Leaderboard github.com
Netflix-Skunkworks/Scumblr
Web framework that allows performing periodic syncs of data sources and performing analysis on the identified results
AI provenance
0%
none-detected
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
60/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
28/100
poor
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/Netflix-Skunkworks/Scumblr
- Commit:
66ed69a91c65527010f970a746a87557bf9b0856 - Generated: 2026-11-13T23:29:46+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 60 | weak | 90% | 100% |
| Security | 28 | poor | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2017-08 | 1,861 | 0% |
| 2017-09 | 91 | 0% |
| 2017-10 | 105 | 0% |
| 2017-11 | 116 | 0% |
| 2017-12 | 347 | 0% |
| 2018-01 | 61 | 0% |
| 2018-02 | 3 | 0% |
| 2018-03 | 69 | 0% |
| 2018-04 | 2 | 0% |
| 2018-05 | 70 | 0% |
| 2018-07 | 3 | 0% |
| 2019-02 | 11 | 0% |
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.06, CI runs tests; 31% of function code in complex or long functions; 13% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 39 |
| Duplication | 46 |
| Code smells (Opengrep) | 86 |
| Tests and CI | 63 |
| Documentation | 80 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 921; mean complexity 3.7, 90th percentile 9; 39 complex and 19 long functions
- Duplicated lines: 13.1% of 14,774 compared
- Tests: 1,366 test lines for 22,574 source lines (ratio 0.06); CI test commands: rake test; 12% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- render in app/assets/javascripts/jquery_sparklines.js: complexity 62, 161 lines
- (anonymous) in app/assets/javascripts/jquery.datetimepicker.js: complexity 51, 139 lines
- init in app/assets/javascripts/jquery_sparklines.js: complexity 47, 124 lines
- Datepicker in app/assets/javascripts/foundation_datepicker.js: complexity 43, 93 lines
- datetimepicker.setOptions in app/assets/javascripts/jquery.datetimepicker.js: complexity 41, 105 lines
Security
Security posture is poor: 0 possible secret(s) in the tree, 1 only in history; 208 known vulnerabilities in 45 dependencies; 23 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 74 |
| Static analysis (Opengrep) | 12 |
| Vulnerable dependencies (OSV) | 0 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 208 in 45 packages (critical 8, high 73, medium 94, low 16)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-3hhc-qp5v-9p2j: activerecord@4.2.10 (RubyGems) is affected by GHSA-3hhc-qp5v-9p2j |
Gemfile.lock |
| critical | osv/GHSA-69p6-wvmq-27gg: git@1.3.0 (RubyGems) is affected by GHSA-69p6-wvmq-27gg |
Gemfile.lock |
| critical | osv/GHSA-5c5f-7vfq-3732: jmespath@1.3.1 (RubyGems) is affected by GHSA-5c5f-7vfq-3732 |
Gemfile.lock |
| critical | osv/GHSA-cr5j-953j-xw5p: nokogiri@1.8.4 (RubyGems) is affected by GHSA-cr5j-953j-xw5p |
Gemfile.lock |
| critical | osv/GHSA-qxcg-xjjg-66mj: nokogiri@1.8.4 (RubyGems) is affected by GHSA-qxcg-xjjg-66mj |
Gemfile.lock |
| critical | osv/GHSA-wq4h-7r42-5hrr: rack@1.6.10 (RubyGems) is affected by GHSA-wq4h-7r42-5hrr |
Gemfile.lock |
| critical | osv/GHSA-r74q-gxcg-73hx: simple_form@3.2.1 (RubyGems) is affected by GHSA-r74q-gxcg-73hx |
Gemfile.lock |
| critical | osv/GHSA-34r7-q49f-h37c: uglifier@2.5.3 (RubyGems) is affected by GHSA-34r7-q49f-h37c |
Gemfile.lock |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/assets/javascripts/jquery_sparklines.js:3011 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/assets/javascripts/jquery_sparklines.js:3023 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/assets/javascripts/jquery_sparklines.js:3048 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a this.group.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/assets/javascripts/jquery_sparklines.js:3048 |
| high | opengrep/ruby.lang.security.missing-csrf-protection: Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class. [confidence low] |
app/controllers/application_controller.rb:16 |
| high | opengrep/ruby.rails.security.injection.tainted-sql-string: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium] |
app/controllers/results_controller.rb:607 |
| high | opengrep/ruby.rails.security.brakeman.check-regex-dos: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium] |
app/controllers/system_metadata_controller.rb:42 |
| high | opengrep/ruby.rails.security.brakeman.check-regex-dos: Found a potentially user-controllable argument in the construction of a regular expressions. This may result in excessive resource consumption when applied to certain inputs, or when the user is allowed to control the match target. Avoid allowing users to specify regular expressions processed by the [confidence medium] |
app/controllers/system_metadata_controller.rb:44 |
| high | opengrep/ruby.rails.security.brakeman.check-unsafe-reflection: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium] |
app/controllers/task_types_controller.rb:27 |
| high | opengrep/ruby.rails.security.brakeman.check-unsafe-reflection: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium] |
app/controllers/task_types_controller.rb:27 |
| high | opengrep/ruby.rails.security.brakeman.check-unsafe-reflection: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium] |
app/controllers/task_types_controller.rb:28 |
| high | opengrep/ruby.rails.security.brakeman.check-unsafe-reflection: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium] |
app/controllers/task_types_controller.rb:28 |
| high | opengrep/ruby.rails.security.brakeman.check-unsafe-reflection: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium] |
app/controllers/task_types_controller.rb:29 |
| high | opengrep/ruby.rails.security.brakeman.check-unsafe-reflection: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium] |
app/controllers/task_types_controller.rb:29 |
| high | opengrep/ruby.rails.security.brakeman.check-unsafe-reflection: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium] |
app/controllers/task_types_controller.rb:30 |
| high | opengrep/ruby.rails.security.brakeman.check-unsafe-reflection: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium] |
app/controllers/task_types_controller.rb:30 |
| high | opengrep/ruby.rails.security.brakeman.check-unsafe-reflection: Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-controllable input. [confidence medium] |
app/controllers/task_types_controller.rb:44 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 22,574; test lines: 1,366
| Language | Lines |
|---|---|
| Ruby | 15,004 |
| JavaScript | 7,311 |
| SQL | 1,625 |