Leaderboard github.com

marwatk/elite-dangerous-bindings

Web-based Elite: Dangerous Keybindings Editor

View repository ↗
TypeScript
★ 0
commit c8259c644aa8
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

22%

explicit

Confidence: 73%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

75/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

36/100

poor

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

22% explicit

Explicit AI attribution on 23% of first-party code added; an estimated 23% including velocity signals.

How the score is built

Explicitly attributed share23%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share23%
AI tool configuration files1
Work sessions at AI pace0
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.00

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	9	5,629	2026-09-27	2026-09-27

Lines added per month all AI-attributed share

2026-0924,976 · 23% AI

Findings in AI-attributed lines vs the rest

From git blame: 3,927 lines trace to AI-attributed commits, 15,600 to others. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	3.31	4.49	0.74×
Security	2.55	1.15	2.21×

Evidence by analyzer

Explicit AI attributionok10 items

attributed_commit_share: 81.8%
attributed_commits: 9
attributed_loc: 5,629
attributed_loc_share: 22.5%
commits: 11
effective_loc: 24,976
tools_detected: 1

AI tool configurationok1 item

CLAUDE.md (claude-code configuration)

artifacts: 1
earliest_adoption: 2026-09-27
tools_configured: 1
workflow_agents: 0

Commit velocityok

excluded_import_loc: 23,404
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 331.61
measured_loc: 1,572
median_loc_per_hour: 196.09
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 2

Release velocityskipped

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 19,527
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 3,927
blame_failures: 0
files_blamed: 102
other_lines: 15,600
quality:ai_findings: 13
quality:ai_per_kloc: 3.31
quality:other_findings: 70
quality:other_per_kloc: 4.49
quality:ratio: 0.74
security:ai_findings: 10
security:ai_per_kloc: 2.55
security:other_findings: 18
security:other_per_kloc: 1.15
security:ratio: 2.21

Code quality

75 adequate

Code quality is adequate: test-to-source ratio 0.27, CI runs tests; 10% of function code in complex or long functions; 0% duplicated lines. Weakest area: type safety.

How the score is built

Complexity73
Duplication98
Lint and smells70
Tests and CI78
Documentation65
Type safety40
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 25
function_nloc: 11,023
functions: 2,094
long_functions: 1
many_param_functions: 0
mean_ccn: 2.48
p90_ccn: 5
risky_nloc_share: 10.3%

Duplication (jscpd)ok4 items

compared_lines: 14,546
duplicated_lines: 62
duplicated_share: 0.4%
files: 102

Lintok

category:best-practice: 8
category:correctness: 75
findings: 83
scanned_lines: 19,527
weighted_findings: 28.25

Tests and CIok3 items

CI config: .github/workflows/ci.yml .github/workflows/ci.yml
CI config: .github/workflows/pages.yml .github/workflows/pages.yml
CI runs tests (npm test)

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: yes
ci_files: 2
cochange_commits: 7
cochange_share: 71.4%
source_lines: 19,527
test_lines: 5,193
test_ratio: 0.27

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 211

Type safetyok

check:low_escape_density: yes
check:strict_config: no
escapes: 0
escapes_per_kloc: 0

Security

36 poor

Security posture is poor: 37 known vulnerabilities in 10 dependencies; 8 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets24
Static analysis (SAST)88
Vulnerable dependencies28
CI workflows19
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 24
declared: 24
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 39
secrets_nonprod: 4

Static analysis (opengrep)ok

findings: 28
findings_high: 0
findings_low: 1
findings_medium: 27
parse_errors: 4
scanned_lines: 19,527
weighted_findings: 6.81

Dependencies (osv-scanner)ok

penalty: 77
vulnerabilities: 37
vulnerable_packages: 10
vulns_critical: 1
vulns_high: 14
vulns_low: 4
vulns_medium: 17
vulns_unknown: 1

CI workflows (zizmor)ok

findings: 11
findings_high: 8
findings_low: 0
findings_medium: 3
penalty: 100.80
workflows: 2

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 0.0%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

1 critical22 high58 medium121 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-cg2g-xh64-v4q7`	package-lock.json	[email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7	Dependencies (osv-scanner)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:12	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:13	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:28	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/pages.yml:24	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/pages.yml:25	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/pages.yml:31	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/pages.yml:34	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/pages.yml:38	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`osv/GHSA-2m5v-pch6-74hx`	package-lock.json	[email protected] (npm) is affected by GHSA-2m5v-pch6-74hx	Dependencies (osv-scanner)
high	`osv/GHSA-46jr-4wx8-v453`	package-lock.json	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-46jr-4wx8-v453	Dependencies (osv-scanner)
high	`osv/GHSA-4w7w-5xrc-9h26`	package-lock.json	[email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26	Dependencies (osv-scanner)
high	`osv/GHSA-57xq-rjx2-v5xh`	package-lock.json	@angular/[email protected] (npm) is affected by GHSA-57xq-rjx2-v5xh	Dependencies (osv-scanner)
high	`osv/GHSA-587h-7wmj-h5pm`	package-lock.json	[email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	Dependencies (osv-scanner)
high	`osv/GHSA-587h-7wmj-h5pm`	package-lock.json	[email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	Dependencies (osv-scanner)
high	`osv/GHSA-62vg-58rm-qff7`	package-lock.json	@angular/[email protected] (npm) is affected by GHSA-62vg-58rm-qff7	Dependencies (osv-scanner)
high	`osv/GHSA-68fv-2mgg-jv7q`	package-lock.json	[email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q	Dependencies (osv-scanner)
high	`osv/GHSA-f897-62hf-6gxq`	package-lock.json	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-f897-62hf-6gxq	Dependencies (osv-scanner)
high	`osv/GHSA-jm63-cq47-j5jp`	package-lock.json	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-jm63-cq47-j5jp	Dependencies (osv-scanner)
high	`osv/GHSA-mrhx-c7xc-m3w5`	package-lock.json	[email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	Dependencies (osv-scanner)
high	`osv/GHSA-mrv2-3pqr-j5jr`	package-lock.json	[email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr	Dependencies (osv-scanner)
high	`osv/GHSA-qrxm-fqhp-jwvm`	package-lock.json	[email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm	Dependencies (osv-scanner)
high	`osv/GHSA-xjj6-f33q-929c`	package-lock.json	[email protected] (npm) is affected by GHSA-xjj6-f33q-929c	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	src/app/core/state/file-actions.service.ts:177	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	src/app/core/state/file-actions.service.ts:50	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	src/app/core/state/file-actions.service.ts:63	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	src/app/features/bindings/changes-panel.ts:151	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	src/app/features/devices/device-detail.ts:141	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	src/app/features/devices/editor/draft.ts:282	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	src/app/features/devices/editor/draft.ts:282	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	src/app/features/devices/editor/layout-editor.ts:138	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	src/app/features/devices/editor/step-image.ts:188	found confirm() call; should this be in production code?	Lint
medium	`opengrep/javascript.lang.best-practice.javascript-confirm`	src/app/features/devices/editor/step-inventory.ts:406	found confirm() call; should this be in production code?	Lint
medium	`zizmor/artipacked`	.github/workflows/ci.yml:12	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/ci.yml:9	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/pages.yml:24	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`osv/GHSA-4qv8-2p9j-2685`	package-lock.json	[email protected] (npm) is affected by GHSA-4qv8-2p9j-2685	Dependencies (osv-scanner)
medium	`osv/GHSA-55wc-3pg8-jfw6`	package-lock.json	[email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6	Dependencies (osv-scanner)
medium	`osv/GHSA-698v-4r3x-3vcv`	package-lock.json	[email protected] (npm) is affected by GHSA-698v-4r3x-3vcv	Dependencies (osv-scanner)
medium	`osv/GHSA-698v-4r3x-3vcv`	package-lock.json	[email protected] (npm) is affected by GHSA-698v-4r3x-3vcv	Dependencies (osv-scanner)
medium	`osv/GHSA-9fm3-97px-rjf6`	package-lock.json	[email protected] (npm) is affected by GHSA-9fm3-97px-rjf6	Dependencies (osv-scanner)
medium	`osv/GHSA-c6gr-qvv4-5v3f`	package-lock.json	[email protected] (npm) is affected by GHSA-c6gr-qvv4-5v3f	Dependencies (osv-scanner)
medium	`osv/GHSA-f72v-6w45-q472`	package-lock.json	[email protected] (npm) is affected by GHSA-f72v-6w45-q472	Dependencies (osv-scanner)
medium	`osv/GHSA-qxg6-89mg-rqv8`	package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8	Dependencies (osv-scanner)
medium	`osv/GHSA-r825-w8mm-5pxw`	package-lock.json	[email protected] (npm) is affected by GHSA-r825-w8mm-5pxw	Dependencies (osv-scanner)
medium	`osv/GHSA-r825-w8mm-5pxw`	package-lock.json	[email protected] (npm) is affected by GHSA-r825-w8mm-5pxw	Dependencies (osv-scanner)
medium	`osv/GHSA-rq7h-c2jc-7f22`	package-lock.json	[email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22	Dependencies (osv-scanner)
medium	`osv/GHSA-rq7h-c2jc-7f22`	package-lock.json	[email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22	Dependencies (osv-scanner)
medium	`osv/GHSA-rvq5-wwqv-78pq`	package-lock.json	@modelcontextprotocol/[email protected] (npm) is affected by GHSA-rvq5-wwqv-78pq	Dependencies (osv-scanner)
medium	`osv/GHSA-vfpm-58rq-9qcg`	package-lock.json	[email protected] (npm) is affected by GHSA-vfpm-58rq-9qcg	Dependencies (osv-scanner)
medium	`osv/GHSA-vfpm-58rq-9qcg`	package-lock.json	[email protected] (npm) is affected by GHSA-vfpm-58rq-9qcg	Dependencies (osv-scanner)
medium	`osv/GHSA-w74x-v6f9-j3xg`	package-lock.json	[email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg	Dependencies (osv-scanner)
medium	`osv/GHSA-wjr9-j795-jxcr`	package-lock.json	[email protected] (npm) is affected by GHSA-wjr9-j795-jxcr	Dependencies (osv-scanner)
medium	`osv/GHSA-xp26-3454-mjgp`	package-lock.json	@vitest/[email protected] (npm) is affected by GHSA-xp26-3454-mjgp	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/core/binds/binds-document.ts:83	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/core/devices/markers.ts:102	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/core/devices/markers.ts:98	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:102	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:128	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:133	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:174	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:240	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:245	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:247	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:252	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:263	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:287	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:298	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:301	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:304	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:348	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:349	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:351	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:402	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:403	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:436	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/app/features/cards/card-render.ts:97	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/app/features/devices/editor/draft.ts:197	RegExp() called with a `img` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.ajv.security.audit.ajv-allerrors-true`	tools/build-device-index.mjs:12	By setting `allErrors: true` in `Ajv` library, all error objects will be allocated without limit. This allows the attacker to produce a huge number of errors which can lead to denial of service. Do not use `allErrors: true` in...	Static analysis (opengrep)
medium	`opengrep/python.lang.security.audit.exec-detected`	tools/import_data.py:40	Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	tools/screenshots/devices-leaders.shots.ts:59	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/about/about.ts:15	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/about/about.ts:15	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/about/about.ts:51	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/about/about.ts:51	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/bulk-dialog.ts:122	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/bulk-dialog.ts:122	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/bulk-dialog.ts:32	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/bulk-dialog.ts:32	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/changes-panel.ts:18	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/changes-panel.ts:18	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/changes-panel.ts:55	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/changes-panel.ts:55	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/control-picker.ts:129	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/control-picker.ts:129	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/export-dialog.ts:125	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/export-dialog.ts:125	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/merge-dialog.ts:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/merge-dialog.ts:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/merge-dialog.ts:92	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/merge-dialog.ts:92	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/settings-dialog.ts:75	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/settings-dialog.ts:75	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/slot-view.ts:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/slot-view.ts:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/warnings-panel.ts:157	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/warnings-panel.ts:157	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/warnings-panel.ts:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/bindings/warnings-panel.ts:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/cards/card-svg.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/cards/card-svg.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/group-dialog.ts:173	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/group-dialog.ts:173	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/group-dialog.ts:44	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/group-dialog.ts:44	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/image-adjust.ts:30	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/image-adjust.ts:30	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/marker-icon.ts:17	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/marker-icon.ts:17	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/marker-icon.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/marker-icon.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-check.ts:26	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-check.ts:26	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-export.ts:24	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-export.ts:24	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-export.ts:63	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-export.ts:63	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-identify.ts:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-identify.ts:23	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-image.ts:17	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-image.ts:17	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-inventory.ts:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-inventory.ts:25	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-name.ts:15	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/devices/editor/step-name.ts:15	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/live-device-card.ts:147	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/live-device-card.ts:147	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/live-device-card.ts:35	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/live-device-card.ts:35	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/live-page.ts:158	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/live-page.ts:158	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/numbering-wizard.ts:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/numbering-wizard.ts:19	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/numbering-wizard.ts:96	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/features/live/numbering-wizard.ts:96	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/shared/device-diagram.ts:107	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/shared/device-diagram.ts:107	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/shared/device-diagram.ts:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/app/shared/device-diagram.ts:29	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/screenshots/devices-leaders.shots.ts:61	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/screenshots/devices-leaders.shots.ts:62	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/screenshots/devices-leaders.shots.ts:63	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/screenshots/devices-leaders.shots.ts:64	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/screenshots/devices-leaders.shots.ts:65	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`gitleaks/generic-api-key`	devices/CHCombatStick/device.json:218	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/CHFighterStick/device.json:304	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/CHProThrottle/device.json:286	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/CobraM5/device.json:370	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/DS4/device.json:223	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/EDCD-054C0CE6/device.json:127	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/EDCD-054C0DF2/device.json:127	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/EDCD-10F57055/device.json:85	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/EDCD-231D0220/device.json:79	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/EDCD-334400D4/device.json:85	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/Gladiator/device.json:350	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/HotasCougar/device.json:428	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/Logitech710WirelessGamepad/device.json:220	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/LogitechExtreme3DPro/device.json:220	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/LogitechG940/device.json:214	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/LogitechGTWheel/device.json:337	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/SaitekFLY5/device.json:253	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/SaitekX45/device.json:402	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/SaitekX52/device.json:441	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/SaitekX52Pro/device.json:441	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/SaitekX55/device.json:253	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/SaitekX56/device.json:267	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/T16000M/device.json:272	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/T16000MFCS/device.json:275	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/TCASidestickLeft/device.json:272	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/TCASidestickRight/device.json:272	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/TFlightHOTASX/device.json:220	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/TFlightStickX/device.json:220	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/ThrustMasterHOTAS4/device.json:227	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/VKB-Gladiator-NXT-Premium-Left-OTA/device.json:181	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/VKB-Gladiator-NXT-Premium-Left/device.json:181	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/VKB-Gladiator-NXT-Premium-Right-OTA/device.json:181	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/VKB-Gladiator-NXT-Premium-Right/device.json:181	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/VKB-Kosmosima-SCG-Left/device.json:389	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/VKB-Kosmosima-SCG-Right/device.json:389	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/Warthog/device.json:325	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/Winwing-Ursa-Minor-Fighter-Left/device.json:623	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	devices/Winwing-Ursa-Minor-Fighter-Right/device.json:688	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	docs/adding-a-device.md:182	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`osv/GHSA-333x-w4r6-6crp`	package-lock.json	[email protected] (npm) is affected by GHSA-333x-w4r6-6crp	Dependencies (osv-scanner)
low	`osv/GHSA-9jrq-w75r-8gcw`	package-lock.json	[email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw	Dependencies (osv-scanner)
low	`osv/GHSA-9jrq-w75r-8gcw`	package-lock.json	[email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw	Dependencies (osv-scanner)
low	`osv/GHSA-xhq7-xmqj-769h`	package-lock.json	[email protected] (npm) is affected by GHSA-xhq7-xmqj-769h	Dependencies (osv-scanner)
low	`gitleaks/generic-api-key`	public/data/generic-device.json:138	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	src/app/features/cards/card-render.spec.ts:37	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	src/testing/fixtures/Custom.4.2.binds:76	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	src/testing/fixtures/X52.4.2.binds:416	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`opengrep/javascript.lang.security.audit.unsafe-formatstring`	tools/screenshots/bindings.shots.ts:69	Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string....	Static analysis (opengrep)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	83
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	11
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	37
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	28
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	43

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`c8259c644aa8`	`prov-5+qual-2+sec-2`	22%	75	36
2026-11-14	`c8259c644aa8`	`prov-4+qual-2+sec-2`	22%	75	36

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/marwatk/elite-dangerous-bindings/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/marwatk/elite-dangerous-bindings/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/marwatk/elite-dangerous-bindings/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/marwatk/elite-dangerous-bindings/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/marwatk/elite-dangerous-bindings/security.svg)](https://repotrust.synapticcyber.com/r/github.com/marwatk/elite-dangerous-bindings/)

Full text report

Repository: https://github.com/marwatk/elite-dangerous-bindings
Commit: c8259c644aa84f30cfa39f5acfb34d713bb7bfa8
Generated: 2026-11-14T14:52:06+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	22	explicit	73%	100%
Code quality	75	adequate	90%	100%
Security	36	poor	85%	100%

AI provenance

Explicit AI attribution on 23% of first-party code added; an estimated 23% including velocity signals.

Explicitly attributed share (lower bound): 22.5%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 22.5%

AI tool	Attributed commits	Lines added
Claude Code	9	5,629

AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 3,927 of 19,527.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	3.31	4.487	0.74x
Security	2.546	1.154	2.21x

Month	Lines added	Attributed to AI
2026-09	24,976	23%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (c8259c644aa8)
Claude Code: trailer 'Co-Authored-By: Claude' (1ffb7d45ee22)
Claude Code: trailer 'Co-Authored-By: Claude' (45d4591c7e2f)
Claude Code: trailer 'Co-Authored-By: Claude' (4875cd58ec1f)
Claude Code: trailer 'Co-Authored-By: Claude' (18e079c87904)
Claude Code: trailer 'Co-Authored-By: Claude' (b26a6f852905)
Claude Code: trailer 'Co-Authored-By: Claude' (a698a8a0859b)
Claude Code: trailer 'Co-Authored-By: Claude' (dbf2fd05bb35)
Claude Code: trailer 'Co-Authored-By: Claude' (77e41a0c3a5a)
CLAUDE.md (claude-code configuration) (CLAUDE.md)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.27, CI runs tests; 10% of function code in complex or long functions; 0% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	73
Duplication	98
Code smells (Opengrep)	70
Tests and CI	78
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 2,094; mean complexity 2.5, 90th percentile 5; 25 complex and 1 long functions
Duplicated lines: 0.4% of 14,546 compared
Tests: 5,193 test lines for 19,527 source lines (ratio 0.27); CI test commands: npm test; 71% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is poor: 37 known vulnerabilities in 10 dependencies; 8 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	24
Static analysis (Opengrep)	88
Vulnerable dependencies (OSV)	28
CI workflows (zizmor)	19
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 37 in 10 packages (critical 1, high 14, medium 17, low 4)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-cg2g-xh64-v4q7`: [email protected] (npm) is affected by GHSA-cg2g-xh64-v4q7	package-lock.json
high	`osv/GHSA-57xq-rjx2-v5xh`: @angular/[email protected] (npm) is affected by GHSA-57xq-rjx2-v5xh	package-lock.json
high	`osv/GHSA-62vg-58rm-qff7`: @angular/[email protected] (npm) is affected by GHSA-62vg-58rm-qff7	package-lock.json
high	`osv/GHSA-46jr-4wx8-v453`: @modelcontextprotocol/[email protected] (npm) is affected by GHSA-46jr-4wx8-v453	package-lock.json
high	`osv/GHSA-f897-62hf-6gxq`: @modelcontextprotocol/[email protected] (npm) is affected by GHSA-f897-62hf-6gxq	package-lock.json
high	`osv/GHSA-jm63-cq47-j5jp`: @modelcontextprotocol/[email protected] (npm) is affected by GHSA-jm63-cq47-j5jp	package-lock.json
high	`osv/GHSA-mrv2-3pqr-j5jr`: [email protected] (npm) is affected by GHSA-mrv2-3pqr-j5jr	package-lock.json
high	`osv/GHSA-68fv-2mgg-jv7q`: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q	package-lock.json
high	`osv/GHSA-2m5v-pch6-74hx`: [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx	package-lock.json
high	`osv/GHSA-4w7w-5xrc-9h26`: [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26	package-lock.json
high	`osv/GHSA-qrxm-fqhp-jwvm`: [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm	package-lock.json
high	`osv/GHSA-xjj6-f33q-929c`: [email protected] (npm) is affected by GHSA-xjj6-f33q-929c	package-lock.json
high	`osv/GHSA-587h-7wmj-h5pm`: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	package-lock.json
high	`osv/GHSA-587h-7wmj-h5pm`: [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm	package-lock.json
high	`osv/GHSA-mrhx-c7xc-m3w5`: [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5	package-lock.json
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:12
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:13
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:28
high	`zizmor/template-injection`: code injection via template expansion [confidence high]	.github/workflows/pages.yml:31
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pages.yml:24
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pages.yml:25
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pages.yml:34
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pages.yml:38
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	src/app/core/binds/binds-document.ts:83
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	src/app/core/devices/markers.ts:98

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 19,527; test lines: 5,193

Language	Lines
TypeScript	24,121
Python	440
JavaScript	86
Shell	73