Leaderboard github.com
cityssm/sunrise-cms
Sunrise Cemetery Management System - A completely free, open source, web-based application to assist cemetery managers with managing their cemetery records.
AI provenance
11%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
59/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
65/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/cityssm/sunrise-cms
- Commit:
12b2b96297bc7e33b5c1f91da43c55edb5150b69 - Generated: 2026-11-14T00:04:18+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 11 | explicit | 95% | 100% |
| Code quality | 59 | weak | 90% | 100% |
| Security | 65 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 11% of first-party code added; an estimated 11% including velocity signals.
- Explicitly attributed share (lower bound): 10.6%
- Unattributed share in AI-consistent velocity bursts: 26.6%
- Estimated AI-generated share: 10.6%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| GitHub Copilot coding agent | 64 | 37,580 |
- AI tooling configured in repo: github-copilot
Current source lines last changed by AI-attributed commits: 23,894 of 110,191.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.167 | 0.232 | 0.72x |
| Security | 1.674 | 3.013 | 0.56x |
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-07 | 9,116 | 0% |
| 2025-08 | 18,047 | 43% |
| 2025-09 | 9,773 | 0% |
| 2025-10 | 8,239 | 28% |
| 2026-02 | 24,159 | 43% |
| 2026-03 | 20,912 | 49% |
| 2026-04 | 2,520 | 0% |
| 2026-07 | 597 | 0% |
| 2026-08 | 7,898 | 0% |
| 2026-09 | 6,226 | 0% |
| 2026-10 | 6,131 | 13% |
| 2026-11 | 8,874 | 68% |
Evidence
- GitHub Copilot coding agent: author Copilot (0ea5c55872c4)
- GitHub Copilot coding agent: author Copilot (f675bf975705)
- GitHub Copilot coding agent: author Copilot (c7bf176de326)
- GitHub Copilot coding agent: author Copilot (e2a0a08d1b56)
- GitHub Copilot coding agent: author Copilot (099177a4497e)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (1ab384881280)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (ede6b18b6b70)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (4f4a6dcd88f2)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (0e1d9ff36598)
- GitHub Copilot coding agent: author Copilot (cd12f9dff7f2)
- GitHub Copilot coding agent: author Copilot (a64e12c9f259)
- GitHub Copilot coding agent: author Copilot (28531e01c653)
- GitHub Copilot coding agent: author Copilot (1fd18313cfed)
- GitHub Copilot coding agent: author Copilot (b2b63ba72a76)
- GitHub Copilot coding agent: author Copilot (639921435cce)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.04, CI runs tests; 24% of function code in complex or long functions; 38% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 48 |
| Duplication | 10 |
| Code smells (Opengrep) | 96 |
| Tests and CI | 72 |
| Documentation | 80 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 3,896; mean complexity 3.1, 90th percentile 7; 70 complex and 109 long functions
- Duplicated lines: 38.4% of 75,326 compared
- Tests: 4,425 test lines for 110,191 source lines (ratio 0.04); CI test commands: npm run test; 11% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- applySourceOrderFormToContract in handlers/contractsGet/new.js: complexity 105, 216 lines
- applySourceOrderFormToContract in handlers/contractsGet/new.ts: complexity 105, 256 lines
- importFromWorkOrderCSV in temp/legacyImportFromCsv/import.workOrder.js: complexity 77, 344 lines
- importFromWorkOrderCSV in temp/legacyImportFromCsv/import.workOrder.ts: complexity 77, 518 lines
- importFromMasterCSV in temp/legacyImportFromCsv/import.master.js: complexity 66, 298 lines
Security
Security posture is weak: 3 known vulnerabilities in 3 dependencies; 306 high-severity SAST findings; 10 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 29 |
| Vulnerable dependencies (OSV) | 89 |
| CI workflows (zizmor) | 11 |
| Posture (policy, updates, signing, lockfiles) | 80 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 3 in 3 packages (critical 0, high 0, medium 2, low 1)
-
Posture checks passed: security policy, dependency updates, lockfiles; missing: signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/auditLog.admin.js:66 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a auditLogContainerElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/auditLog.admin.js:66 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/auditLog.admin.js:122 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a auditLogContainerElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/auditLog.admin.js:122 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/auditLog.admin.ts:105 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a auditLogContainerElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/auditLog.admin.ts:105 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/auditLog.admin.ts:170 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a auditLogContainerElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/auditLog.admin.ts:170 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.js:26 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a panelBlockElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.js:26 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.js:129 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a panelBlockElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.js:129 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.js:187 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a cemeteryKeyFromSpanElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.js:187 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.js:188 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a cemeteryKeyToSpanElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.js:188 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.ts:66 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a panelBlockElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.ts:66 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.ts:219 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a panelBlockElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.ts:219 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.ts:314 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a cemeteryKeyFromSpanElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.ts:314 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.ts:315 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a cemeteryKeyToSpanElement.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.creator.ts:315 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
public/javascripts/burialSite.edit.js:87 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 110,191; test lines: 4,425
| Language | Lines |
|---|---|
| TypeScript | 72,182 |
| JavaScript | 42,434 |