Leaderboard github.com
raygan/mam-audiofinder
A simple webUI to download audiobooks from MyAnonymouse using qBittorrent, and import them to an Audiobookshelf library
AI provenance
0%
possible
- Confidence
- 49%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
36/100
poor
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
61/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/raygan/mam-audiofinder
- Commit:
08dc54ba85a6e72d002bf94d950d830ae469d69a - Generated: 2026-11-13T23:52:46+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 49% | 100% |
| Code quality | 36 | poor | 90% | 100% |
| Security | 61 | weak | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
AI tooling configured in repo: generic-agent
-
Stylometry index: 0.93 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 2). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-09 | 1,097 | 0% |
| 2025-12 | 272 | 0% |
Evidence
- AGENTS.md (generic-agent configuration) (AGENTS.md)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 30% of function code in complex or long functions; 5% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 40 |
| Duplication | 72 |
| Code smells (Opengrep) | 50 |
| Tests and CI | 0 |
| Documentation | 40 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 43; mean complexity 7.5, 90th percentile 17; 5 complex and 0 long functions
- Duplicated lines: 5.5% of 881 compared
- Tests: 0 test lines for 1,078 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
- Docs missing or thin: license, contributing, changelog
Most complex functions:
- add_to_qb in app/main.py: complexity 39, 94 lines
- build_qb_path_map in app/main.py: complexity 27, 30 lines
- do_import in app/main.py: complexity 24, 69 lines
- api_setup in app/main.py: complexity 20, 30 lines
- search.flatten in app/main.py: complexity 17, 23 lines
Security
Security posture is weak: 11 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 3 |
| Vulnerable dependencies (OSV) | 100 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:11 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:112 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a tr.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:112 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:174 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a tr.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:174 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:201 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a emptyTr.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:201 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:210 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a tr.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:210 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:240 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a expTd.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
app/static/app.js:240 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
app/static/app.js:121 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
app/static/app.js:174 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
app/static/app.js:201 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
app/static/app.js:210 |
| medium | opengrep/javascript.lang.security.html-in-template-string: This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low] |
app/static/app.js:214 |
| low | opengrep/javascript.audit.detect-replaceall-sanitization: Detected a call to replaceAll() in an attempt to HTML escape the string (s || '').toString(). Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as sanitize-html or DOMPurify. [confidence low] |
app/static/app.js:140 |
| low | opengrep/javascript.audit.detect-replaceall-sanitization: Detected a call to replaceAll() in an attempt to HTML escape the string (s || '').toString() .replaceAll('&', '&'). Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-h [confidence low] |
app/static/app.js:140 |
| low | opengrep/javascript.audit.detect-replaceall-sanitization: Detected a call to replaceAll() in an attempt to HTML escape the string (s || '').toString() .replaceAll('&', '&') .replaceAll('<', '<'). Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitizatio [confidence low] |
app/static/app.js:140 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 1,078; test lines: 0
| Language | Lines |
|---|---|
| Python | 682 |
| JavaScript | 396 |