanner)
high osv/GHSA-v2wj-q39q-566r package-lock.json [email protected] (npm) is affected by GHSA-v2wj-q39q-566r Dependencies (osv-scanner)
high osv/GHSA-xwg4-73v4-xw9w package-lock.json [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w Dependencies (osv-scanner)
medium zizmor/excessive-permissions .github/workflows/ci.yml:1 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/ci.yml:12 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/artipacked .github/workflows/ci.yml:16 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/ci.yml:34 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/artipacked .github/workflows/ci.yml:39 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium zizmor/artipacked .github/workflows/codeql.yml:28 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/manual-ci.yml:1 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/artipacked .github/workflows/manual-ci.yml:11 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/manual-ci.yml:29 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/artipacked .github/workflows/manual-ci.yml:35 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/manual-ci.yml:58 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/artipacked .github/workflows/manual-ci.yml:68 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/manual-ci.yml:7 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/template-injection .github/workflows/manual-ci.yml:81 code injection via template expansion [confidence medium] CI workflows (zizmor)
medium osv/GHSA-3v7f-55p6-f55p package-lock.json [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p Dependencies (osv-scanner)
medium osv/GHSA-4w7w-66w2-5vf9 package-lock.json [email protected] (npm) is affected by GHSA-4w7w-66w2-5vf9 Dependencies (osv-scanner)
medium osv/GHSA-698v-4r3x-3vcv package-lock.json [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv Dependencies (osv-scanner)
medium osv/GHSA-f886-m6hf-6m8v package-lock.json [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v Dependencies (osv-scanner)
medium osv/GHSA-fx2h-pf6j-xcff package-lock.json [email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff Dependencies (osv-scanner)
medium osv/GHSA-fxqj-rqcc-2cmp package-lock.json [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 package-lock.json [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-jxxr-4gwj-5jf2 package-lock.json [email protected] (npm) is affected by GHSA-jxxr-4gwj-5jf2 Dependencies (osv-scanner)
medium osv/GHSA-p498-v437-472g package-lock.json @humanfs/[email protected] (npm) is affected by GHSA-p498-v437-472g Dependencies (osv-scanner)
medium osv/GHSA-q2hr-2g5m-vwhr package-lock.json [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr Dependencies (osv-scanner)
medium osv/GHSA-qx2v-qp2m-jg93 package-lock.json [email protected] (npm) is affected by GHSA-qx2v-qp2m-jg93 Dependencies (osv-scanner)
medium osv/GHSA-r825-w8mm-5pxw package-lock.json [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw Dependencies (osv-scanner)
medium osv/GHSA-rq7h-c2jc-7f22 package-lock.json [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 Dependencies (osv-scanner)
medium osv/GHSA-v6wh-96g9-6wx3 package-lock.json [email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3 Dependencies (osv-scanner)
medium opengrep/javascript.lang.security.audit.unsafe-dynamic-method voxel-rpg/src/systems/items.js:59 Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] Static analysis (opengrep)
low osv/GHSA-9jrq-w75r-8gcw package-lock.json [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw Dependencies (osv-scanner)
low osv/GHSA-g7r4-m6w7-qqqr package-lock.json [email protected] (npm) is affected by GHSA-g7r4-m6w7-qqqr Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceskipped—0
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-40
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b4140
Tests and CICode qualityok—0
Type safetyCode qualityskipped—0
CI workflows (zizmor)Securityokzizmor 1.32.026
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.133
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b4141
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

Scores from different scoring versions aren't directly comparable.

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-140119784383b8prov-5+qual-2+sec-20%6458
2026-11-140119784383b8prov-4+qual-2+sec-20%6458

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/leobrqz/VibedGames-benchmark/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/leobrqz/VibedGames-benchmark/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/leobrqz/VibedGames-benchmark/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/leobrqz/VibedGames-benchmark/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/leobrqz/VibedGames-benchmark/security.svg)](https://repotrust.synapticcyber.com/r/github.com/leobrqz/VibedGames-benchmark/)
Full text report

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 possible 43% 100%
Code quality 64 weak 90% 100%
Security 58 weak 85% 100%

AI provenance

Weak signals consistent with AI-assisted development.

  • Explicitly attributed share (lower bound): 0.0%

  • Unattributed share in AI-consistent velocity bursts: 50.2%

  • Estimated AI-generated share: 0.0%

  • AI tooling configured in repo: github-copilot

Month Lines added Attributed to AI
2026-03 5,690 0%

Evidence

  • .github/copilot-instructions.md (github-copilot configuration) (.github/copi)
  • 2,859 lines of first-party code in ~4.2h (673 lines/hour, 2 commit session) (0119784383b8)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 13% of function code in complex or long functions; 1% duplicated lines. Weakest area: testing.

Area Score
Complexity (lizard) 67
Duplication 94
Code smells (Opengrep) 100
Tests and CI 15
Documentation 80
Type safety n/a
Process (Scorecard review/maintenance) n/a
  • Functions: 370; mean complexity 2.5, 90th percentile 5; 3 complex and 4 long functions
  • Duplicated lines: 0.9% of 4,055 compared
  • Tests: 0 test lines for 5,681 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
  • Docs missing or thin: changelog

Most complex functions:

Security

Security posture is weak: 33 known vulnerabilities in 10 dependencies; 12 high-severity workflow issues. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 98
Vulnerable dependencies (OSV) 35
CI workflows (zizmor) 6
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a
  • Known vulnerabilities: 33 in 10 packages (critical 0, high 17, medium 14, low 2)

  • Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity Finding Location
high osv/GHSA-3jxr-9vmj-r5cp: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp package-lock.json
high osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p package-lock.json
high osv/GHSA-mh99-v99m-4gvg: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg package-lock.json
high osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 package-lock.json
high osv/GHSA-rgw5-rvv9-x895: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 package-lock.json
high osv/GHSA-25h7-pfq9-p65f: [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f package-lock.json
high osv/GHSA-rf6f-7fwh-wjgh: [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh package-lock.json
high osv/GHSA-28wg-ghj8-5hjv: [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv package-lock.json
high osv/GHSA-2v37-7h3g-55p8: [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 package-lock.json
high osv/GHSA-xwg4-73v4-xw9w: [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w package-lock.json
high osv/GHSA-c2c7-rcm5-vvqj: [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj package-lock.json
high osv/GHSA-6g55-p6wh-862q: [email protected] (npm) is affected by GHSA-6g55-p6wh-862q package-lock.json
high osv/GHSA-r28c-9q8g-f849: [email protected] (npm) is affected by GHSA-r28c-9q8g-f849 package-lock.json
high osv/GHSA-68fv-2mgg-jv7q: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q package-lock.json
high osv/GHSA-587h-7wmj-h5pm: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm package-lock.json
high osv/GHSA-p9ff-h696-f583: [email protected] (npm) is affected by GHSA-p9ff-h696-f583 package-lock.json
high osv/GHSA-v2wj-q39q-566r: [email protected] (npm) is affected by GHSA-v2wj-q39q-566r package-lock.json
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:17
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:20
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:40
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:43
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/codeql.yml:29
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/codeql.yml:32
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/codeql.yml:38
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/manual-ci.yml:12

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 5,681; test lines: 0
Language Lines
JavaScript 5,651
Shell 30