rstockm/mastowall

Simple implementation of a Twitter-Wall like grid of postings from Mastodon

https://github.com/rstockm/mastowall · commit 5b4a91f1d4b9 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/rstockm/mastowall
Commit: 5b4a91f1d4b9412ca13cad08b7dbd266eed8ebd3
Generated: 2026-11-13T23:46:56+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	64%	100%
Code quality	45	poor	90%	100%
Security	51	weak	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
Stylometry index: 7.72 per 1,000 lines (narrated steps 7, placeholders 0, assistant phrasing 0, emoji 5). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2023-05	440	0%
2023-06	13	0%
2023-11	20	0%
2024-01	14	0%
2025-08	106	0%
2025-10	929	0%
2025-11	8	0%

Evidence

step-by-step narration comment: // STEP 1: Measure start positions from avatars with actual layout (script.js:45)
step-by-step narration comment: // STEP 2: Render people list and measure end positions in final on-screen placement (script.js:49)
step-by-step narration comment: // STEP 3: Create clones for each author (script.js:54)
step-by-step narration comment: // STEP 4: Shrink and move post cards toward center (script.js:57)
step-by-step narration comment: // STEP 5: Animate clones to end positions (script.js:59)
step-by-step narration comment: // STEP 6: Hide app-content NOW (after measurement) and show people container during flight (script.js:61)
step-by-step narration comment: // STEP 7: Crossfade from clones to real avatars in boxes (script.js:63)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 22% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	51
Duplication	91
Code smells (Opengrep)	54
Tests and CI	0
Documentation	65
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 98; mean complexity 2.9, 90th percentile 5; 2 complex and 2 long functions
Duplicated lines: 1.5% of 925 compared
Tests: 0 test lines for 1,230 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: no high-impact findings. Weakest area: sast.

Area	Score
Secrets (gitleaks, tree + history)	97
Static analysis (Opengrep)	9
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	n/a

Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates

Top findings

Severity	Finding	Location
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]	script.js:10
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:46
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`: User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	script.js:47
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`: JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	script.js:47
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:139
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:147
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:154
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:157
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:169
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:173
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:180
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-selector`: User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	script.js:186
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`: User controlled data in a jQuery's `.prepend(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	script.js:187
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`: User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	script.js:254
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`: JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	script.js:254
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:389
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:410
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:416
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	script.js:418
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`: User controlled data in a jQuery's `.html(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	script.js:430
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`: JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	script.js:430
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`: User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	script.js:570
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`: User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	script.js:850
medium	`opengrep/javascript.jquery.security.audit.jquery-insecure-method`: User controlled data in a jQuery's `.append(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	script.js:853
medium	`opengrep/javascript.jquery.security.audit.prohibit-jquery-html`: JQuery's `html` function is susceptible to Cross Site Scripting (XSS) attacks. If you're just passing text, consider `text` instead. Otherwise, use a function that escapes HTML such as edX's `HtmlUtils.setHtml()`. [confidence low]	script.js:910

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 1,230; test lines: 0

Language	Lines
JavaScript	1,177
Shell	53

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/rstockm/mastowall/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/rstockm/mastowall/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/rstockm/mastowall/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/rstockm/mastowall/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/rstockm/mastowall/security.svg)](https://repotrust.synapticcyber.com/r/github.com/rstockm/mastowall/)