Vuedo/vuedo
Vuedo is a blog platform, built with Laravel and Vue.js.
- Repository: https://github.com/Vuedo/vuedo
- Commit:
0ef7e6c2e6e482e73e1f11f0e7e5530b6e433c7a - Generated: 2026-11-13T23:33:11+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 49% | 100% |
| Code quality | 77 | adequate | 90% | 100% |
| Security | 59 | weak | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2016-07 | 20,134 | 0% |
| 2016-08 | 2,167 | 0% |
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.04, CI runs tests; 6% of function code in complex or long functions; 7% duplicated lines. Weakest area: docs.
| Area | Score |
|---|---|
| Complexity (lizard) | 84 |
| Duplication | 67 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 67 |
| Documentation | 65 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 1,432; mean complexity 1.4, 90th percentile 2; 5 complex and 1 long functions
- Duplicated lines: 6.7% of 12,574 compared
- Tests: 906 test lines for 21,230 source lines (ratio 0.04); CI test commands: phpunit; 25% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- FastClick.notNeeded in public/lte/js/fastclick.js: complexity 24, 53 lines
- Dropzone.prototype.uploadFiles in public/js/dropzone.js: complexity 23, 71 lines
- FastClick.prototype.onTouchEnd in public/lte/js/fastclick.js: complexity 21, 57 lines
- Dropzone in public/js/dropzone.js: complexity 20, 57 lines
- update in public/js/pnotify.buttons.js: complexity 20, 24 lines
Security
Security posture is weak: 69 known vulnerabilities in 19 dependencies; 6 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 90 |
| Vulnerable dependencies (OSV) | 7 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 69 in 19 packages (critical 7, high 22, medium 28, low 8)
-
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-f9x3-7vq9-cph6: laravel/framework@v5.2.37 (Packagist) is affected by GHSA-f9x3-7vq9-cph6 |
composer.lock |
| critical | osv/GHSA-qm5c-m76r-2hfr: laravel/framework@v5.2.37 (Packagist) is affected by GHSA-qm5c-m76r-2hfr |
composer.lock |
| critical | osv/GHSA-9f46-5r25-5wfm: league/flysystem@1.0.24 (Packagist) is affected by GHSA-9f46-5r25-5wfm |
composer.lock |
| critical | osv/GHSA-pcw8-m77r-2528: mtdowling/jmespath.php@2.3.0 (Packagist) is affected by GHSA-pcw8-m77r-2528 |
composer.lock |
| critical | osv/GHSA-r7c9-c69m-rph8: phpunit/phpunit@4.8.26 (Packagist) is affected by GHSA-r7c9-c69m-rph8 |
composer.lock |
| critical | osv/GHSA-pr44-4jfr-286m: swiftmailer/swiftmailer@v5.4.2 (Packagist) is affected by GHSA-pr44-4jfr-286m |
composer.lock |
| critical | osv/GHSA-x92h-wmg2-6hp7: symfony/http-foundation@v3.0.7 (Packagist) is affected by GHSA-x92h-wmg2-6hp7 |
composer.lock |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
app/User.php:83 |
| high | opengrep/php.laravel.security.laravel-cookie-long-timeout: Found a configuration file where the lifetime attribute is over 30 minutes. [confidence low] |
config/session.php:32 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/js/dropzone.js:268 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a node.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/js/dropzone.js:268 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/js/dropzone.js:1532 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a div.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/js/dropzone.js:1532 |
| high | osv/GHSA-27qh-8cxx-2cr5: aws/aws-sdk-php@3.18.18 (Packagist) is affected by GHSA-27qh-8cxx-2cr5 |
composer.lock |
| high | osv/GHSA-62m3-fc7f-jpp8: erusev/parsedown@1.6.0 (Packagist) is affected by GHSA-62m3-fc7f-jpp8 |
composer.lock |
| high | osv/GHSA-25mq-v84q-4j7r: guzzlehttp/guzzle@6.2.0 (Packagist) is affected by GHSA-25mq-v84q-4j7r |
composer.lock |
| high | osv/GHSA-cwmx-hcrq-mhc3: guzzlehttp/guzzle@6.2.0 (Packagist) is affected by GHSA-cwmx-hcrq-mhc3 |
composer.lock |
| high | osv/GHSA-f2wf-25xc-69c9: guzzlehttp/guzzle@6.2.0 (Packagist) is affected by GHSA-f2wf-25xc-69c9, GHSA-w248-ffj2-4v5q |
composer.lock |
| high | osv/GHSA-m6ch-gg5f-wxx3: guzzlehttp/guzzle@6.2.0 (Packagist) is affected by GHSA-m6ch-gg5f-wxx3 |
composer.lock |
| high | osv/GHSA-q559-8m2m-g699: guzzlehttp/guzzle@6.2.0 (Packagist) is affected by GHSA-q559-8m2m-g699 |
composer.lock |
| high | osv/GHSA-v5mv-p594-2x33: guzzlehttp/guzzle@6.2.0 (Packagist) is affected by GHSA-v5mv-p594-2x33 |
composer.lock |
| high | osv/GHSA-5vg9-5847-vvmq: laravel/framework@v5.2.37 (Packagist) is affected by GHSA-5vg9-5847-vvmq |
composer.lock |
| high | osv/GHSA-gv7v-rgg6-548h: laravel/framework@v5.2.37 (Packagist) is affected by GHSA-gv7v-rgg6-548h |
composer.lock |
| high | osv/GHSA-qvqm-h22r-4cp9: laravel/framework@v5.2.37 (Packagist) is affected by GHSA-qvqm-h22r-4cp9 |
composer.lock |
| high | osv/GHSA-w2pm-r78h-4m7v: laravel/framework@v5.2.37 (Packagist) is affected by GHSA-w2pm-r78h-4m7v |
composer.lock |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 21,230; test lines: 906
| Language | Lines |
|---|---|
| PHP | 17,994 |
| JavaScript | 2,953 |
| Vue | 1,177 |
| Shell | 12 |