bugsee/bugsee-javascript

Bugsee SDK for JavaScript

https://github.com/bugsee/bugsee-javascript · commit c7f7f128f7a7 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/bugsee/bugsee-javascript
Commit: c7f7f128f7a7fb78f39e3104302487ef3273b228
Generated: 2026-11-13T23:20:48+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	95	explicit	95%	100%
Code quality	79	adequate	90%	100%
Security	46	poor	85%	100%

AI provenance

Explicit AI attribution on 95% of first-party code added; an estimated 95% including velocity signals.

Explicitly attributed share (lower bound): 95.1%
Unattributed share in AI-consistent velocity bursts: 3.5%
Estimated AI-generated share: 95.1%

AI tool	Attributed commits	Lines added
Claude Code	1,022	338,614
Cursor agent	3	2,156

AI tooling configured in repo: claude-code, generic-agent

Current source lines last changed by AI-attributed commits: 115,368 of 117,218.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	1.17	2.703	0.43x
Security	0.745	0.0	n/a

Stylometry index: 0.08 per 1,000 lines (narrated steps 0, placeholders 1, assistant phrasing 0, emoji 15). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2026-05	25,908	100%
2026-06	59,375	100%
2026-07	19,553	100%
2026-08	76,045	80%
2026-09	25,754	92%
2026-10	129,451	100%
2026-11	22,163	100%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (c7f7f128f7a7)
Claude Code: trailer 'Co-Authored-By: Claude' (bf166695d347)
Claude Code: trailer 'Co-Authored-By: Claude' (ae67a28de27b)
Claude Code: trailer 'Co-Authored-By: Claude' (dadf19724bdd)
Claude Code: trailer 'Co-Authored-By: Claude' (34f421ef122e)
Claude Code: trailer 'Co-authored-by: Claude' (554797d8b833)
Claude Code: trailer 'Co-Authored-By: Claude' (f5a52358663c)
Claude Code: trailer 'Co-Authored-By: Claude' (a7b95027f969)
Claude Code: trailer 'Co-Authored-By: Claude' (c5ed64aa49b1)
Claude Code: message 'Generated with [Claude Code' (5037d0f8b743)
Claude Code: message 'Generated with [Claude Code' (2ad7e1756f82)
Claude Code: message 'Generated with [Claude Code' (2594efc949bc)
Claude Code: message 'Generated with [Claude Code' (f2d3351645ed)
Claude Code: message 'Generated with [Claude Code' (894915f01833)
Claude Code: message 'Generated with [Claude Code' (bf620ab3b5af)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 1.74, CI runs tests; 18% of function code in complex or long functions; 7% duplicated lines. Weakest area: complexity.

Area	Score
Complexity (lizard)	58
Duplication	64
Code smells (Opengrep)	91
Tests and CI	100
Documentation	65
Type safety	100
Process (Scorecard review/maintenance)	n/a

Functions: 7,495; mean complexity 2.5, 90th percentile 5; 68 complex and 28 long functions
Duplicated lines: 7.4% of 89,812 compared
Tests: 203,988 test lines for 117,218 source lines (ratio 1.74); CI test commands: npm test, pnpm test, vitest; 86% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is poor: 0 possible secret(s) in the tree, 1 only in history; 182 known vulnerabilities in 57 dependencies; 39 high-severity SAST findings; 14 high-severity workflow issues. Weakest area: dependencies.

Area	Score
Secrets (gitleaks, tree + history)	53
Static analysis (Opengrep)	86
Vulnerable dependencies (OSV)	0
CI workflows (zizmor)	5
Posture (policy, updates, signing, lockfiles)	100
OpenSSF Scorecard	n/a

Known vulnerabilities: 182 in 57 packages (critical 5, high 66, medium 88, low 22)
Posture checks passed: security policy, dependency updates, signed commits; missing: lockfiles

Top findings

Severity	Finding	Location
critical	`osv/GHSA-279x-mwfv-vcqv`: @nuxt/devtools@3.2.4 (npm) is affected by GHSA-279x-mwfv-vcqv	pnpm-lock.yaml
critical	`osv/GHSA-v5rq-49vh-5v5c`: @simple-git/argv-parser@1.1.1 (npm) is affected by GHSA-v5rq-49vh-5v5c	pnpm-lock.yaml
critical	`osv/GHSA-p6vx-979v-rg4c`: seroval@1.5.4 (npm) is affected by GHSA-p6vx-979v-rg4c	pnpm-lock.yaml
critical	`osv/GHSA-pqg4-j6r4-53mv`: shell-quote@1.9.0 (npm) is affected by GHSA-pqg4-j6r4-53mv	pnpm-lock.yaml
critical	`osv/GHSA-x6jw-m9v5-85vh`: simple-git@3.36.0 (npm) is affected by GHSA-x6jw-m9v5-85vh	pnpm-lock.yaml
high	`opengrep/typescript.react.security.react-insecure-request`: Unencrypted request over HTTP detected. [confidence medium]	docs/design/async-origin-capture/probe.mjs:33
high	`opengrep/typescript.react.security.react-insecure-request`: Unencrypted request over HTTP detected. [confidence medium]	docs/design/async-origin-capture/probe.mjs:34
high	`opengrep/typescript.react.security.react-insecure-request`: Unencrypted request over HTTP detected. [confidence medium]	docs/design/async-origin-capture/probe.mjs:35
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/cart.ts:29
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/cart.ts:29
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/home.ts:22
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `grid.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/home.ts:22
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/home.ts:45
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `grid.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/home.ts:45
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/orders.ts:8
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/orders.ts:8
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/product.ts:13
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/product.ts:13
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/product.ts:26
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/product.ts:26
high	`opengrep/typescript.react.security.react-insecure-request`: Unencrypted request over HTTP detected. [confidence medium]	samples/browser-vanilla/src/pages/scenarios.ts:297
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/scenarios.ts:519
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `rows.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/scenarios.ts:519
high	`opengrep/javascript.browser.security.insecure-document-method`: User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/settings.ts:79
high	`opengrep/javascript.browser.security.insecure-innerhtml`: User controlled data in a `container.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]	samples/browser-vanilla/src/pages/settings.ts:79

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 117,218; test lines: 203,988

Language	Lines
TypeScript	308,821
JavaScript	9,176
Svelte	1,428
Vue	1,241
Shell	540

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/bugsee/bugsee-javascript/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/bugsee/bugsee-javascript/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/bugsee/bugsee-javascript/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/bugsee/bugsee-javascript/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/bugsee/bugsee-javascript/security.svg)](https://repotrust.synapticcyber.com/r/github.com/bugsee/bugsee-javascript/)