github/auto-check-element
An input element that validates its value with a server endpoint.
- Repository: https://github.com/github/auto-check-element
- Commit:
f45736d04f7eedf9f22bc9294f9ebff462e81dbd - Generated: 2026-11-14T00:07:01+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | explicit | 95% | 100% |
| Code quality | 84 | strong | 90% | 100% |
| Security | 80 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| GitHub Copilot coding agent | 7 | 0 |
Current source lines last changed by AI-attributed commits: 0 of 454.
Too few lines in one group to compare finding densities.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2020-05 | 68 | 0% |
| 2020-06 | 3 | 0% |
| 2021-08 | 20 | 0% |
| 2022-01 | 2 | 0% |
| 2023-04 | 222 | 0% |
| 2023-07 | 1 | 0% |
| 2024-05 | 82 | 0% |
| 2024-11 | 145 | 0% |
| 2024-12 | 40 | 0% |
| 2025-01 | 55 | 0% |
| 2025-03 | 26 | 0% |
| 2026-10 | 41 | 0% |
Evidence
- GitHub Copilot coding agent: author copilot-swe-agent[bot] (a435daa57fd5)
- GitHub Copilot coding agent: author copilot-swe-agent[bot] (7395c645c9bc)
- GitHub Copilot coding agent: author copilot-swe-agent[bot] (6a1a8d3f2bd8)
- GitHub Copilot coding agent: author copilot-swe-agent[bot] (9fea93fa4ad5)
- GitHub Copilot coding agent: author copilot-swe-agent[bot] (b9c3a92f6273)
- GitHub Copilot coding agent: author copilot-swe-agent[bot] (3356d05d7933)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (ca09d3a31c10)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 1.12, CI runs tests; 24% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 49 |
| Duplication | 100 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 90 |
| Documentation | 65 |
| Type safety | 100 |
| Process (Scorecard review/maintenance) | 100 |
- Functions: 38; mean complexity 2.6, 90th percentile 5; 1 complex and 0 long functions
- Duplicated lines: 0.0% of 289 compared
- Tests: 507 test lines for 454 source lines (ratio 1.12); CI test commands: npm test; 25% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
Security
Security posture is adequate: 26 known vulnerabilities in 17 dependencies; 1 high-severity workflow issues. Weakest area: dependencies.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 100 |
| Vulnerable dependencies (OSV) | 23 |
| CI workflows (zizmor) | 90 |
| Posture (policy, updates, signing, lockfiles) | 100 |
| OpenSSF Scorecard | 71 |
-
Known vulnerabilities: 26 in 17 packages (critical 0, high 11, medium 13, low 2)
-
Posture checks passed: security policy, dependency updates, signed commits, lockfiles; missing: none
-
OpenSSF Scorecard aggregate: 8.1/10 (published 2026-11-09)
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | osv/GHSA-c475-qrg2-pj4r: basic-ftp@5.2.2 (npm) is affected by GHSA-c475-qrg2-pj4r |
package-lock.json |
| high | osv/GHSA-rp42-5vxx-qpwr: basic-ftp@5.2.2 (npm) is affected by GHSA-rp42-5vxx-qpwr |
package-lock.json |
| high | osv/GHSA-rpmf-866q-6p89: basic-ftp@5.2.2 (npm) is affected by GHSA-rpmf-866q-6p89 |
package-lock.json |
| high | osv/GHSA-3xgq-45jj-v275: cross-spawn@7.0.3 (npm) is affected by GHSA-3xgq-45jj-v275 |
package-lock.json |
| high | osv/GHSA-7pqw-9j4j-h8q3: extract-zip@2.0.1 (npm) is affected by GHSA-7pqw-9j4j-h8q3 |
package-lock.json |
| high | osv/GHSA-jmr9-qjv8-65gv: extract-zip@2.0.1 (npm) is affected by GHSA-jmr9-qjv8-65gv |
package-lock.json |
| high | osv/GHSA-7gcc-r8m5-44qm: koa@2.16.1 (npm) is affected by GHSA-7gcc-r8m5-44qm |
package-lock.json |
| high | osv/GHSA-c2c7-rcm5-vvqj: picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj |
package-lock.json |
| high | osv/GHSA-mw96-cpmx-2vgc: rollup@4.22.4 (npm) is affected by GHSA-mw96-cpmx-2vgc |
package-lock.json |
| high | osv/GHSA-c2qf-rxjj-qqgw: semver@6.3.0 (npm) is affected by GHSA-c2qf-rxjj-qqgw |
package-lock.json |
| high | osv/GHSA-mrhx-c7xc-m3w5: zod@3.23.8 (npm) is affected by GHSA-mrhx-c7xc-m3w5 |
package-lock.json |
| high | zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] |
.github/workflows/publish.yml:15 |
| medium | osv/GHSA-968p-4wvh-cqc8: @babel/runtime@7.21.0 (npm) is affected by GHSA-968p-4wvh-cqc8 |
package-lock.json |
| medium | osv/GHSA-2g4f-4pwh-qvx6: ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6 |
package-lock.json |
| medium | osv/GHSA-5pm8-86m8-9m6r: basic-ftp@5.2.2 (npm) is affected by GHSA-5pm8-86m8-9m6r |
package-lock.json |
| medium | osv/GHSA-r4jh-29pc-gfqr: basic-ftp@5.2.2 (npm) is affected by GHSA-r4jh-29pc-gfqr |
package-lock.json |
| medium | osv/GHSA-gcqx-w48m-w2h4: deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4 |
package-lock.json |
| medium | osv/GHSA-67mh-4wv8-2f99: esbuild@0.17.19 (npm) is affected by GHSA-67mh-4wv8-2f99 |
package-lock.json |
| medium | osv/GHSA-rxp7-6hxx-x8q5: ip-address@10.7.3 (npm) is affected by GHSA-rxp7-6hxx-x8q5 |
package-lock.json |
| medium | osv/GHSA-952p-6rrq-rcjv: micromatch@4.0.5 (npm) is affected by GHSA-952p-6rrq-rcjv |
package-lock.json |
| medium | osv/GHSA-3v7f-55p6-f55p: picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p |
package-lock.json |
| medium | osv/GHSA-4mjr-xmp4-gh2g: qs@6.15.2 (npm) is affected by GHSA-4mjr-xmp4-gh2g |
package-lock.json |
| medium | osv/GHSA-6pq8-jhm2-2vcw: qs@6.15.2 (npm) is affected by GHSA-6pq8-jhm2-2vcw |
package-lock.json |
| medium | osv/GHSA-x5fp-wj9c-mxmx: qs@6.15.2 (npm) is affected by GHSA-x5fp-wj9c-mxmx |
package-lock.json |
| medium | osv/GHSA-j8xg-fqg3-53r7: word-wrap@1.2.3 (npm) is affected by GHSA-j8xg-fqg3-53r7 |
package-lock.json |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 454; test lines: 507
| Language | Lines |
|---|---|
| JavaScript | 548 |
| TypeScript | 413 |