Leaderboard github.com
rubysherpas/forem
The best Rails 3 and Rails 4 forum engine. Ever.
AI provenance
0%
none-detected
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
94/100
strong
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
51/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% none-detected
No AI attribution or AI-consistent velocity signals detected.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts0%
- Estimated AI-generated share0%
- AI tool configuration files0
- Work sessions at AI pace0
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)0.00
Lines added per month all AI-attributed share
- 2011-0219,573 · 0% AI
- 2011-03534 · 0% AI
- 2011-05317 · 0% AI
- 2011-06638 · 0% AI
- 2011-0775 · 0% AI
- 2011-0878 · 0% AI
- 2011-09310 · 0% AI
- 2011-10525 · 0% AI
- 2011-111,746 · 0% AI
- 2011-12582 · 0% AI
- 2012-01331 · 0% AI
- 2012-021,590 · 0% AI
- 2012-03442 · 0% AI
- 2012-04316 · 0% AI
- 2012-0548 · 0% AI
- 2012-06342 · 0% AI
- 2012-07170 · 0% AI
- 2012-0846 · 0% AI
- 2012-09172 · 0% AI
- 2012-10178 · 0% AI
- 2012-11199 · 0% AI
- 2012-1270 · 0% AI
- 2013-01257 · 0% AI
- 2013-0213 · 0% AI
- 2013-030 · 0% AI
- 2013-0464 · 0% AI
- 2013-05362 · 0% AI
- 2013-0662 · 0% AI
- 2013-07136 · 0% AI
- 2013-080 · 0% AI
- 2013-09119 · 0% AI
- 2013-103 · 0% AI
- 2013-11119 · 0% AI
- 2013-1223 · 0% AI
- 2014-01116 · 0% AI
- 2014-0234 · 0% AI
- 2014-03217 · 0% AI
- 2014-041 · 0% AI
- 2014-0517 · 0% AI
- 2014-060 · 0% AI
- 2014-070 · 0% AI
- 2014-085 · 0% AI
- 2014-0933 · 0% AI
- 2014-1025 · 0% AI
- 2014-1154 · 0% AI
- 2014-1222 · 0% AI
- 2015-0181 · 0% AI
- 2015-02505 · 0% AI
- 2015-0331 · 0% AI
- 2015-040 · 0% AI
- 2015-060 · 0% AI
- 2015-0759 · 0% AI
- 2015-080 · 0% AI
- 2015-093 · 0% AI
- 2015-100 · 0% AI
- 2015-110 · 0% AI
- 2016-010 · 0% AI
- 2016-050 · 0% AI
Evidence by analyzer
Explicit AI attributionok
- attributed_commit_share
- 0.0%
- attributed_commits
- 0
- attributed_loc
- 0
- attributed_loc_share
- 0.0%
- commits
- 1,302
- effective_loc
- 30,643
- tools_detected
- 0
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok
- excluded_import_loc
- 19,029
- flagged_loc
- 0
- flagged_loc_share
- 0.0%
- flagged_units
- 0
- max_loc_per_hour
- 170.26
- measured_loc
- 11,614
- median_loc_per_hour
- 37.01
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 11,614
- work_units
- 378
Release velocityskipped
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0
- lines_scanned
- 2,548
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Code quality
94 strong
Code quality is strong: test-to-source ratio 1.40, CI runs tests; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: docs.
How the score is built
- Complexity100
- Duplication100
- Lint and smells95
- Tests and CI90
- Documentation80
- Type safetynot measured
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok
- complex_functions
- 0
- function_nloc
- 1,356
- functions
- 264
- long_functions
- 0
- many_param_functions
- 0
- mean_ccn
- 1.46
- p90_ccn
- 2
- risky_nloc_share
- 0.0%
Duplication (jscpd)ok
- compared_lines
- 1,556
- duplicated_lines
- 0
- duplicated_share
- 0.0%
- files
- 96
Lintok
- category:performance
- 2
- findings
- 2
- scanned_lines
- 2,548
- weighted_findings
- 0.50
Tests and CIok2 items
- CI config: .travis.yml
.travis.yml - CI runs tests (bundle exec rspec, rspec)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 1
- cochange_commits
- 106
- cochange_share
- 32.1%
- source_lines
- 2,548
- test_lines
- 3,561
- test_ratio
- 1.40
Documentationok2 items
- README.md
README.md - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 181
Type safetyskipped
Security
51 weak
Security posture is weak: no high-impact findings. Weakest area: posture.
How the score is built
- Secrets97
- Static analysis (SAST)20
- Vulnerable dependenciesnot measured
- CI workflowsnot measured
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesskipped
no registry dependencies declared
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 1
Static analysis (opengrep)ok
- findings
- 33
- findings_high
- 0
- findings_low
- 0
- findings_medium
- 33
- parse_errors
- 19
- scanned_lines
- 2,548
- weighted_findings
- 11.75
Dependencies (osv-scanner)skipped
CI workflows (zizmor)skipped
Security postureok1 item
- Gemfile has no lockfile alongside it (unpinned dependencies)
Gemfile
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 0.0%
- unpinned_manifests
- 1
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
33 medium3 low
36 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/forem/admin/categories_controller.rb:42 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/forem/admin/forums_controller.rb:43 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect |
app/controllers/forem/admin/groups_controller.rb:18 | When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/forem/admin/groups_controller.rb:34 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/forem/admin/members_controller.rb:26 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/forem/admin/topics_controller.rb:48 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/forem/moderation_controller.rb:32 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/forem/posts_controller.rb:117 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find |
app/controllers/forem/topics_controller.rb:98 | Found an unscoped `find(...)` with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag |
app/helpers/forem/application_helper.rb:21 | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe |
app/helpers/forem/application_helper.rb:22 | 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe |
app/helpers/forem/application_helper.rb:44 | 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe |
app/helpers/forem/formatting_helper.rb:14 | 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe |
app/helpers/forem/formatting_helper.rb:16 | 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe |
app/helpers/forem/formatting_helper.rb:8 | 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.weak-hashes-md5 |
app/helpers/forem/posts_helper.rb:16 | Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag |
app/helpers/forem/topics_helper.rb:16 | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag |
app/helpers/forem/topics_helper.rb:34 | 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/forem/admin/categories/index.html.erb:16 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/forem/admin/forums/index.html.erb:21 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/admin/groups/show.html.erb:21 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/categories/show.html.erb:2 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/forem/forums/_forum.html.erb:2 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/topics/_topic.html.erb:20 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute |
app/views/forem/topics/show.html.erb:1 | Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/topics/show.html.erb:10 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/topics/show.html.erb:14 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/topics/show.html.erb:16 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/topics/show.html.erb:22 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/topics/show.html.erb:23 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/topics/show.html.erb:24 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/topics/show.html.erb:25 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to |
app/views/forem/topics/show.html.erb:7 | Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a... | Static analysis (opengrep) |
| low | opengrep/ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial |
db/migrate/20110228084940_add_reply_to_to_forem_posts.rb:3 | The :reply_to_id column appears to be a foreign key. Would it benefit from an index? Having an index can improve performance. | Lint |
| low | opengrep/ruby.rails.performance.ruby-rails-performance-indexes-are-beneficial |
db/migrate/20111103214432_add_category_id_to_forums.rb:3 | The :category_id column appears to be a foreign key. Would it benefit from an index? Having an index can improve performance. | Lint |
| low | gitleaks/generic-api-key |
spec/dummy/config/initializers/secret_token.rb:7 | Possible generic-api-key secret in history (commit 82ba7f8a72); removed from the current tree but still retrievable | Secrets (gitleaks) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 2 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | skipped | — | 0 | |
| Dependencies (osv-scanner) | Security | skipped | — | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | skipped | — | 0 | no registry dependencies declared |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 33 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 1 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | fb37858a51cf | prov-5+qual-2+sec-2 | 0% | 94 | 51 |
| 2026-11-14 | fb37858a51cf | prov-4+qual-2+sec-2 | 0% | 94 | 51 |
Full text report
- Repository: https://github.com/rubysherpas/forem
- Commit:
fb37858a51cfc8fe2ccd113e61af42546091fd27 - Generated: 2026-11-14T14:52:07+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 94 | strong | 90% | 100% |
| Security | 51 | weak | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2014-04 | 1 | 0% |
| 2014-05 | 17 | 0% |
| 2014-08 | 5 | 0% |
| 2014-09 | 33 | 0% |
| 2014-10 | 25 | 0% |
| 2014-11 | 54 | 0% |
| 2014-12 | 22 | 0% |
| 2015-01 | 81 | 0% |
| 2015-02 | 505 | 0% |
| 2015-03 | 31 | 0% |
| 2015-07 | 59 | 0% |
| 2015-09 | 3 | 0% |
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 1.40, CI runs tests; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: docs.
| Area | Score |
|---|---|
| Complexity (lizard) | 100 |
| Duplication | 100 |
| Code smells (Opengrep) | 95 |
| Tests and CI | 90 |
| Documentation | 80 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 264; mean complexity 1.5, 90th percentile 2; 0 complex and 0 long functions
- Duplicated lines: 0.0% of 1,556 compared
- Tests: 3,561 test lines for 2,548 source lines (ratio 1.40); CI test commands: bundle exec rspec, rspec; 32% of recent source commits also change tests
- Docs missing or thin: changelog
Security
Security posture is weak: no high-impact findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 20 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find: Found an unscoped find(...) with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium] |
app/controllers/forem/admin/categories_controller.rb:42 |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find: Found an unscoped find(...) with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium] |
app/controllers/forem/admin/forums_controller.rb:43 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-redirect: When a redirect uses user input, a malicious user can spoof a website under a trusted URL or access restricted parts of a site. When using user-supplied values, sanitize the value before using it for the redirect. [confidence medium] |
app/controllers/forem/admin/groups_controller.rb:18 |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find: Found an unscoped find(...) with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium] |
app/controllers/forem/admin/groups_controller.rb:34 |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find: Found an unscoped find(...) with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium] |
app/controllers/forem/admin/members_controller.rb:26 |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find: Found an unscoped find(...) with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium] |
app/controllers/forem/admin/topics_controller.rb:48 |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find: Found an unscoped find(...) with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium] |
app/controllers/forem/moderation_controller.rb:32 |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find: Found an unscoped find(...) with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium] |
app/controllers/forem/posts_controller.rb:117 |
| medium | opengrep/ruby.rails.security.brakeman.check-unscoped-find: Found an unscoped find(...) with user-controllable input. If the ActiveRecord model being searched against is sensitive, this may lead to Insecure Direct Object Reference (IDOR) behavior and allow users to read arbitrary records. Scope the find to the current user, e.g. `current_user.accounts.find [confidence medium] |
app/controllers/forem/topics_controller.rb:98 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag: 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external d [confidence low] |
app/helpers/forem/application_helper.rb:21 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe: 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low] |
app/helpers/forem/application_helper.rb:22 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe: 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low] |
app/helpers/forem/application_helper.rb:44 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe: 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low] |
app/helpers/forem/formatting_helper.rb:8 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe: 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low] |
app/helpers/forem/formatting_helper.rb:14 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe: 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low] |
app/helpers/forem/formatting_helper.rb:16 |
| medium | opengrep/ruby.lang.security.weak-hashes-md5: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium] |
app/helpers/forem/posts_helper.rb:16 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag: 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external d [confidence low] |
app/helpers/forem/topics_helper.rb:16 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-content-tag: 'content_tag()' bypasses HTML escaping for some portion of the content. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. If you must do this, create your HTML manually and use 'html_safe'. Ensure no external d [confidence low] |
app/helpers/forem/topics_helper.rb:34 |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute: Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] |
app/views/forem/admin/categories/index.html.erb:16 |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute: Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] |
app/views/forem/admin/forums/index.html.erb:21 |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to: Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low] |
app/views/forem/admin/groups/show.html.erb:21 |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to: Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low] |
app/views/forem/categories/show.html.erb:2 |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute: Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] |
app/views/forem/forums/_forum.html.erb:2 |
| medium | opengrep/ruby.rails.security.audit.xss.templates.dangerous-link-to: Detected a template variable used in 'link_to'. This will generate dynamic data in the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the [confidence low] |
app/views/forem/topics/_topic.html.erb:20 |
| medium | opengrep/ruby.rails.security.audit.xss.templates.unquoted-attribute: Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "<%= expr %>". [confidence low] |
app/views/forem/topics/show.html.erb:1 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 2,548; test lines: 3,561
| Language | Lines |
|---|---|
| Ruby | 6,106 |
| JavaScript | 3 |