cardpay/unlimeety
Privacy-first AI-powered tool to work with your meeting notes. Allows for recording, annotated live transcription and deep googl-meet integration. Creates custom AI summaries and AI search, audio-to-text syncronization, transcript enhancements and more.
- Repository: https://github.com/cardpay/unlimeety
- Commit:
c0e6a5c30fbe2808ee683f629022e9aac122b644 - Generated: 2026-11-13T23:49:15+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 47 | explicit | 95% | 100% |
| Code quality | 64 | weak | 90% | 100% |
| Security | 49 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 47% of first-party code added; an estimated 47% including velocity signals.
- Explicitly attributed share (lower bound): 47.2%
- Unattributed share in AI-consistent velocity bursts: 5.5%
- Estimated AI-generated share: 47.2%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 118 | 20,089 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 9,141 of 25,877.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 6.126 | 3.884 | 1.58x |
| Security | 13.237 | 10.696 | 1.24x |
- Stylometry index: 0.10 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 5). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-08 | 27,636 | 44% |
| 2026-09 | 11,160 | 71% |
| 2026-10 | 3,776 | 1% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (5502da1a2c9b)
- Claude Code: trailer 'Co-Authored-By: Claude' (383ba76d5c4f)
- Claude Code: trailer 'Co-Authored-By: Claude' (40faca3e1fff)
- Claude Code: trailer 'Co-Authored-By: Claude' (db23dc337501)
- Claude Code: trailer 'Co-Authored-By: Claude' (ed0fd9a64d17)
- Claude Code: on merged branch (106ac9be57) (3b90fcda2f10)
- Claude Code: on merged branch (e9abde2620) (8461e210bb0d)
- Claude Code: on merged branch (e9abde2620) (bcdf5ac73b7c)
- Claude Code: on merged branch (e9abde2620) (eaef9ae4ff9b)
- Claude Code: on merged branch (e9abde2620) (a0d0bedbd22c)
- Claude Code: on merged branch (e9abde2620) (75a41d43245a)
- Claude Code: on merged branch (e9abde2620) (3d3b27abe2d4)
- Claude Code: on merged branch (e9abde2620) (ec80eac3c967)
- Claude Code: on merged branch (e9abde2620) (c4a46f5b9265)
- Claude Code: on merged branch (e9abde2620) (09f24906e460)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.47, no CI test run detected; 17% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 60 |
| Duplication | 82 |
| Code smells (Opengrep) | 65 |
| Tests and CI | 53 |
| Documentation | 65 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,046; mean complexity 3.4, 90th percentile 7; 44 complex and 7 long functions
- Duplicated lines: 3.2% of 20,465 compared
- Tests: 12,110 test lines for 25,877 source lines (ratio 0.47); CI test commands: none detected; 54% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- extractSubtitleFromNode in extenstion/content.js: complexity 74, 142 lines
- runRecordTranscribeJob in desktop/main.js: complexity 64, 172 lines
- runEnhanceJob in desktop/main.js: complexity 37, 162 lines
- (anonymous) in desktop/renderer/live/live.js: complexity 37, 78 lines
- readWaveform in desktop/audio-waveform.js: complexity 36, 71 lines
Security
Security posture is poor: 57 known vulnerabilities in 9 dependencies; 34 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 28 |
| Vulnerable dependencies (OSV) | 36 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 57 in 9 packages (critical 0, high 29, medium 22, low 6)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: process.platform === 'win32'}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
desktop/main.js:1877 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument claudePath. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
desktop/main.js:1882 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: process.platform === 'win32'}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
desktop/main.js:1982 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument codexPath. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
desktop/main.js:1983 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:1230 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a transcriptView.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:1230 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:1974 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a card.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:1974 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:2073 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a root.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:2073 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:2170 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a root.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:2170 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3291 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a summaryRailBody.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3291 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3313 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a summaryRailBody.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3313 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3331 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a summaryRailBody.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3331 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3340 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a summaryRailBody.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3340 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3401 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a summaryRailBody.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3401 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3598 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a btn.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:3598 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
desktop/renderer/app.js:4225 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v1.8.1 ships Unlimeety-1.8.1-arm64.zip (1 downloads)
- binary-release-asset: release v1.8.1 ships Unlimeety-arm64.dmg (5 downloads)
- binary-release-asset: release v1.8.1-beta.4 ships Unlimeety-1.8.1-beta.4-arm64.zip (2 downloads)
- binary-release-asset: release v1.8.1-beta.4 ships Unlimeety-arm64-beta.dmg (1 downloads)
- binary-release-asset: release v1.8.1-beta.4 ships unlimeety-extension-beta.zip (2 downloads)
- readme-download-lure: links directly to a downloadable archive or installer
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 25,877; test lines: 12,110
| Language | Lines |
|---|---|
| JavaScript | 34,105 |
| Swift | 3,861 |
| Shell | 21 |