RepoTrust

Leaderboard github.com

SweetJonnySauce/EDMC-Mining-Analytics

EDMC plug in for laser mining tracking analytics. It's all about the Tons per Hour baby!

  • View repository ↗
  • Python
  • ★ 27
  • commit e098bfc00624
  • scored 2026-11-13
  • scoring prov-4+qual-2+sec-2

AI provenance

0%

possible

Confidence
65%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

55/100

weak

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

79/100

adequate

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 possible 65% 100%
Code quality 55 weak 90% 100%
Security 79 adequate 85% 100%

AI provenance

Weak signals consistent with AI-assisted development.

  • Explicitly attributed share (lower bound): 0.0%

  • Unattributed share in AI-consistent velocity bursts: 38.8%

  • Estimated AI-generated share: 0.0%

  • AI tooling configured in repo: generic-agent

  • Stylometry index: 0.08 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 5). Reported as a signal, not scored.

Month Lines added Attributed to AI
2025-09 2,517 0%
2025-10 26,067 0%
2025-11 166 0%
2025-12 271 0%
2026-01 2,370 0%
2026-03 13,598 0%
2026-04 18,552 0%
2026-05 605 0%
2026-06 1,465 0%

Evidence

  • 9,074 lines of first-party code in ~0.9h (10,437 lines/hour, 1 commit session) (ab7ff50cf526)
  • 8,509 lines of first-party code in ~4.0h (2,127 lines/hour, 1 commit session) (9b0817f11f45)
  • AGENTS.md (generic-agent configuration) (AGENTS.md)
  • 1.1.0-alpha-2 → 1.1.0-alpha-3: 8,509 lines in 0.96 days (8,858.6 lines/day) (1.1.0-alpha-)
  • 1,795 lines of first-party code in ~1.6h (1,155 lines/hour, 2 commit session) (387d1b9aa505)
  • 1,982 lines of first-party code in ~2.0h (969 lines/hour, 1 commit session) (f945cd664bd3)
  • 4,075 lines of first-party code in ~5.1h (794 lines/hour, 4 commit session) (62a0ce712029)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.56, no CI test run detected; 29% of function code in complex or long functions; 7% duplicated lines. Weakest area: type safety.

Area Score
Complexity (lizard) 42
Duplication 65
Code smells (Opengrep) 52
Tests and CI 67
Documentation 65
Type safety 0
Process (Scorecard review/maintenance) n/a
  • Functions: 1,750; mean complexity 4.4, 90th percentile 9; 71 complex and 29 long functions
  • Duplicated lines: 7.2% of 24,013 compared
  • Tests: 16,997 test lines for 30,205 source lines (ratio 0.56); CI test commands: none detected; 18% of recent source commits also change tests
  • Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is adequate: 4 high-severity SAST findings; 4 high-severity workflow issues. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 96
Vulnerable dependencies (OSV) 100
CI workflows (zizmor) 44
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a
  • Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity Finding Location
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] web/js/index/charts/cumulative_commodities.js:504
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a axis.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] web/js/index/charts/cumulative_commodities.js:504
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] web/js/index/charts/timeline.js:180
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a axis.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] web/js/index/charts/timeline.js:180
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:17
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:20
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:46
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:54
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] web/js/index/charts/cumulative_commodities.js:504
medium opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] web/js/index/charts/timeline.js:180
medium zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] .github/workflows/release.yml:16
info zizmor/template-injection: code injection via template expansion [confidence low] .github/workflows/release.yml:41
info zizmor/superfluous-actions: action functionality is already included by the runner [confidence high] .github/workflows/release.yml:46

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

  • Source lines: 30,205; test lines: 16,997
Language Lines
Python 34,059
JavaScript 12,853
Shell 290

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/SweetJonnySauce/EDMC-Mining-Analytics/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/SweetJonnySauce/EDMC-Mining-Analytics/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/SweetJonnySauce/EDMC-Mining-Analytics/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/SweetJonnySauce/EDMC-Mining-Analytics/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/SweetJonnySauce/EDMC-Mining-Analytics/security.svg)](https://repotrust.synapticcyber.com/r/github.com/SweetJonnySauce/EDMC-Mining-Analytics/)