Leaderboard github.com

senchalabs/jsduck

Simple JavaScript Duckumentation generator.

View repository ↗
Ruby
★ 1,488
commit febef5558ecd
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

none-detected

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

70/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

70/100

adequate

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace0
Releases at AI pace0
Coding-style index (1.0+ means possible)0.00

Lines added per month all AI-attributed share

2010-102,615 · 0% AI
2010-111,705 · 0% AI
2010-124,121 · 0% AI
2011-01682 · 0% AI
2011-02274 · 0% AI
2011-031,084 · 0% AI
2011-04847 · 0% AI
2011-0594,579 · 0% AI
2011-064,683 · 0% AI
2011-073,535 · 0% AI
2011-087,764 · 0% AI
2011-098,467 · 0% AI
2011-103,869 · 0% AI
2011-113,517 · 0% AI
2011-121,164 · 0% AI
2012-011,340 · 0% AI
2012-022,408 · 0% AI
2012-033,110 · 0% AI
2012-044,007 · 0% AI
2012-054,397 · 0% AI
2012-06471 · 0% AI
2012-071,395 · 0% AI
2012-0810,032 · 0% AI
2012-097,668 · 0% AI
2012-103,127 · 0% AI
2012-111,141 · 0% AI
2012-121,999 · 0% AI
2013-0111,641 · 0% AI
2013-021,182 · 0% AI
2013-031,193 · 0% AI
2013-041,440 · 0% AI
2013-052,214 · 0% AI
2013-06776 · 0% AI
2013-07807 · 0% AI
2013-082,055 · 0% AI
2013-09576 · 0% AI
2013-10460 · 0% AI
2013-116,329 · 0% AI
2013-1229 · 0% AI
2014-0367 · 0% AI
2014-050 · 0% AI
2014-102 · 0% AI
2014-1127 · 0% AI
2015-040 · 0% AI
2015-053 · 0% AI
2015-0617 · 0% AI
2016-010 · 0% AI
2018-090 · 0% AI
2019-010 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 3,277
effective_loc: 208,819
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok

excluded_import_loc: 0
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 22,298.75
measured_loc: 208,819
median_loc_per_hour: 55.74
pr_timed_units: 0
pre_ai_era_burst_loc: 103,121
pre_ai_era_bursts: 7
pre_ai_era_measured_loc: 208,819
work_units: 1,344

Release velocityok

flagged_releases: 0
max_loc_per_day: 16,707.90
releases: 78

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 31,871
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

70 adequate

Code quality is adequate: test-to-source ratio 0.42, no CI test run detected; 10% of function code in complex or long functions; 1% duplicated lines. Weakest area: process.

How the score is built

Complexity73
Duplication93
Lint and smells99
Tests and CI66
Documentation65
Type safetynot measured
Review process5

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 15
function_nloc: 15,225
functions: 1,886
long_functions: 4
many_param_functions: 0
mean_ccn: 2.10
p90_ccn: 4
risky_nloc_share: 10.5%

Duplication (jscpd)ok10 items

compared_lines: 20,931
duplicated_lines: 258
duplicated_share: 1.2%
files: 321

Lintok

category:correctness: 4
findings: 4
scanned_lines: 31,871
weighted_findings: 1

Tests and CIok1 item

CI config: .travis.yml .travis.yml

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: yes
ci_files: 1
cochange_commits: 233
cochange_share: 26.6%
source_lines: 31,871
test_lines: 13,372
test_ratio: 0.42

Documentationok2 items

README.md README.md
COPYING COPYING

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 118

Type safetyskipped

Security

70 adequate

Security posture is adequate: 4 high-severity SAST findings. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)94
Vulnerable dependenciesnot measured
CI workflowsnot measured
Security posture0
OpenSSF Scorecard20

Evidence by analyzer

OpenSSF Scorecardok10 items

aggregate: 1.90
check:Binary-Artifacts: yes
check:Branch-Protection: no
check:CII-Best-Practices: no
check:Code-Review: yes
check:Fuzzing: no
check:License: yes
check:Maintained: no
check:SAST: no
check:Security-Policy: no
check:Signed-Releases: no

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 13
findings_high: 4
findings_low: 0
findings_medium: 9
parse_errors: 0
scanned_lines: 31,871
weighted_findings: 5.95

Dependencies (osv-scanner)skipped

CI workflows (zizmor)skipped

Security postureok1 item

Gemfile has no lockfile alongside it (unpinned dependencies) Gemfile

check:dependency_updates: no
check:lockfiles: no
check:security_policy: no
check:signed_commits: no
signed_commit_share: 1.5%
unpinned_manifests: 1

Release downloadsok5 items

binary_assets: 8
signals: 1
suspicious: 0

Findings

4 high9 medium4 low

Severity	Rule	Location	Message	Tool
high	`opengrep/javascript.browser.security.insecure-document-method`	template/app/view/Tabs.js:321	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	template/app/view/Tabs.js:321	User controlled data in a `this.el.dom.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	template/resources/prettify/prettify.js:26	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	template/resources/prettify/prettify.js:26	User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	lib/jsduck/cache.rb:113	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.rails.security.injection.raw-html-format`	lib/jsduck/tag/member_tag.rb:126	Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	template/app/ClassRegistry.js:135	RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	template/app/ClassRegistry.js:136	RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	template/app/ClassRegistry.js:137	RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	template/app/view/cls/Overview.js:233	RegExp() called with a `search` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	template/app/view/comments/TagEditor.js:92	RegExp() called with a `tagname` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	template/resources/codemirror/markdown.js:171	RegExp() called with a `endChar` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	template/resources/prettify/prettify.js:12	RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.useless-assignment`	template/resources/prettify/prettify.js:12	`b` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	template/resources/prettify/prettify.js:16	`c[n++]` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	template/resources/prettify/prettify.js:29	`c` is assigned twice; the first assignment is useless	Lint
low	`opengrep/javascript.lang.correctness.useless-assignment`	template/resources/prettify/prettify.js:8	`B` is assigned twice; the first assignment is useless	Lint

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-4`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	4
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	skipped	`—`	0
Dependencies (osv-scanner)	Security	skipped	`—`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	13
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`febef5558ecd`	`prov-5+qual-2+sec-2`	0%	70	70
2026-11-14	`febef5558ecd`	`prov-4+qual-2+sec-2`	0%	70	70

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/senchalabs/jsduck/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/senchalabs/jsduck/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/senchalabs/jsduck/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/senchalabs/jsduck/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/senchalabs/jsduck/security.svg)](https://repotrust.synapticcyber.com/r/github.com/senchalabs/jsduck/)

Full text report

Repository: https://github.com/senchalabs/jsduck
Commit: febef5558ecd05da25f5c260365acc3afd0cafd8
Generated: 2026-11-14T14:52:07+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	65%	100%
Code quality	70	adequate	90%	100%
Security	70	adequate	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%

Month	Lines added	Attributed to AI
2013-06	776	0%
2013-07	807	0%
2013-08	2,055	0%
2013-09	576	0%
2013-10	460	0%
2013-11	6,329	0%
2013-12	29	0%
2014-03	67	0%
2014-10	2	0%
2014-11	27	0%
2015-05	3	0%
2015-06	17	0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.42, no CI test run detected; 10% of function code in complex or long functions; 1% duplicated lines. Weakest area: process.

Area	Score
Complexity (lizard)	73
Duplication	93
Code smells (Opengrep)	99
Tests and CI	66
Documentation	65
Type safety	n/a
Process (Scorecard review/maintenance)	5

Functions: 1,886; mean complexity 2.1, 90th percentile 4; 15 complex and 4 long functions
Duplicated lines: 1.2% of 20,931 compared
Tests: 13,372 test lines for 31,871 source lines (ratio 0.42); CI test commands: none detected; 27% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is adequate: 4 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	94
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	20

Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
OpenSSF Scorecard aggregate: 1.9/10 (published 2026-10-19)

Top findings

Severity	Finding	Location
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	template/app/view/Tabs.js:321
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `this.el.dom.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	template/app/view/Tabs.js:321
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	template/resources/prettify/prettify.js:26
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `b.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	template/resources/prettify/prettify.js:26
medium	`opengrep/ruby.lang.security.weak-hashes-md5`: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]	lib/jsduck/cache.rb:113
medium	`opengrep/ruby.rails.security.injection.raw-html-format`: Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. Use the `render templ [confidence medium]	lib/jsduck/tag/member_tag.rb:126
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]	template/app/ClassRegistry.js:135
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]	template/app/ClassRegistry.js:136
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `text` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]	template/app/ClassRegistry.js:137
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `search` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]	template/app/view/cls/Overview.js:233
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `tagname` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]	template/app/view/comments/TagEditor.js:92
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `endChar` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]	template/resources/codemirror/markdown.js:171
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `a` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]	template/resources/prettify/prettify.js:12

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v6.0.0.beta ships jsduck-6.0.0-beta.exe (8218 downloads)
binary-release-asset: release v5.3.4 ships jsduck-5.3.4.exe (7116 downloads)
binary-release-asset: release v5.3.2 ships jsduck-5.3.2.exe (232 downloads)
binary-release-asset: release v5.3.0 ships jsduck-5.3.0.exe (161 downloads)
binary-release-asset: release v5.2.0 ships jsduck-5.2.0.exe (105 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 31,871; test lines: 13,372

Language	Lines
Ruby	28,577
JavaScript	16,571
PHP	95