Leaderboard github.com

skyachieved/Horologium

View repository ↗
JavaScript
★ 0
commit dc0db4af05ec
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

100%

explicit

Confidence: 71%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

76/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

72/100

adequate

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

100% explicit

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

How the score is built

Explicitly attributed share100%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share100%
AI tool configuration files2
Work sessions at AI pace1
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.20

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	5	12,751	2026-10-15	2026-10-28

Lines added per month all AI-attributed share

2026-1012,751 · 100% AI

Findings in AI-attributed lines vs the rest

From git blame: 9,785 lines trace to AI-attributed commits, 0 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	2.66	—	—
Security	1.53	—	—

Evidence by analyzer

Explicit AI attributionok6 items

Claude Code: 5 attributed commits, 12,751 lines added
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'
Claude Code: trailer 'Co-Authored-By: Claude'

attributed_commit_share: 83.3%
attributed_commits: 5
attributed_loc: 12,751
attributed_loc_share: 100.0%
commits: 6
effective_loc: 12,751
tools_detected: 1

AI tool configurationok2 items

artifacts: 2
earliest_adoption: 2026-10-15
tools_configured: 2
workflow_agents: 0

Commit velocityok1 item

2,281 lines of first-party code in ~4.0h (569 lines/hour, 2 commit session)

excluded_import_loc: 10,470
flagged_loc: 2,281
flagged_loc_share: 100.0%
flagged_units: 1
max_loc_per_hour: 569.50
measured_loc: 2,281
median_loc_per_hour: 569.50
pr_timed_units: 0
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 1

Release velocityskipped

Coding styleok1 item

placeholder or demo-only phrasing: biquad('lowpass', 900, 0.707, sampleRate)(data); // a soft, dark hush: replace this with your own sound

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 1
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 1
index: 0.20
lines_scanned: 9,785
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0.10

Findings in AI-written linesok

ai_lines: 9,785
blame_failures: 0
files_blamed: 90
other_lines: 0
quality:ai_findings: 26
quality:ai_per_kloc: 2.66
quality:other_findings: 0
security:ai_findings: 15
security:ai_per_kloc: 1.53
security:other_findings: 0

Code quality

76 adequate

Code quality is adequate: test-to-source ratio 0.28, CI runs tests; 15% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity.

How the score is built

Complexity64
Duplication98
Lint and smells76
Tests and CI79
Documentation65
Type safetynot measured
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 20
function_nloc: 7,531
functions: 1,252
long_functions: 3
many_param_functions: 0
mean_ccn: 2.66
p90_ccn: 5
risky_nloc_share: 14.8%

Duplication (jscpd)ok2 items

compared_lines: 7,277
duplicated_lines: 28
duplicated_share: 0.4%
files: 90

Lintok

category:correctness: 26
findings: 26
scanned_lines: 9,785
weighted_findings: 11

Tests and CIok3 items

CI config: .github/workflows/ci.yml .github/workflows/ci.yml
CI config: .github/workflows/release.yml .github/workflows/release.yml
CI runs tests (npm test)

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: yes
ci_files: 2
cochange_commits: 2
cochange_share: 100.0%
source_lines: 9,785
test_lines: 2,720
test_ratio: 0.28

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 101

Type safetyskipped

Security

72 adequate

Security posture is adequate: 2 known vulnerabilities in 2 dependencies; 3 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)83
Vulnerable dependencies90
CI workflows33
Security posture0
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok

checked: 3
declared: 3
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 15
findings_high: 3
findings_low: 0
findings_medium: 12
parse_errors: 0
scanned_lines: 9,785
weighted_findings: 5.25

Dependencies (osv-scanner)ok

penalty: 6
vulnerabilities: 2
vulnerable_packages: 2
vulns_critical: 0
vulns_high: 0
vulns_low: 0
vulns_medium: 2
vulns_unknown: 0

CI workflows (zizmor)ok

findings: 8
findings_high: 6
findings_low: 0
findings_medium: 2
penalty: 66
workflows: 2

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 16.7%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

9 high22 medium20 low

Severity	Rule	Location	Message	Tool
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:21	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:22	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:23	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/cache-poisoning`	.github/workflows/release.yml:24	runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:24	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:36	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/javascript.express.security.audit.remote-property-injection`	extensions/music-sources/generated/synth/engine.js:28	Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-document-method`	src/renderer/js/dom.js:46	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	src/renderer/js/dom.js:46	User controlled data in a `tpl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	extensions/music-sources/generated/compose/compose.js:57	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	extensions/music-sources/generated/compose/compose.js:60	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	extensions/music-sources/generated/compose/compose.js:61	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	extensions/music-sources/generated/compose/compose.js:61	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	src/core/defaults.js:87	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`opengrep/javascript.lang.correctness.no-stringify-keys`	src/core/defaults.js:88	JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.	Lint
medium	`zizmor/artipacked`	.github/workflows/ci.yml:21	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/release.yml:23	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`	extensions/music-sources/generated/synth/drums.js:165	Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`osv/GHSA-g3hv-75wg-m249`	package-lock.json	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249	Dependencies (osv-scanner)
medium	`osv/GHSA-g3hv-75wg-m249`	package-lock.json	[email protected] (npm) is affected by GHSA-g3hv-75wg-m249	Dependencies (osv-scanner)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/core/sprite.js:44	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/core/sprite.js:57	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/core/sprite.js:62	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/core/sprite.js:65	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	src/main/extensions.js:146	RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop`	src/renderer/js/app-state.js:63	Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	src/renderer/js/icons.js:34	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.insecure-object-assign`	tools/audio-qa.js:49	Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	tools/new-extension.js:50	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	tools/scaffold.js:72	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	tools/ui-check.js:206	RegExp() called with a `l` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	extensions/music-sources/local-files/index.js:233	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	extensions/music-sources/local-files/index.js:233	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	extensions/music-sources/local-files/index.js:239	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	extensions/music-sources/local-files/index.js:239	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/core/schema.js:67	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/core/schema.js:67	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/main/miniplayer.js:20	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/main/miniplayer.js:20	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/renderer/js/views/profile-form.js:60	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/renderer/js/views/profile-form.js:60	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:135	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:135	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:146	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:202	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:202	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:206	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:206	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:206	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:87	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	tools/ui-check.js:87	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	26
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	8
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	2
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	15
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`dc0db4af05ec`	`prov-5+qual-2+sec-2`	100%	76	72
2026-11-14	`dc0db4af05ec`	`prov-4+qual-2+sec-2`	100%	76	72

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/skyachieved/Horologium/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/skyachieved/Horologium/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/skyachieved/Horologium/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/skyachieved/Horologium/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/skyachieved/Horologium/security.svg)](https://repotrust.synapticcyber.com/r/github.com/skyachieved/Horologium/)

Full text report

Repository: https://github.com/skyachieved/Horologium
Commit: dc0db4af05ec7af09f0198db0e2e28d882d7f361
Generated: 2026-11-14T14:52:07+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	100	explicit	71%	100%
Code quality	76	adequate	90%	100%
Security	72	adequate	85%	100%

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

Explicitly attributed share (lower bound): 100.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 100.0%

AI tool	Attributed commits	Lines added
Claude Code	5	12,751

AI tooling configured in repo: claude-code, generic-agent

Current source lines last changed by AI-attributed commits: 9,785 of 9,785.

Too few lines in one group to compare finding densities.

Stylometry index: 0.20 per 1,000 lines (narrated steps 0, placeholders 1, assistant phrasing 0, emoji 0). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-10	12,751	100%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (dc0db4af05ec)
Claude Code: trailer 'Co-Authored-By: Claude' (b7c6e4d22837)
Claude Code: trailer 'Co-Authored-By: Claude' (2f6526cd05f9)
Claude Code: trailer 'Co-Authored-By: Claude' (4a1de6abb255)
Claude Code: trailer 'Co-Authored-By: Claude' (f9d432534693)
CLAUDE.md (claude-code configuration) (CLAUDE.md)
AGENTS.md (generic-agent configuration) (AGENTS.md)
2,281 lines of first-party code in ~4.0h (569 lines/hour, 2 commit session) (b7c6e4d22837)
placeholder or demo-only phrasing: biquad('lowpass', 900, 0.707, sampleRate)(data); // a soft, dark hush: replace this with your own sound (templates/la)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.28, CI runs tests; 15% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity.

Area	Score
Complexity (lizard)	64
Duplication	98
Code smells (Opengrep)	76
Tests and CI	79
Documentation	65
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 1,252; mean complexity 2.7, 90th percentile 5; 20 complex and 3 long functions
Duplicated lines: 0.4% of 7,277 compared
Tests: 2,720 test lines for 9,785 source lines (ratio 0.28); CI test commands: npm test; 100% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is adequate: 2 known vulnerabilities in 2 dependencies; 3 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	83
Vulnerable dependencies (OSV)	90
CI workflows (zizmor)	33
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 2 in 2 packages (critical 0, high 0, medium 2, low 0)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
high	`opengrep/javascript.express.security.audit.remote-property-injection`: Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties. [confidence low]	extensions/music-sources/generated/synth/engine.js:28
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/renderer/js/dom.js:46
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `tpl.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	src/renderer/js/dom.js:46
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:21
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:22
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:23
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:24
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:36
high	`zizmor/cache-poisoning`: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	.github/workflows/release.yml:24
medium	`opengrep/javascript.lang.security.audit.unsafe-dynamic-method`: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]	extensions/music-sources/generated/synth/drums.js:165
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	src/core/sprite.js:44
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	src/core/sprite.js:57
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	src/core/sprite.js:62
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	src/core/sprite.js:65
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `t` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]	src/main/extensions.js:146
medium	`opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop`: Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]	src/renderer/js/app-state.js:63
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	src/renderer/js/icons.js:34
medium	`opengrep/javascript.lang.security.insecure-object-assign`: Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]	tools/audio-qa.js:49
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	tools/new-extension.js:50
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	tools/scaffold.js:72
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `l` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled in [confidence low]	tools/ui-check.js:206
medium	`osv/GHSA-g3hv-75wg-m249`: [email protected] (npm) is affected by GHSA-g3hv-75wg-m249	package-lock.json
medium	`osv/GHSA-g3hv-75wg-m249`: [email protected] (npm) is affected by GHSA-g3hv-75wg-m249	package-lock.json
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/ci.yml:21
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/release.yml:23

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 9,785; test lines: 2,720

Language	Lines
JavaScript	12,505