rm2thaddeus/Pixel_Detective

A repository for the Pixel Detective project.

https://github.com/rm2thaddeus/Pixel_Detective · commit 8e741807f9b0 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/rm2thaddeus/Pixel_Detective
Commit: 8e741807f9b04e4bbb5c1b5c6460cd271e600837
Generated: 2026-11-13T23:46:40+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	3	explicit	95%	100%
Code quality	49	poor	90%	100%
Security	56	weak	85%	100%

AI provenance

Explicit AI attribution on 3% of first-party code added; an estimated 3% including velocity signals.

Explicitly attributed share (lower bound): 2.6%
Unattributed share in AI-consistent velocity bursts: 19.5%
Estimated AI-generated share: 2.6%

AI tool	Attributed commits	Lines added
OpenAI Codex	14	2,678
Claude Code	6	20

AI tooling configured in repo: cursor, generic-agent

Current source lines last changed by AI-attributed commits: 2,764 of 60,918.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	0.362	3.026	0.12x
Security	0.0	0.911	0.0x

Stylometry index: 2.81 per 1,000 lines (narrated steps 15, placeholders 7, assistant phrasing 4, emoji 269). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2025-03	5,777	0%
2025-05	20,941	0%
2025-06	22,798	6%
2025-07	7,480	14%
2025-08	3,484	0%
2025-09	38,850	1%
2025-10	218	0%
2025-11	37	0%
2026-01	4,492	0%
2026-02	20	100%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (9a066452a697)
Claude Code: trailer 'Co-Authored-By: Claude' (44cae356080d)
Claude Code: trailer 'Co-Authored-By: Claude' (a234add56841)
Claude Code: trailer 'Co-Authored-By: Claude' (d2c74c5d7445)
Claude Code: trailer 'Co-Authored-By: Claude' (e6d0d782d622)
Claude Code: trailer 'Co-Authored-By: Claude' (0f2bda092922)
OpenAI Codex: on merged branch (288501749b) (77049264d737)
OpenAI Codex: on merged branch (ed072ad457) (45c9d2c5e0dc)
OpenAI Codex: on merged branch (e8b4a3f924) (16566391537f)
OpenAI Codex: on merged branch (f501743000) (eb43da113256)
OpenAI Codex: on merged branch (eefaaf87b3) (e29c52808ace)
OpenAI Codex: on merged branch (3e0d95f1eb) (fb26d508864d)
OpenAI Codex: on merged branch (42c88dd7b7) (f60617693ed7)
OpenAI Codex: on merged branch (e1198122b2) (a984ced4b788)
OpenAI Codex: on merged branch (7a584ee4fe) (fd723bcc6d91)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.06, no CI test run detected; 31% of function code in complex or long functions; 9% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	39
Duplication	59
Code smells (Opengrep)	49
Tests and CI	41
Documentation	85
Type safety	26
Process (Scorecard review/maintenance)	n/a

Functions: 2,697; mean complexity 3.8, 90th percentile 8; 93 complex and 58 long functions
Duplicated lines: 8.9% of 47,561 compared
Tests: 3,379 test lines for 60,918 source lines (ratio 0.06); CI test commands: none detected; 9% of recent source commits also change tests
Docs missing or thin: contributing

Most complex functions:

Security

Security posture is weak: 381 known vulnerabilities in 57 dependencies; 11 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: dependencies.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	87
Vulnerable dependencies (OSV)	0
CI workflows (zizmor)	54
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Known vulnerabilities: 381 in 57 packages (critical 23, high 211, medium 132, low 13)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
critical	`osv/GHSA-m7jm-9gc2-mpf2`: fast-xml-parser@4.5.3 (npm) is affected by GHSA-m7jm-9gc2-mpf2	frontend/package-lock.json
critical	`osv/GHSA-fjxv-7rqg-78g4`: form-data@4.0.3 (npm) is affected by GHSA-fjxv-7rqg-78g4	frontend/package-lock.json
critical	`osv/GHSA-2464-fhr4-w9xw`: next@15.3.3 (npm) is affected by GHSA-2464-fhr4-w9xw	frontend/package-lock.json
critical	`osv/GHSA-2xp9-vwfh-vxw4`: next@15.3.3 (npm) is affected by GHSA-2xp9-vwfh-vxw4	frontend/package-lock.json
critical	`osv/GHSA-9qr9-h5gf-34mp`: next@15.3.3 (npm) is affected by GHSA-9qr9-h5gf-34mp	frontend/package-lock.json
critical	`osv/GHSA-p293-qw3h-jr36`: next@15.3.3 (npm) is affected by GHSA-p293-qw3h-jr36	frontend/package-lock.json
critical	`osv/GHSA-x2qx-6953-8485`: gitpython@3.1.44 (PyPI) is affected by PYSEC-2026-2161, GHSA-x2qx-6953-8485	requirements.txt
critical	`osv/GHSA-284h-m62q-gf8w`: gitpython@3.1.44 (PyPI) is affected by PYSEC-2026-3786, GHSA-284h-m62q-gf8w	requirements.txt
critical	`osv/GHSA-82r6-8w77-94w6`: anyio@4.8.0 (PyPI) is affected by PYSEC-2026-4025, GHSA-82r6-8w77-94w6	requirements.txt
critical	`osv/GHSA-6q48-6c7w-9gw2`: certifi@2025.1.31 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2	requirements.txt
critical	`osv/GHSA-vqfr-h8mv-ghfj`: h11@0.14.0 (PyPI) is affected by PYSEC-2026-348, GHSA-vqfr-h8mv-ghfj	requirements.txt
critical	`osv/GHSA-5x8w-8jj5-q52h`: pillow@11.1.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h	requirements.txt
critical	`osv/GHSA-8g5g-8vmr-9782`: pillow@11.1.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782	requirements.txt
critical	`osv/GHSA-v9pv-5gc8-w2m6`: pillow@11.1.0 (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6	requirements.txt
critical	`osv/GHSA-xvh5-g6gv-559v`: pillow@11.1.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v	requirements.txt
critical	`osv/GHSA-332p-7hrc-92wf`: pillow@11.1.0 (PyPI) is affected by GHSA-332p-7hrc-92wf	requirements.txt
critical	`osv/GHSA-w889-685w-c8fh`: pillow@11.1.0 (PyPI) is affected by GHSA-w889-685w-c8fh	requirements.txt
critical	`osv/GHSA-fgcw-684q-jj6r`: transformers@4.49.0 (PyPI) is affected by PYSEC-2026-2290, GHSA-fgcw-684q-jj6r	requirements.txt
critical	`osv/GHSA-2464-fhr4-w9xw`: next@15.5.2 (npm) is affected by GHSA-2464-fhr4-w9xw	tools/dev-graph-ui/package-lock.json
critical	`osv/GHSA-2xp9-vwfh-vxw4`: next@15.5.2 (npm) is affected by GHSA-2xp9-vwfh-vxw4	tools/dev-graph-ui/package-lock.json
critical	`osv/GHSA-9qr9-h5gf-34mp`: next@15.5.2 (npm) is affected by GHSA-9qr9-h5gf-34mp	tools/dev-graph-ui/package-lock.json
critical	`osv/GHSA-p293-qw3h-jr36`: next@15.5.2 (npm) is affected by GHSA-p293-qw3h-jr36	tools/dev-graph-ui/package-lock.json
critical	`osv/GHSA-23hp-3jrh-7fpw`: tar@7.4.3 (npm) is affected by GHSA-23hp-3jrh-7fpw	tools/dev-graph-ui/package-lock.json
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	backend/developer_graph_service/Dockerfile:17
high	`opengrep/dockerfile.security.missing-user`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	backend/gpu_umap_service/Dockerfile:15

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 60,918; test lines: 3,379

Language	Lines
Python	36,423
TypeScript	25,853
PowerShell	1,139
JavaScript	879
Shell	3

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/rm2thaddeus/Pixel_Detective/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/rm2thaddeus/Pixel_Detective/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/rm2thaddeus/Pixel_Detective/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/rm2thaddeus/Pixel_Detective/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/rm2thaddeus/Pixel_Detective/security.svg)](https://repotrust.synapticcyber.com/r/github.com/rm2thaddeus/Pixel_Detective/)