youzan/zan-proxy

An extensible proxy for PC/Mobile/APP developer

https://github.com/youzan/zan-proxy · commit d35dda17de5f · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/youzan/zan-proxy
Commit: d35dda17de5f04a0309c7bd17eb62cecc5b6b5d2
Generated: 2026-11-13T23:40:07+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	61%	100%
Code quality	71	adequate	90%	100%
Security	18	poor	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%

Month	Lines added	Attributed to AI
2018-08	199	0%
2018-09	415	0%
2018-10	38	0%
2018-11	27	0%
2019-01	2	0%
2019-03	8,607	0%
2019-04	4	0%
2019-05	35	0%
2019-07	10	0%
2019-11	7,501	0%
2019-12	76	0%
2020-01	2	0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.00, CI runs tests; 1% of function code in complex or long functions; 2% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	96
Duplication	89
Code smells (Opengrep)	68
Tests and CI	38
Documentation	85
Type safety	60
Process (Scorecard review/maintenance)	n/a

Functions: 2,271; mean complexity 3.3, 90th percentile 6; 68 complex and 0 long functions
Duplicated lines: 2.0% of 7,305 compared
Tests: 0 test lines for 11,738 source lines (ratio 0.00); CI test commands: npm run test; 8% of recent source commits also change tests
Docs missing or thin: contributing

Most complex functions:

Security

Security posture is poor: 1 possible secret(s) in the tree, 6 only in history; 738 known vulnerabilities in 276 dependencies; 12 high-severity SAST findings. Weakest area: dependencies.

Area	Score
Secrets (gitleaks, tree + history)	22
Static analysis (Opengrep)	42
Vulnerable dependencies (OSV)	0
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 738 in 276 packages (critical 61, high 331, medium 273, low 45)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-rq8g-5pc5-wrhr`: [email protected] (npm) is affected by GHSA-rq8g-5pc5-wrhr; also in docs/yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-hr2v-3952-633q`: [email protected] (npm) is affected by GHSA-hr2v-3952-633q; also in docs/yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-fjxv-7rqg-78g4`: [email protected] (npm) is affected by GHSA-fjxv-7rqg-78g4; also in docs/yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-fjxv-7rqg-78g4`: [email protected] (npm) is affected by GHSA-fjxv-7rqg-78g4; also in docs/yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-fjxv-7rqg-78g4`: [email protected] (npm) is affected by GHSA-fjxv-7rqg-78g4; also in docs/yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-896r-f27r-55mw`: [email protected] (npm) is affected by GHSA-896r-f27r-55mw; also in docs/yarn.lock; also in webui/yarn.lock; also in yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-jf85-cpcp-j695`: [email protected] (npm) is affected by GHSA-jf85-cpcp-j695; also in docs/yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-jf85-cpcp-j695`: [email protected] (npm) is affected by GHSA-jf85-cpcp-j695; also in docs/yarn.lock; also in yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-xvch-5gv4-984h`: [email protected] (npm) is affected by GHSA-xvch-5gv4-984h; also in docs/yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-xvch-5gv4-984h`: [email protected] (npm) is affected by GHSA-xvch-5gv4-984h; also in docs/yarn.lock; also in webui/yarn.lock; also in yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-xvch-5gv4-984h`: [email protected] (npm) is affected by GHSA-xvch-5gv4-984h; also in docs/yarn.lock; also in webui/yarn.lock; also in yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-23hp-3jrh-7fpw`: [email protected] (npm) is affected by GHSA-23hp-3jrh-7fpw; also in docs/yarn.lock; also in webui/yarn.lock	docs/book/yarn.lock
critical	`osv/GHSA-67hx-6x53-jw92`: @babel/[email protected] (npm) is affected by GHSA-67hx-6x53-jw92; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-cpq7-6gpm-g9rc`: [email protected] (npm) is affected by GHSA-cpq7-6gpm-g9rc; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-phwq-j96m-2c2q`: [email protected] (npm) is affected by GHSA-phwq-j96m-2c2q; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-vjh7-7g9h-fjfh`: [email protected] (npm) is affected by GHSA-vjh7-7g9h-fjfh; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-3gx7-xhv7-5mx3`: [email protected] (npm) is affected by GHSA-3gx7-xhv7-5mx3	webui/yarn.lock
critical	`osv/GHSA-6h5x-7c5m-7cr7`: [email protected] (npm) is affected by GHSA-6h5x-7c5m-7cr7; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-fjxv-7rqg-78g4`: [email protected] (npm) is affected by GHSA-fjxv-7rqg-78g4; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-8r6j-v8pm-fqw3`: [email protected] (npm) is affected by GHSA-8r6j-v8pm-fqw3; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-qh2h-chj9-jffq`: [email protected] (npm) is affected by GHSA-qh2h-chj9-jffq	webui/yarn.lock
critical	`osv/GHSA-76p3-8jx3-jpfq`: [email protected] (npm) is affected by GHSA-76p3-8jx3-jpfq; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-76p3-8jx3-jpfq`: [email protected] (npm) is affected by GHSA-76p3-8jx3-jpfq; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-jf85-cpcp-j695`: [email protected] (npm) is affected by GHSA-jf85-cpcp-j695; also in yarn.lock	webui/yarn.lock
critical	`osv/GHSA-jf85-cpcp-j695`: [email protected] (npm) is affected by GHSA-jf85-cpcp-j695	webui/yarn.lock

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v5.1.0 ships Zan.Proxy-5.1.0.dmg (1769 downloads)
binary-release-asset: release v5.0.0 ships Zan.Proxy-5.0.0.dmg (237 downloads)
binary-release-asset: release v4.1.0 ships Zan.Proxy-4.1.0.dmg (559 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 11,738; test lines: 0

Language	Lines
TypeScript	6,795
Vue	3,533
JavaScript	1,410

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/youzan/zan-proxy/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/youzan/zan-proxy/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/youzan/zan-proxy/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/youzan/zan-proxy/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/youzan/zan-proxy/security.svg)](https://repotrust.synapticcyber.com/r/github.com/youzan/zan-proxy/)