RepoTrust

Leaderboard github.com

thiagomuller/financial_control

Vibe coded, personal usage, localhost only, financial control

  • View repository ↗
  • Go
  • ★ 0
  • commit 086005e39ef6
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

38%

explicit

Confidence
71%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

64/100

weak

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

55/100

weak

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

38% explicit

Explicit AI attribution on 38% of first-party code added; an estimated 38% including velocity signals.

How the score is built

  • Explicitly attributed share38%
  • Unattributed share in AI-pace bursts0%
  • Estimated AI-generated share38%
  • AI tool configuration files0
  • Work sessions at AI pace0
  • Releases at AI pacenot measured
  • Coding-style index (1.0+ means possible)0.00

Attributed AI tools

ToolCommitsLines addedFirst seenLast seen
Claude Code22,9182026-04-262026-04-28

Lines added per month all AI-attributed share

  1. 2026-047,612 · 38% AI

Findings in AI-attributed lines vs the rest

From git blame: 1,090 lines trace to AI-attributed commits, 3,179 to others. Reported, not scored.

Findings per 1,000 linesAI-attributedOtherRatio
Code quality0.001.890.00×
Security0.000.320.00×

Evidence by analyzer

Explicit AI attributionok3 items
attributed_commit_share
33.3%
attributed_commits
2
attributed_loc
2,918
attributed_loc_share
38.3%
commits
6
effective_loc
7,612
tools_detected
1
AI tool configurationok
artifacts
0
tools_configured
0
workflow_agents
0
Commit velocityok
excluded_import_loc
4,694
flagged_loc
0
flagged_loc_share
0.0%
flagged_units
0
max_loc_per_hour
394.73
measured_loc
2,918
median_loc_per_hour
355.62
pr_timed_units
2
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
2
Release velocityskipped
Coding styleok
count:assistant_voice
0
count:emoji_in_code
0
count:narrated_steps
0
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
0
files:narrated_steps
0
files:placeholder
0
index
0
lines_scanned
4,269
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0
per_kloc:narrated_steps
0
per_kloc:placeholder
0
Findings in AI-written linesok
ai_lines
1,090
blame_failures
0
files_blamed
52
other_lines
3,179
quality:ai_findings
0
quality:ai_per_kloc
0
quality:other_findings
6
quality:other_per_kloc
1.89
quality:ratio
0
security:ai_findings
0
security:ai_per_kloc
0
security:other_findings
1
security:other_per_kloc
0.32
security:ratio
0

Code quality

64 weak

Code quality is weak: test-to-source ratio 0.52, no CI test run detected; 8% of function code in complex or long functions; 16% duplicated lines. Weakest area: duplication.

How the score is built

  • Complexity78
  • Duplication38
  • Lint and smells70
  • Tests and CI55
  • Documentation65
  • Type safety100
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok2 items
complex_functions
2
function_nloc
2,622
functions
250
long_functions
2
many_param_functions
0
mean_ccn
2.48
p90_ccn
5
risky_nloc_share
8.2%
Duplication (jscpd)ok10 items
compared_lines
2,881
duplicated_lines
463
duplicated_share
16.1%
files
52
Lintok
category:best-practice
6
findings
6
scanned_lines
4,269
weighted_findings
6
Tests and CIok
check:ci_present
no
check:ci_runs_lint
no
check:ci_runs_tests
no
check:has_tests
yes
check:test_ratio
yes
check:tests_cochange
yes
ci_files
0
cochange_commits
3
cochange_share
100.0%
source_lines
4,269
test_lines
2,204
test_ratio
0.52
Documentationok2 items
  • README.md README.md
  • LICENSE LICENSE
check:changelog
no
check:contributing
no
check:license
yes
check:readme
yes
readme_lines
109
Type safetyok1 item
  • TypeScript strict type checking: my_finances_ui/tsconfig.json my_finances_ui/tsconfig.json
check:low_escape_density
yes
check:strict_config
yes
escapes
1
escapes_per_kloc
0.65

Security

55 weak

Security posture is weak: 197 known vulnerabilities in 42 dependencies; 2 high-severity SAST findings. Weakest area: dependencies.

How the score is built

  • Secrets100
  • Static analysis (SAST)71
  • Vulnerable dependencies1
  • CI workflowsnot measured
  • Security posture20
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesok
checked
17
declared
17
lookup_errors
0
missing
0
recent
0
Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
3
findings_high
2
findings_low
0
findings_medium
1
parse_errors
0
scanned_lines
4,269
weighted_findings
4.20
Dependencies (osv-scanner)ok
penalty
285
vulnerabilities
197
vulnerable_packages
42
vulns_critical
10
vulns_high
67
vulns_low
17
vulns_medium
96
vulns_unknown
7
CI workflows (zizmor)skipped
Security postureok1 item
  • e2e/package.json has no lockfile alongside it (unpinned dependencies) e2e/package.json
check:dependency_updates
no
check:lockfiles
no
check:security_policy
no
check:signed_commits
yes
signed_commit_share
66.7%
unpinned_manifests
1
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

10 critical69 high110 medium17 low

SeverityRuleLocationMessageTool
critical osv/GHSA-5cgq-3rg8-m6cv my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv Dependencies (osv-scanner)
critical osv/GHSA-89gr-r52h-f8rx my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx Dependencies (osv-scanner)
critical osv/GHSA-f5wc-c3c7-36mc my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc Dependencies (osv-scanner)
critical osv/GHSA-jppx-rxg9-jmrx my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx Dependencies (osv-scanner)
critical osv/GHSA-rm3j-f69w-wqmq my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq Dependencies (osv-scanner)
critical osv/GHSA-vgwf-h737-ff37 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37 Dependencies (osv-scanner)
critical osv/GHSA-x527-x647-q7gg my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg Dependencies (osv-scanner)
critical osv/GHSA-23hp-3jrh-7fpw my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-23hp-3jrh-7fpw Dependencies (osv-scanner)
critical osv/GHSA-67c8-pqhq-4rmx my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-67c8-pqhq-4rmx Dependencies (osv-scanner)
critical osv/GHSA-jqcg-44mw-7w3h my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h Dependencies (osv-scanner)
high opengrep/dockerfile.security.missing-user my_finances_api/Dockerfile:15 By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... Static analysis (opengrep)
high osv/GHSA-259r-337f-4rfw my_finances_api/go.mod github.com/klauspost/[email protected] (Go) is affected by GO-2026-5841, GHSA-259r-337f-4rfw Dependencies (osv-scanner)
high osv/GHSA-hfg8-hc9c-6c3h my_finances_api/go.mod github.com/moby/[email protected] (Go) is affected by GO-2026-6253, GHSA-hfg8-hc9c-6c3h Dependencies (osv-scanner)
high osv/GHSA-q4h4-gmj2-qvw2 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2 Dependencies (osv-scanner)
high osv/GHSA-w879-237q-wc7r my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r Dependencies (osv-scanner)
high opengrep/dockerfile.security.missing-user my_finances_ui/Dockerfile:14 By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... Static analysis (opengrep)
high osv/GHSA-22jm-h49p-29qw my_finances_ui/package-lock.json @modelcontextprotocol/[email protected] (npm) is affected by GHSA-22jm-h49p-29qw Dependencies (osv-scanner)
high osv/GHSA-27r3-jxmh-p828 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 Dependencies (osv-scanner)
high osv/GHSA-28wg-ghj8-5hjv my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-28wg-ghj8-5hjv Dependencies (osv-scanner)
high osv/GHSA-2m5v-pch6-74hx my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx Dependencies (osv-scanner)
high osv/GHSA-2m5v-pch6-74hx my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-2m5v-pch6-74hx Dependencies (osv-scanner)
high osv/GHSA-2v37-7h3g-55p8 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-2v37-7h3g-55p8 Dependencies (osv-scanner)
high osv/GHSA-39pv-4j6c-2g6v my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-39pv-4j6c-2g6v Dependencies (osv-scanner)
high osv/GHSA-3jxr-9vmj-r5cp my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp Dependencies (osv-scanner)
high osv/GHSA-46jr-4wx8-v453 my_finances_ui/package-lock.json @modelcontextprotocol/[email protected] (npm) is affected by GHSA-46jr-4wx8-v453 Dependencies (osv-scanner)
high osv/GHSA-48r7-hpm6-gfxm my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-48r7-hpm6-gfxm Dependencies (osv-scanner)
high osv/GHSA-4c8g-83qw-93j6 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-4c8g-83qw-93j6 Dependencies (osv-scanner)
high osv/GHSA-4cwx-7wf7-3272 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-4cwx-7wf7-3272 Dependencies (osv-scanner)
high osv/GHSA-4w7w-5xrc-9h26 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-4w7w-5xrc-9h26 Dependencies (osv-scanner)
high osv/GHSA-52v5-jr5w-gjxr my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-52v5-jr5w-gjxr Dependencies (osv-scanner)
high osv/GHSA-57xq-rjx2-v5xh my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-57xq-rjx2-v5xh Dependencies (osv-scanner)
high osv/GHSA-587h-7wmj-h5pm my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-587h-7wmj-h5pm Dependencies (osv-scanner)
high osv/GHSA-62vg-58rm-qff7 my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-62vg-58rm-qff7 Dependencies (osv-scanner)
high osv/GHSA-68fv-2mgg-jv7q my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q Dependencies (osv-scanner)
high osv/GHSA-6g55-p6wh-862q my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-6g55-p6wh-862q Dependencies (osv-scanner)
high osv/GHSA-6j4f-fj2g-mc7p my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p Dependencies (osv-scanner)
high osv/GHSA-6qxp-vccf-f47h my_finances_ui/package-lock.json @modelcontextprotocol/[email protected] (npm) is affected by GHSA-6qxp-vccf-f47h Dependencies (osv-scanner)
high osv/GHSA-73wf-gq98-2v4g my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g Dependencies (osv-scanner)
high osv/GHSA-7p8r-x3mc-p8w7 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-7p8r-x3mc-p8w7 Dependencies (osv-scanner)
high osv/GHSA-88fw-hqm2-52qc my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-88fw-hqm2-52qc Dependencies (osv-scanner)
high osv/GHSA-8x88-c5mf-7j5w my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-8x88-c5mf-7j5w Dependencies (osv-scanner)
high osv/GHSA-c83g-rgw3-j3cx my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx Dependencies (osv-scanner)
high osv/GHSA-f65p-4m7j-42xc my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-f65p-4m7j-42xc Dependencies (osv-scanner)
high osv/GHSA-f897-62hf-6gxq my_finances_ui/package-lock.json @modelcontextprotocol/[email protected] (npm) is affected by GHSA-f897-62hf-6gxq Dependencies (osv-scanner)
high osv/GHSA-ff3f-86qr-9cv3 my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-ff3f-86qr-9cv3 Dependencies (osv-scanner)
high osv/GHSA-hm92-r4w5-c3mj my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-hm92-r4w5-c3mj Dependencies (osv-scanner)
high osv/GHSA-jhpw-976m-542j my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-jhpw-976m-542j Dependencies (osv-scanner)
high osv/GHSA-jj27-h5hq-8x99 my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-jj27-h5hq-8x99 Dependencies (osv-scanner)
high osv/GHSA-jj27-h5hq-8x99 my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-jj27-h5hq-8x99 Dependencies (osv-scanner)
high osv/GHSA-jqff-g426-hqxp my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-jqff-g426-hqxp Dependencies (osv-scanner)
high osv/GHSA-mh99-v99m-4gvg my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg Dependencies (osv-scanner)
high osv/GHSA-mrhx-c7xc-m3w5 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-mrhx-c7xc-m3w5 Dependencies (osv-scanner)
high osv/GHSA-mwp4-54f8-5fhr my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-mwp4-54f8-5fhr Dependencies (osv-scanner)
high osv/GHSA-p3vc-36g9-x9gr my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-p3vc-36g9-x9gr Dependencies (osv-scanner)
high osv/GHSA-q3j6-qgpj-74h6 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-q3j6-qgpj-74h6 Dependencies (osv-scanner)
high osv/GHSA-q6f4-qqrg-jv6x my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-q6f4-qqrg-jv6x Dependencies (osv-scanner)
high osv/GHSA-qhr7-859c-m2p7 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 Dependencies (osv-scanner)
high osv/GHSA-qrxm-fqhp-jwvm my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm Dependencies (osv-scanner)
high osv/GHSA-qrxm-fqhp-jwvm my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-qrxm-fqhp-jwvm Dependencies (osv-scanner)
high osv/GHSA-qw65-cvwx-89v3 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 Dependencies (osv-scanner)
high osv/GHSA-r28c-9q8g-f849 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-r28c-9q8g-f849 Dependencies (osv-scanner)
high osv/GHSA-r292-9mhp-454m my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-r292-9mhp-454m Dependencies (osv-scanner)
high osv/GHSA-rfgv-xxqx-mfg5 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5 Dependencies (osv-scanner)
high osv/GHSA-rfgv-xxqx-mfg5 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-rfgv-xxqx-mfg5 Dependencies (osv-scanner)
high osv/GHSA-rgjc-h3x7-9mwg my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-rgjc-h3x7-9mwg Dependencies (osv-scanner)
high osv/GHSA-rgw5-rvv9-x895 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 Dependencies (osv-scanner)
high osv/GHSA-v2hh-gcrm-f6hx my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-v2hh-gcrm-f6hx Dependencies (osv-scanner)
high osv/GHSA-v39h-62p7-jpjc my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-v39h-62p7-jpjc Dependencies (osv-scanner)
high osv/GHSA-v56q-mh7h-f735 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-v56q-mh7h-f735 Dependencies (osv-scanner)
high osv/GHSA-vmh5-mc38-953g my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-vmh5-mc38-953g Dependencies (osv-scanner)
high osv/GHSA-vxpw-j846-p89q my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-vxpw-j846-p89q Dependencies (osv-scanner)
high osv/GHSA-vxpw-j846-p89q my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-vxpw-j846-p89q Dependencies (osv-scanner)
high osv/GHSA-w293-vg96-wgc3 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-w293-vg96-wgc3 Dependencies (osv-scanner)
high osv/GHSA-w4pp-8pjf-rmxw my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-w4pp-8pjf-rmxw Dependencies (osv-scanner)
high osv/GHSA-x9g3-xrwr-cwfg my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-x9g3-xrwr-cwfg Dependencies (osv-scanner)
high osv/GHSA-xjj6-f33q-929c my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-xjj6-f33q-929c Dependencies (osv-scanner)
high osv/GHSA-xjj6-f33q-929c my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-xjj6-f33q-929c Dependencies (osv-scanner)
high osv/GHSA-xvcm-6775-5m9r my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-xvcm-6775-5m9r Dependencies (osv-scanner)
high osv/GHSA-xwg4-73v4-xw9w my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-xwg4-73v4-xw9w Dependencies (osv-scanner)
medium opengrep/go.lang.best-practice.hidden-goroutine my_finances_api/internal/scheduler/scheduler.go:10 Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'. Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm my_finances_ui/src/app/features/bank-accounts/bank-accounts.component.ts:85 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm my_finances_ui/src/app/features/goals/goals.component.ts:78 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm my_finances_ui/src/app/features/tags/tags.component.ts:93 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm my_finances_ui/src/app/features/transactions/transactions.component.ts:110 found confirm() call; should this be in production code? Lint
medium opengrep/javascript.lang.best-practice.javascript-confirm my_finances_ui/src/app/features/transfers/transfers.component.ts:100 found confirm() call; should this be in production code? Lint
medium osv/GHSA-45gg-vh54-h5m9 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9 Dependencies (osv-scanner)
medium osv/GHSA-78mq-xcr3-xm33 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33 Dependencies (osv-scanner)
medium osv/GHSA-9m57-25v3-79x9 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9 Dependencies (osv-scanner)
medium osv/GHSA-mjcv-p78q-w5fw my_finances_api/go.mod github.com/moby/sys/[email protected] (Go) is affected by GO-2026-6686, GHSA-mjcv-p78q-w5fw Dependencies (osv-scanner)
medium osv/GHSA-q7gw-24fr-5p69 my_finances_api/go.mod go.opentelemetry.io/otel/[email protected] (Go) is affected by GHSA-q7gw-24fr-5p69 Dependencies (osv-scanner)
medium osv/GHSA-qpw4-5x99-6vjp my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp Dependencies (osv-scanner)
medium osv/GO-2026-5024 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5024 Dependencies (osv-scanner)
medium osv/GO-2026-5158 my_finances_api/go.mod go.opentelemetry.io/[email protected] (Go) is affected by GO-2026-5158 Dependencies (osv-scanner)
medium osv/GO-2026-5932 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-5932 Dependencies (osv-scanner)
medium osv/GO-2026-6303 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-6303 Dependencies (osv-scanner)
medium osv/GO-2026-6354 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-6354 Dependencies (osv-scanner)
medium osv/GO-2026-6355 my_finances_api/go.mod golang.org/x/[email protected] (Go) is affected by GO-2026-6355 Dependencies (osv-scanner)
medium osv/GO-2026-6865 my_finances_api/go.mod github.com/klauspost/[email protected] (Go) is affected by GO-2026-6865 Dependencies (osv-scanner)
medium opengrep/go.lang.security.audit.net.use-tls my_finances_api/main.go:41 Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. [confidence medium] Static analysis (opengrep)
medium osv/GHSA-2gcr-mfcq-wcc3 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-2gcr-mfcq-wcc3 Dependencies (osv-scanner)
medium osv/GHSA-2jfj-6hjv-fm6j my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-2jfj-6hjv-fm6j Dependencies (osv-scanner)
medium osv/GHSA-3g3m-2fjr-6pw4 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4 Dependencies (osv-scanner)
medium osv/GHSA-3hrh-pfw6-9m5x my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-3hrh-pfw6-9m5x Dependencies (osv-scanner)
medium osv/GHSA-3wwx-pv8p-q78v my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-3wwx-pv8p-q78v Dependencies (osv-scanner)
medium osv/GHSA-3xpg-4rpp-hhhm my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-3xpg-4rpp-hhhm Dependencies (osv-scanner)
medium osv/GHSA-46wx-v44x-9hh2 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-46wx-v44x-9hh2 Dependencies (osv-scanner)
medium osv/GHSA-4h7h-rv7c-7m2v my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-4h7h-rv7c-7m2v Dependencies (osv-scanner)
medium osv/GHSA-4m76-xfj5-7975 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-4m76-xfj5-7975 Dependencies (osv-scanner)
medium osv/GHSA-4mjr-xmp4-gh2g my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g Dependencies (osv-scanner)
medium osv/GHSA-4qv8-2p9j-2685 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 Dependencies (osv-scanner)
medium osv/GHSA-4qv8-2p9j-2685 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-4qv8-2p9j-2685 Dependencies (osv-scanner)
medium osv/GHSA-54fx-42gc-7vw4 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-54fx-42gc-7vw4 Dependencies (osv-scanner)
medium osv/GHSA-55wc-3pg8-jfw6 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-55wc-3pg8-jfw6 Dependencies (osv-scanner)
medium osv/GHSA-58w9-8g37-x9v5 my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-58w9-8g37-x9v5 Dependencies (osv-scanner)
medium osv/GHSA-5r4p-p66f-jhc7 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-5r4p-p66f-jhc7 Dependencies (osv-scanner)
medium osv/GHSA-692r-grfm-v8x7 my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-692r-grfm-v8x7 Dependencies (osv-scanner)
medium osv/GHSA-698v-4r3x-3vcv my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-698v-4r3x-3vcv Dependencies (osv-scanner)
medium osv/GHSA-69xw-7hcm-h432 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-69xw-7hcm-h432 Dependencies (osv-scanner)
medium osv/GHSA-6pq8-jhm2-2vcw my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw Dependencies (osv-scanner)
medium osv/GHSA-6prh-2h8m-c8cw my_finances_ui/package-lock.json @modelcontextprotocol/[email protected] (npm) is affected by GHSA-6prh-2h8m-c8cw Dependencies (osv-scanner)
medium osv/GHSA-82fw-gwwq-j7x9 my_finances_ui/package-lock.json @vitest/[email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9 Dependencies (osv-scanner)
medium osv/GHSA-82fw-gwwq-j7x9 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-82fw-gwwq-j7x9 Dependencies (osv-scanner)
medium osv/GHSA-8j4g-w8fx-2239 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-8j4g-w8fx-2239 Dependencies (osv-scanner)
medium osv/GHSA-8xcm-r25x-g524 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-8xcm-r25x-g524 Dependencies (osv-scanner)
medium osv/GHSA-8xcm-r25x-g524 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-8xcm-r25x-g524 Dependencies (osv-scanner)
medium osv/GHSA-9fm3-97px-rjf6 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 Dependencies (osv-scanner)
medium osv/GHSA-9fm3-97px-rjf6 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-9fm3-97px-rjf6 Dependencies (osv-scanner)
medium osv/GHSA-9vqf-7f2p-gf9v my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-9vqf-7f2p-gf9v Dependencies (osv-scanner)
medium osv/GHSA-crvj-82cr-hjcx my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-crvj-82cr-hjcx Dependencies (osv-scanner)
medium osv/GHSA-f23p-vx2j-j53r my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-f23p-vx2j-j53r Dependencies (osv-scanner)
medium osv/GHSA-f3m7-gqxr-g87x my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-f3m7-gqxr-g87x Dependencies (osv-scanner)
medium osv/GHSA-f3m7-gqxr-g87x my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-f3m7-gqxr-g87x Dependencies (osv-scanner)
medium osv/GHSA-f577-qrjj-4474 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-f577-qrjj-4474 Dependencies (osv-scanner)
medium osv/GHSA-f72v-6w45-q472 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-f72v-6w45-q472 Dependencies (osv-scanner)
medium osv/GHSA-frvp-7c67-39w9 my_finances_ui/package-lock.json @hono/[email protected] (npm) is affected by GHSA-frvp-7c67-39w9 Dependencies (osv-scanner)
medium osv/GHSA-fx2h-pf6j-xcff my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-fx2h-pf6j-xcff Dependencies (osv-scanner)
medium osv/GHSA-fxqj-rqcc-2cmp my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-fxqj-rqcc-2cmp Dependencies (osv-scanner)
medium osv/GHSA-g3hv-75wg-m249 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-g3hv-75wg-m249 Dependencies (osv-scanner)
medium osv/GHSA-g6gw-c38x-mqfc my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-g6gw-c38x-mqfc Dependencies (osv-scanner)
medium osv/GHSA-gqvv-2mrq-wpjv my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-gqvv-2mrq-wpjv Dependencies (osv-scanner)
medium osv/GHSA-gvwx-54wh-qm9j my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-gvwx-54wh-qm9j Dependencies (osv-scanner)
medium osv/GHSA-h3mg-xc3c-68pw my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-h3mg-xc3c-68pw Dependencies (osv-scanner)
medium osv/GHSA-h7mg-cq63-vhpq my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-h7mg-cq63-vhpq Dependencies (osv-scanner)
medium osv/GHSA-hh8m-fm6v-7cvg my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-hh8m-fm6v-7cvg Dependencies (osv-scanner)
medium osv/GHSA-hh8m-fm6v-7cvg my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-hh8m-fm6v-7cvg Dependencies (osv-scanner)
medium osv/GHSA-hrr3-gc8f-f4qj my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj Dependencies (osv-scanner)
medium osv/GHSA-hvrm-45r6-mjfj my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-hvrm-45r6-mjfj Dependencies (osv-scanner)
medium osv/GHSA-hxh3-vqpv-xpqv my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-hxh3-vqpv-xpqv Dependencies (osv-scanner)
medium osv/GHSA-j6c9-x7qj-28xf my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-j6c9-x7qj-28xf Dependencies (osv-scanner)
medium osv/GHSA-j6r3-76f7-8jcv my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-j6r3-76f7-8jcv Dependencies (osv-scanner)
medium osv/GHSA-jfc7-64v2-mr8c my_finances_ui/package-lock.json @sigstore/[email protected] (npm) is affected by GHSA-jfc7-64v2-mr8c Dependencies (osv-scanner)
medium osv/GHSA-jpvv-r467-5p4w my_finances_ui/package-lock.json @hono/[email protected] (npm) is affected by GHSA-jpvv-r467-5p4w Dependencies (osv-scanner)
medium osv/GHSA-jr45-8vmc-qm54 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-jr45-8vmc-qm54 Dependencies (osv-scanner)
medium osv/GHSA-jxxr-4gwj-5jf2 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-jxxr-4gwj-5jf2 Dependencies (osv-scanner)
medium osv/GHSA-m8rv-5g2x-5cg5 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-m8rv-5g2x-5cg5 Dependencies (osv-scanner)
medium osv/GHSA-m8rv-5g2x-5cg5 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-m8rv-5g2x-5cg5 Dependencies (osv-scanner)
medium osv/GHSA-p297-fm68-3q8c my_finances_ui/package-lock.json @angular/[email protected] (npm) is affected by GHSA-p297-fm68-3q8c Dependencies (osv-scanner)
medium osv/GHSA-p77w-8qqv-26rm my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-p77w-8qqv-26rm Dependencies (osv-scanner)
medium osv/GHSA-p88m-4jfj-68fv my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-p88m-4jfj-68fv Dependencies (osv-scanner)
medium osv/GHSA-p88m-4jfj-68fv my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-p88m-4jfj-68fv Dependencies (osv-scanner)
medium osv/GHSA-pmjh-fq2x-6v4x my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-pmjh-fq2x-6v4x Dependencies (osv-scanner)
medium osv/GHSA-pr7r-676h-xcf6 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-pr7r-676h-xcf6 Dependencies (osv-scanner)
medium osv/GHSA-q2hr-2g5m-vwhr my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr Dependencies (osv-scanner)
medium osv/GHSA-q8mj-m7cp-5q26 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-q8mj-m7cp-5q26 Dependencies (osv-scanner)
medium osv/GHSA-qp7p-654g-cw7p my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-qp7p-654g-cw7p Dependencies (osv-scanner)
medium osv/GHSA-qxg6-89mg-rqv8 my_finances_ui/package-lock.json @vitest/[email protected] (npm) is affected by GHSA-qxg6-89mg-rqv8 Dependencies (osv-scanner)
medium osv/GHSA-r825-w8mm-5pxw my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-r825-w8mm-5pxw Dependencies (osv-scanner)
medium osv/GHSA-rmxm-3fg6-px4f my_finances_ui/package-lock.json @hono/[email protected] (npm) is affected by GHSA-rmxm-3fg6-px4f Dependencies (osv-scanner)
medium osv/GHSA-rpw4-54j3-4h4q my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-rpw4-54j3-4h4q Dependencies (osv-scanner)
medium osv/GHSA-rq7h-c2jc-7f22 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-rq7h-c2jc-7f22 Dependencies (osv-scanner)
medium osv/GHSA-rv63-4mwf-qqc2 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-rv63-4mwf-qqc2 Dependencies (osv-scanner)
medium osv/GHSA-rvq5-wwqv-78pq my_finances_ui/package-lock.json @modelcontextprotocol/[email protected] (npm) is affected by GHSA-rvq5-wwqv-78pq Dependencies (osv-scanner)
medium osv/GHSA-rx4f-c7p8-82vq my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-rx4f-c7p8-82vq Dependencies (osv-scanner)
medium osv/GHSA-rxp7-6hxx-x8q5 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-rxp7-6hxx-x8q5 Dependencies (osv-scanner)
medium osv/GHSA-v2v4-37r5-5v8g my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-v2v4-37r5-5v8g Dependencies (osv-scanner)
medium osv/GHSA-v3r7-h72x-cjcm my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-v3r7-h72x-cjcm Dependencies (osv-scanner)
medium osv/GHSA-v3r7-h72x-cjcm my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-v3r7-h72x-cjcm Dependencies (osv-scanner)
medium osv/GHSA-v6wh-96g9-6wx3 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-v6wh-96g9-6wx3 Dependencies (osv-scanner)
medium osv/GHSA-vmf3-w455-68vh my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-vmf3-w455-68vh Dependencies (osv-scanner)
medium osv/GHSA-w5vr-8v7q-w6rv my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv Dependencies (osv-scanner)
medium osv/GHSA-w62v-xxxg-mg59 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-w62v-xxxg-mg59 Dependencies (osv-scanner)
medium osv/GHSA-w74x-v6f9-j3xg my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg Dependencies (osv-scanner)
medium osv/GHSA-w8wr-v893-vjvp my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-w8wr-v893-vjvp Dependencies (osv-scanner)
medium osv/GHSA-wgpf-jwqj-8h8p my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-wgpf-jwqj-8h8p Dependencies (osv-scanner)
medium osv/GHSA-wwfh-h76j-fc44 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-wwfh-h76j-fc44 Dependencies (osv-scanner)
medium osv/GHSA-x5fp-wj9c-mxmx my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-x5fp-wj9c-mxmx Dependencies (osv-scanner)
medium osv/GHSA-xgjw-pm74-86q4 my_finances_ui/package-lock.json @sigstore/[email protected] (npm) is affected by GHSA-xgjw-pm74-86q4 Dependencies (osv-scanner)
medium osv/GHSA-xgm2-5f3f-mvvc my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-xgm2-5f3f-mvvc Dependencies (osv-scanner)
medium osv/GHSA-xrhx-7g5j-rcj5 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-xrhx-7g5j-rcj5 Dependencies (osv-scanner)
low osv/GHSA-2gqq-gqf2-x968 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-2gqq-gqf2-x968 Dependencies (osv-scanner)
low osv/GHSA-333x-w4r6-6crp my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-333x-w4r6-6crp Dependencies (osv-scanner)
low osv/GHSA-35p6-xmwp-9g52 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-35p6-xmwp-9g52 Dependencies (osv-scanner)
low osv/GHSA-35p6-xmwp-9g52 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-35p6-xmwp-9g52 Dependencies (osv-scanner)
low osv/GHSA-3gg2-335m-rxc6 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-3gg2-335m-rxc6 Dependencies (osv-scanner)
low osv/GHSA-4x5r-pxfx-6jf8 my_finances_ui/package-lock.json @babel/[email protected] (npm) is affected by GHSA-4x5r-pxfx-6jf8 Dependencies (osv-scanner)
low osv/GHSA-79qm-7rj5-m7r9 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-79qm-7rj5-m7r9 Dependencies (osv-scanner)
low osv/GHSA-8436-99hf-9mmv my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-8436-99hf-9mmv Dependencies (osv-scanner)
low osv/GHSA-9jrq-w75r-8gcw my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-9jrq-w75r-8gcw Dependencies (osv-scanner)
low osv/GHSA-g7r4-m6w7-qqqr my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-g7r4-m6w7-qqqr Dependencies (osv-scanner)
low osv/GHSA-g8m3-5g58-fq7m my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-g8m3-5g58-fq7m Dependencies (osv-scanner)
low osv/GHSA-g8m3-5g58-fq7m my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-g8m3-5g58-fq7m Dependencies (osv-scanner)
low osv/GHSA-hm8q-7f3q-5f36 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-hm8q-7f3q-5f36 Dependencies (osv-scanner)
low osv/GHSA-r53p-7pc4-xj5r my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-r53p-7pc4-xj5r Dependencies (osv-scanner)
low osv/GHSA-r53p-7pc4-xj5r my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-r53p-7pc4-xj5r Dependencies (osv-scanner)
low osv/GHSA-v422-hmwv-36x6 my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-v422-hmwv-36x6 Dependencies (osv-scanner)
low osv/GHSA-xhq7-xmqj-769h my_finances_ui/package-lock.json [email protected] (npm) is affected by GHSA-xhq7-xmqj-769h Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceskipped—0
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-40
Findings in AI-written linesAI provenanceokgit-blame0
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b4146
Tests and CICode qualityok—0
Type safetyCode qualityok—0
CI workflows (zizmor)Securityskipped—0
Dependencies (osv-scanner)Securityokosv-scanner version: 2.7.1197
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityok—0
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b4143
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

Scores from different scoring versions aren't directly comparable.

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-14086005e39ef6prov-5+qual-2+sec-238%6455
2026-11-14086005e39ef6prov-4+qual-2+sec-238%6455

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/thiagomuller/financial_control/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/thiagomuller/financial_control/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/thiagomuller/financial_control/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/thiagomuller/financial_control/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/thiagomuller/financial_control/security.svg)](https://repotrust.synapticcyber.com/r/github.com/thiagomuller/financial_control/)
Full text report

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 38 explicit 71% 100%
Code quality 64 weak 90% 100%
Security 55 weak 85% 100%

AI provenance

Explicit AI attribution on 38% of first-party code added; an estimated 38% including velocity signals.

  • Explicitly attributed share (lower bound): 38.3%
  • Unattributed share in AI-consistent velocity bursts: 0.0%
  • Estimated AI-generated share: 38.3%
AI tool Attributed commits Lines added
Claude Code 2 2,918

Current source lines last changed by AI-attributed commits: 1,090 of 4,269.

Findings per 1,000 lines AI-attributed Other Ratio
Quality 0.0 1.887 0.0x
Security 0.0 0.315 0.0x
Month Lines added Attributed to AI
2026-04 7,612 38%

Evidence

  • Claude Code: trailer 'Co-Authored-By: Claude' (25c4ab33fc5c)
  • Claude Code: trailer 'Co-Authored-By: Claude' (af8b7178d49b)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.52, no CI test run detected; 8% of function code in complex or long functions; 16% duplicated lines. Weakest area: duplication.

Area Score
Complexity (lizard) 78
Duplication 38
Code smells (Opengrep) 70
Tests and CI 55
Documentation 65
Type safety 100
Process (Scorecard review/maintenance) n/a
  • Functions: 250; mean complexity 2.5, 90th percentile 5; 2 complex and 2 long functions
  • Duplicated lines: 16.1% of 2,881 compared
  • Tests: 2,204 test lines for 4,269 source lines (ratio 0.52); CI test commands: none detected; 100% of recent source commits also change tests
  • Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 197 known vulnerabilities in 42 dependencies; 2 high-severity SAST findings. Weakest area: dependencies.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 71
Vulnerable dependencies (OSV) 1
CI workflows (zizmor) n/a
Posture (policy, updates, signing, lockfiles) 20
OpenSSF Scorecard n/a

  • Known vulnerabilities: 197 in 42 packages (critical 10, high 67, medium 96, low 17)

  • Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles

Top findings

Severity Finding Location
critical osv/GHSA-jppx-rxg9-jmrx: golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx my_finances_api/go.mod
critical osv/GHSA-f5wc-c3c7-36mc: golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc my_finances_api/go.mod
critical osv/GHSA-vgwf-h737-ff37: golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37 my_finances_api/go.mod
critical osv/GHSA-89gr-r52h-f8rx: golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx my_finances_api/go.mod
critical osv/GHSA-rm3j-f69w-wqmq: golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq my_finances_api/go.mod
critical osv/GHSA-5cgq-3rg8-m6cv: golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv my_finances_api/go.mod
critical osv/GHSA-x527-x647-q7gg: golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg my_finances_api/go.mod
critical osv/GHSA-67c8-pqhq-4rmx: [email protected] (npm) is affected by GHSA-67c8-pqhq-4rmx my_finances_ui/package-lock.json
critical osv/GHSA-jqcg-44mw-7w3h: [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h my_finances_ui/package-lock.json
critical osv/GHSA-23hp-3jrh-7fpw: [email protected] (npm) is affected by GHSA-23hp-3jrh-7fpw my_finances_ui/package-lock.json
high opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] my_finances_api/Dockerfile:15
high opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] my_finances_ui/Dockerfile:14
high osv/GHSA-259r-337f-4rfw: github.com/klauspost/[email protected] (Go) is affected by GO-2026-5841, GHSA-259r-337f-4rfw my_finances_api/go.mod
high osv/GHSA-hfg8-hc9c-6c3h: github.com/moby/[email protected] (Go) is affected by GO-2026-6253, GHSA-hfg8-hc9c-6c3h my_finances_api/go.mod
high osv/GHSA-q4h4-gmj2-qvw2: golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2 my_finances_api/go.mod
high osv/GHSA-w879-237q-wc7r: golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r my_finances_api/go.mod
high osv/GHSA-39pv-4j6c-2g6v: @angular/[email protected] (npm) is affected by GHSA-39pv-4j6c-2g6v my_finances_ui/package-lock.json
high osv/GHSA-48r7-hpm6-gfxm: @angular/[email protected] (npm) is affected by GHSA-48r7-hpm6-gfxm my_finances_ui/package-lock.json
high osv/GHSA-jhpw-976m-542j: @angular/[email protected] (npm) is affected by GHSA-jhpw-976m-542j my_finances_ui/package-lock.json
high osv/GHSA-p3vc-36g9-x9gr: @angular/[email protected] (npm) is affected by GHSA-p3vc-36g9-x9gr my_finances_ui/package-lock.json
high osv/GHSA-q6f4-qqrg-jv6x: @angular/[email protected] (npm) is affected by GHSA-q6f4-qqrg-jv6x my_finances_ui/package-lock.json
high osv/GHSA-jj27-h5hq-8x99: @angular/[email protected] (npm) is affected by GHSA-jj27-h5hq-8x99 my_finances_ui/package-lock.json
high osv/GHSA-jj27-h5hq-8x99: @angular/[email protected] (npm) is affected by GHSA-jj27-h5hq-8x99 my_finances_ui/package-lock.json
high osv/GHSA-rgjc-h3x7-9mwg: @angular/[email protected] (npm) is affected by GHSA-rgjc-h3x7-9mwg my_finances_ui/package-lock.json
high osv/GHSA-57xq-rjx2-v5xh: @angular/[email protected] (npm) is affected by GHSA-57xq-rjx2-v5xh my_finances_ui/package-lock.json

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 4,269; test lines: 2,204
Language Lines
Go 3,724
TypeScript 2,749