Leaderboard github.com

vladotesanovic/ngSemantic

Angular 2 building blocks :package: based on Semantic UI

View repository ↗
TypeScript
★ 963
commit 0a5da26346ff
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

none-detected

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

47/100

poor

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

69/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace0
Releases at AI pacenot measured
Coding-style index (1.0+ means possible)0.00

Lines added per month all AI-attributed share

2015-0915,427 · 0% AI
2015-1023,925 · 0% AI
2015-11135 · 0% AI
2016-016,592 · 0% AI
2016-022,266 · 0% AI
2016-03344 · 0% AI
2016-041,680 · 0% AI
2016-061,297 · 0% AI
2016-072,105 · 0% AI
2016-08690 · 0% AI
2016-09769 · 0% AI
2016-1023 · 0% AI
2016-1177 · 0% AI
2016-122,639 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 312
effective_loc: 57,969
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok

excluded_import_loc: 13,950
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 4,085.50
measured_loc: 44,019
median_loc_per_hour: 54.47
pr_timed_units: 0
pre_ai_era_burst_loc: 29,600
pre_ai_era_bursts: 4
pre_ai_era_measured_loc: 44,019
work_units: 130

Release velocityskipped

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 6,178
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

47 poor

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 15% duplicated lines. Weakest area: type safety.

How the score is built

Complexity100
Duplication41
Lint and smells42
Tests and CI15
Documentation85
Type safety0
Review process20

Evidence by analyzer

Complexity (lizard)ok

complex_functions: 0
function_nloc: 1,502
functions: 343
long_functions: 0
many_param_functions: 0
mean_ccn: 2.21
p90_ccn: 3
risky_nloc_share: 0.0%

Duplication (jscpd)ok10 items

compared_lines: 4,901
duplicated_lines: 720
duplicated_share: 14.7%
files: 125

Lintok

category:correctness: 86
findings: 86
scanned_lines: 6,178
weighted_findings: 21.50

Tests and CIok1 item

CI config: .travis.yml .travis.yml

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: no
check:test_ratio: no
check:tests_cochange: no
ci_files: 1
cochange_commits: 171
cochange_share: 0.0%
source_lines: 6,178
test_lines: 0
test_ratio: 0

Documentationok3 items

README.md README.md
LICENCE LICENCE
CHANGELOG.md CHANGELOG.md

check:changelog: yes
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 119

Type safetyok

check:low_escape_density: no
check:strict_config: no
escapes: 42
escapes_per_kloc: 9.42

Security

69 weak

Security posture is weak: 2 high-severity SAST findings. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)88
Vulnerable dependenciesnot measured
CI workflowsnot measured
Security posture0
OpenSSF Scorecard25

Evidence by analyzer

OpenSSF Scorecardok9 items

aggregate: 2.60
check:Binary-Artifacts: yes
check:Branch-Protection: no
check:CII-Best-Practices: no
check:Code-Review: yes
check:Fuzzing: no
check:License: yes
check:Maintained: no
check:SAST: no
check:Security-Policy: no

Package registriesok

checked: 24
declared: 24
lookup_errors: 0
missing: 0
recent: 0

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 5
findings_high: 2
findings_low: 0
findings_medium: 3
parse_errors: 0
scanned_lines: 6,178
weighted_findings: 2.25

Dependencies (osv-scanner)skipped

CI workflows (zizmor)skipped

Security postureok1 item

package.json has no lockfile alongside it (unpinned dependencies) package.json

check:dependency_updates: no
check:lockfiles: no
check:security_policy: no
check:signed_commits: no
signed_commit_share: 0.0%
unpinned_manifests: 1

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

2 high3 medium86 low

Severity	Rule	Location	Message	Tool
high	`opengrep/javascript.browser.security.insecure-document-method`	demo/app/prismjs/prismjs.directive.ts:15	User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
high	`opengrep/javascript.browser.security.insecure-innerhtml`	demo/app/prismjs/prismjs.directive.ts:15	User controlled data in a `this.viewContainer.element.nativeElement.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`	demo/app/pipes/array.ts:38	RegExp() called with a `search` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use...	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.html-in-template-string`	demo/app/prismjs/prismjs.directive.ts:15	This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS)....	Static analysis (opengrep)
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`	tools/server.js:8	Detected that function argument `req` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled...	Static analysis (opengrep)
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/accordion.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/accordion.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/checkbox.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/checkbox.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/contextmenu.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/contextmenu.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/devicevisibility.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/devicevisibility.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/dimmer.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/dimmer.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/form.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/form.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/input.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/input.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/list.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/list.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/menu.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/menu.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/message.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/message.ts:8	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/modal.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/modal.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/select.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/select.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/sidebar.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/sidebar.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/tab.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	demo/app/components/elements/tab.ts:5	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/accordion/accordion.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/accordion/accordion.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/accordion/accordion.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/accordion/accordion.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/accordion/accordion.ts:52	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/accordion/accordion.ts:52	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/button/button.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/button/button.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/card/card.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/card/card.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/card/card.ts:43	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/card/card.ts:43	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/contextmenu/contextmenu.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/contextmenu/contextmenu.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/contextmenu/contextmenu.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/contextmenu/contextmenu.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/dropdown/dropdown.ts:10	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/dropdown/dropdown.ts:10	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/flag/flag.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/flag/flag.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/input/input.ts:107	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/input/input.ts:107	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/input/input.ts:17	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/input/input.ts:17	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/input/input.ts:69	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/input/input.ts:69	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/item/item.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/item/item.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/list/list.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/list/list.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/loader/loader.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/loader/loader.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/menu/menu.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/menu/menu.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/message/message.ts:15	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/message/message.ts:15	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/message/message.ts:16	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/message/message.ts:16	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/modal/modal.ts:16	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/modal/modal.ts:16	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/popup/popup.ts:13	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/popup/popup.ts:13	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/progress/progress.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/progress/progress.ts:6	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/rating/rating.ts:17	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/rating/rating.ts:17	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/search/search.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/search/search.ts:12	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/segment/segment.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/segment/segment.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/select/select.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/select/select.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/shape/shape.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/shape/shape.ts:11	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/sidebar/sidebar.ts:35	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/sidebar/sidebar.ts:35	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/tab/tab.ts:32	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint
low	`opengrep/javascript.lang.correctness.missing-template-string-indicator`	src/tab/tab.ts:32	This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?	Lint

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	skipped	`—`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	86
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	skipped	`—`	0
Dependencies (osv-scanner)	Security	skipped	`—`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	ok	`—`	0
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	5
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`0a5da26346ff`	`prov-5+qual-2+sec-2`	0%	47	69
2026-11-14	`0a5da26346ff`	`prov-4+qual-2+sec-2`	0%	47	69

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/vladotesanovic/ngSemantic/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/vladotesanovic/ngSemantic/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/vladotesanovic/ngSemantic/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/vladotesanovic/ngSemantic/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/vladotesanovic/ngSemantic/security.svg)](https://repotrust.synapticcyber.com/r/github.com/vladotesanovic/ngSemantic/)

Full text report

Repository: https://github.com/vladotesanovic/ngSemantic
Commit: 0a5da26346ff7964ec181632d0e34ee2f12385e9
Generated: 2026-11-14T14:52:08+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	65%	100%
Code quality	47	poor	90%	100%
Security	69	weak	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%

Month	Lines added	Attributed to AI
2015-11	135	0%
2016-01	6,592	0%
2016-02	2,266	0%
2016-03	344	0%
2016-04	1,680	0%
2016-06	1,297	0%
2016-07	2,105	0%
2016-08	690	0%
2016-09	769	0%
2016-10	23	0%
2016-11	77	0%
2016-12	2,639	0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 15% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	100
Duplication	41
Code smells (Opengrep)	42
Tests and CI	15
Documentation	85
Type safety	0
Process (Scorecard review/maintenance)	20

Functions: 343; mean complexity 2.2, 90th percentile 3; 0 complex and 0 long functions
Duplicated lines: 14.7% of 4,901 compared
Tests: 0 test lines for 6,178 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: contributing

Security

Security posture is weak: 2 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	88
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	25

Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
OpenSSF Scorecard aggregate: 2.6/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	demo/app/prismjs/prismjs.directive.ts:15
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `this.viewContainer.element.nativeElement.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	demo/app/prismjs/prismjs.directive.ts:15
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-regexp`: RegExp() called with a `search` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]	demo/app/pipes/array.ts:38
medium	`opengrep/javascript.lang.security.html-in-template-string`: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]	demo/app/prismjs/prismjs.directive.ts:15
medium	`opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename`: Detected that function argument `req` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]	tools/server.js:8

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 6,178; test lines: 0

Language	Lines
TypeScript	4,457
JavaScript	1,721