edandersen/mvplove
A directory of Microsoft MVPs
- Repository: https://github.com/edandersen/mvplove
- Commit:
986cb7a30605d0e0b8e1738f0cd0649b8af776c5 - Generated: 2026-11-13T23:56:37+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 4 | explicit | 81% | 100% |
| Code quality | 49 | poor | 90% | 100% |
| Security | 71 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 4% of first-party code added; an estimated 4% including velocity signals.
- Explicitly attributed share (lower bound): 4.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 4.0%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| GitHub Copilot coding agent | 2 | 1,274 |
- AI tooling configured in repo: github-copilot
Current source lines last changed by AI-attributed commits: 989 of 29,875.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 2.022 | 0.0 | n/a |
| Security | 0.0 | 0.381 | 0.0x |
- Stylometry index: 0.50 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 0, emoji 24). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-03 | 28,317 | 0% |
| 2026-04 | 1,675 | 76% |
| 2026-06 | 1,288 | 0% |
| 2026-08 | 164 | 0% |
| 2026-11 | 72 | 0% |
Evidence
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (43c6c5fa68aa)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (c33fc177ab4f)
- .github/copilot-instructions.md (github-copilot configuration) (.github/copi)
- step-by-step narration comment: // Step 1 - using first Check Number: (src/wwwroot/)
- step-by-step narration comment: // Step 1 - using first Check Number: (src/wwwroot/)
- step-by-step narration comment: // First, handle focusin/focusout (src/wwwroot/)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is poor: test-to-source ratio 0.05, no CI test run detected; 20% of function code in complex or long functions; 48% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 55 |
| Duplication | 6 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 44 |
| Documentation | 40 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,330; mean complexity 2.9, 90th percentile 6; 34 complex and 6 long functions
- Duplicated lines: 47.9% of 20,443 compared
- Tests: 1,573 test lines for 29,875 source lines (ratio 0.05); CI test commands: none detected; 16% of recent source commits also change tests
- Docs missing or thin: license, contributing, changelog
Most complex functions:
- trigger in src/wwwroot/lib/jquery/dist/jquery.slim.js: complexity 54, 96 lines
- (anonymous) in src/wwwroot/lib/jquery/dist/jquery.slim.js: complexity 46, 66 lines
- preventOverflow in src/wwwroot/lib/bootstrap/dist/js/bootstrap.bundle.js: complexity 42, 97 lines
- find in src/wwwroot/lib/jquery/dist/jquery.slim.js: complexity 40, 80 lines
- superMatcher in src/wwwroot/lib/jquery/dist/jquery.slim.js: complexity 36, 67 lines
Security
Security posture is adequate: 6 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 94 |
| Static analysis (Opengrep) | 93 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 52 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/wwwroot/js/agui-client.js:49 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a bubble.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/wwwroot/js/agui-client.js:49 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/wwwroot/js/agui-client.js:115 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a bubble.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/wwwroot/js/agui-client.js:115 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/wwwroot/js/agui-client.js:123 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a bubble.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/wwwroot/js/agui-client.js:123 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/deploy.yml:15 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/deploy.yml:18 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/deploy.yml:37 |
| medium | opengrep/csharp.dotnet.security.audit.mass-assignment: Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application. [confidence medium] |
src/Controllers/MvpController.cs:45 |
| medium | opengrep/csharp.dotnet.security.audit.mass-assignment: Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application. [confidence medium] |
src/Controllers/MvpController.cs:85 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/deploy.yml:14 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/deploy.yml:9 |
| low | gitleaks/private-key: Possible private-key secret in the current tree (test/docs/example file) |
.copilot/skills/secret-handling/SKILL.md:48 |
| low | gitleaks/private-key: Possible private-key secret in the current tree (test/docs/example file) |
.squad/templates/skills/secret-handling/SKILL.md:48 |
| low | opengrep/csharp.dotnet.security.audit.missing-or-broken-authorization: Anonymous access shouldn't be allowed unless explicit by design. Access control checks are missing and potentially can be bypassed. This finding violates the principle of least privilege or deny by default, where access should only be permitted for a specific set of roles or conforms to a custom pol [confidence medium] |
src/Controllers/CopilotController.cs:5 |
| low | opengrep/csharp.dotnet.security.audit.missing-or-broken-authorization: Anonymous access shouldn't be allowed unless explicit by design. Access control checks are missing and potentially can be bypassed. This finding violates the principle of least privilege or deny by default, where access should only be permitted for a specific set of roles or conforms to a custom pol [confidence medium] |
src/Controllers/HomeController.cs:8 |
| low | opengrep/csharp.dotnet.security.audit.missing-or-broken-authorization: Anonymous access shouldn't be allowed unless explicit by design. Access control checks are missing and potentially can be bypassed. This finding violates the principle of least privilege or deny by default, where access should only be permitted for a specific set of roles or conforms to a custom pol [confidence medium] |
src/Controllers/MvpController.cs:7 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 29,875; test lines: 1,573
| Language | Lines |
|---|---|
| JavaScript | 28,322 |
| C# | 2,696 |
| PowerShell | 222 |
| Shell | 208 |