{ "round": "2026-07", "generatedAt": "2026-07-27T18:34:06.748Z", "scannerRules": 212, "methodology": { "sampleStrategy": "GitHub code search for each builder's scaffold marker, deduped to one row per repository, screened against the eligibility rules below, then the first N survivors in GitHub's own result order. No hand-picking: the sampler never sees scan results, and the scanner never sees the eligibility reasons. Markers by builder — Lovable: lovable-tagger in package.json; v0: v0-user-next config merge in the Next.js config; Bolt: bolt-vite-react-ts template in .bolt/config.json; Base44: @base44/sdk in package.json.", "eligibility": [ "Public, non-fork, non-archived, non-disabled repositories only.", "Repositories flagged as GitHub templates are excluded.", "Repositories owned by the builder's own organization are excluded (product and docs, not user apps).", "The scaffold marker must appear in one of the builder's live marker files (package.json for Lovable and Base44, the Next.js config for v0, .bolt/config.json for Bolt). A mention in a README, a lockfile or a backup copy of the manifest is not evidence the repo was scaffolded by the builder.", "Repositories whose name, description or topics identify them as a tutorial, course, boilerplate, starter kit, template, workshop or awesome-list are excluded.", "Size bounds: 40 KB to 250,000 KB. Below the floor there is no app; above the ceiling it is a monorepo or asset dump rather than one vibe-coded app.", "Must contain at least 5 non-vendored source files, measured from the git tree before cloning.", "Repositories that fail to clone or scan are counted as excluded, never as clean." ], "vendoredPathPatterns": [ "**/components/ui/**", "**/ui/shadcn/**", "**/shadcn/ui/**", "**/*.md", "**/*.mdx", ".claude/**", ".agent/**", ".cursor/**", ".superpowers/**", ".windsurf/**", "**/.claude/**", "**/.agent/**", "**/vendor/**", "**/vendored/**", "**/third_party/**", "**/generated/**", "**/__generated__/**" ], "limitations": [ "Attribution is scaffold-level, not authorship-level. The marker proves the project was created from the builder's scaffold; it does not prove every line was generated by it. Humans edit these repos afterwards, and some of what is measured is human-written.", "The sample is public GitHub only. Apps that were never pushed, were pushed privately, or were deployed straight from the builder without a repo are invisible, and there is no reason to assume they are similar.", "GitHub code search caps at 1,000 results per query, so for builders with a larger universe the sample is drawn from the first 1,000 results in GitHub's relevance order, not uniformly at random from the whole universe.", "The 'vendored' bucket is broader than the word suggests: it covers copied UI component libraries, markdown documentation and committed AI-agent tooling directories — everything the builder's code generation is not accountable for. Those findings are reported, not discarded.", "Static analysis has false positives. Findings are not confirmed exploits, and a critical finding is a thing a human should look at, not a proven breach.", "Project size is a confound and it is not small: median scanned files per repository ranges from 30.5 (Bolt) to 160 (Lovable). A smaller project has fewer places for a critical finding to occur, so a builder whose users ship smaller apps scores better on every rate here without necessarily generating safer code. The per-builder median is published in the sample table so this can be read directly rather than inferred.", "The vendored-critical column is a fact about scaffold composition, not about security. It largely reflects how much of a component library each builder copies in: a builder that ships the full shadcn/ui suite inherits the two files that generate nearly all vendored findings, while one that ships a few hand-rolled primitives inherits none. A 0% vendored rate means the builder vendors less code, not that it produces safer code.", "Some rules fire on scaffold files the builder ships unmodified (a missing Content-Security-Policy on the stock index.html, for instance) where the real control lives in host headers the scanner cannot see. Those inflate the high-severity counts for every builder roughly equally and do not affect the critical-severity headline.", "Per-repo rows are anonymized by design. The numbers are reproducible by re-running the pipeline; the individual repositories behind them are deliberately not recoverable, because publishing them would disclose live vulnerabilities in other people's projects.", "Files over 1.5 MB are skipped, and repositories are scanned up to 8,000 files. No repository in this round hit the file cap, so every repository was measured whole.", "Round size: 87 repositories across 4 builders. Differences of a few percentage points between builders are inside the noise of a sample this size." ] }, "builders": [ { "id": "lovable", "name": "Lovable", "marker": "lovable-tagger in package.json", "attributionConfidence": "scaffold", "universeSize": 10284, "sampled": 25, "scanned": 25, "excluded": 10, "underSampled": false, "minReportableN": 10, "appCode": { "reposWithCritical": 19, "pctWithCritical": 0.76, "reposWithHighOrWorse": 25, "pctWithHighOrWorse": 1, "medianFindings": 51, "meanFindings": 228.08, "gradeDistribution": { "A+": 0, "A": 0, "B": 1, "C": 1, "D": 2, "F": 21 }, "topRules": [ { "rule": "VC106", "title": "Magic Numbers in Code", "repos": 25, "occurrences": 834 }, { "rule": "VC027", "title": "Missing Security Meta Tags / Headers", "repos": 25, "occurrences": 161 }, { "rule": "VC056", "title": "Clickjacking — Missing X-Frame-Options", "repos": 25, "occurrences": 90 }, { "rule": "VC020", "title": "Missing Content Security Policy (CSP)", "repos": 25, "occurrences": 80 }, { "rule": "VC097", "title": "Console.log Left in Production Code", "repos": 21, "occurrences": 824 }, { "rule": "VC001", "title": "Hardcoded API Key or Secret", "repos": 17, "occurrences": 154 }, { "rule": "VC046", "title": "Session Fixation Risk", "repos": 15, "occurrences": 24 }, { "rule": "VC100", "title": "N+1 Query Pattern Detected", "repos": 13, "occurrences": 226 }, { "rule": "VC037", "title": "Stack Traces Exposed in API Responses", "repos": 12, "occurrences": 572 }, { "rule": "ENTROPY", "title": "High-Entropy String Detected (Possible Secret)", "repos": 11, "occurrences": 83 } ] }, "vendoredCode": { "reposWithCritical": 22, "pctWithCritical": 0.88, "reposWithHighOrWorse": 22, "pctWithHighOrWorse": 0.88, "medianFindings": 5, "meanFindings": 50.08, "gradeDistribution": { "A+": 2, "A": 0, "B": 0, "C": 1, "D": 13, "F": 9 }, "topRules": [ { "rule": "ENTROPY", "title": "High-Entropy String Detected (Possible Secret)", "repos": 22, "occurrences": 225 }, { "rule": "VC007", "title": "Potential Cross-Site Scripting (XSS)", "repos": 22, "occurrences": 35 }, { "rule": "VC017", "title": "Insecure Cookie Settings", "repos": 22, "occurrences": 31 }, { "rule": "VC063", "title": "Unsanitized dangerouslySetInnerHTML", "repos": 22, "occurrences": 22 }, { "rule": "VC097", "title": "Console.log Left in Production Code", "repos": 9, "occurrences": 345 }, { "rule": "VC103", "title": "TODO/FIXME Left in Code", "repos": 3, "occurrences": 24 }, { "rule": "VC033", "title": "Debug/Development Mode Exposed", "repos": 3, "occurrences": 19 }, { "rule": "VC106", "title": "Magic Numbers in Code", "repos": 3, "occurrences": 9 }, { "rule": "VC031", "title": "Hardcoded JWT Secret", "repos": 2, "occurrences": 27 }, { "rule": "VC069", "title": "Missing Certificate Pinning in Mobile App", "repos": 2, "occurrences": 16 } ] }, "repos": [ { "id": "02ea62de283571c3", "files": 236, "appFindings": 52, "vendoredFindings": 8, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "091fb8211f0f61f0", "files": 124, "appFindings": 39, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "170a3d90d2b1c857", "files": 89, "appFindings": 50, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "17eb6f811f63fe95", "files": 79, "appFindings": 7, "vendoredFindings": 5, "grade": "C", "score": 79, "detectedPlatforms": [ "lovable" ] }, { "id": "1c8b6f30b79fee39", "files": 480, "appFindings": 414, "vendoredFindings": 8, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "24dc1e4a2d117696", "files": 101, "appFindings": 49, "vendoredFindings": 11, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "3a88e4d6c26b6a4b", "files": 215, "appFindings": 79, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "4272955b72500b21", "files": 170, "appFindings": 43, "vendoredFindings": 7, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "436e82cdc20a235e", "files": 173, "appFindings": 79, "vendoredFindings": 13, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "557edced39c4b03e", "files": 82, "appFindings": 5, "vendoredFindings": 5, "grade": "B", "score": 83, "detectedPlatforms": [ "lovable" ] }, { "id": "6268cfdce1bdf63d", "files": 160, "appFindings": 88, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "78018a6e6d9bcd68", "files": 207, "appFindings": 62, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "8835cedc04238291", "files": 574, "appFindings": 146, "vendoredFindings": 8, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "89f6bd1f2432b0de", "files": 77, "appFindings": 9, "vendoredFindings": 5, "grade": "D", "score": 63, "detectedPlatforms": [ "lovable" ] }, { "id": "8de54058d486daf8", "files": 132, "appFindings": 25, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "8e093987eb8ef11a", "files": 144, "appFindings": 13, "vendoredFindings": 5, "grade": "F", "score": 57, "detectedPlatforms": [ "lovable" ] }, { "id": "9251a035f6b0fb72", "files": 87, "appFindings": 9, "vendoredFindings": 5, "grade": "F", "score": 55, "detectedPlatforms": [ "lovable" ] }, { "id": "93f987a973b0b9c8", "files": 6971, "appFindings": 3373, "vendoredFindings": 1076, "grade": "F", "score": 0, "detectedPlatforms": [ "claude-code", "lovable" ] }, { "id": "9dc318d6e5e80f81", "files": 146, "appFindings": 51, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "a2d6a384f45af021", "files": 1116, "appFindings": 580, "vendoredFindings": 21, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "b75d5418b0cdb165", "files": 48, "appFindings": 27, "vendoredFindings": 0, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "c111d622fca3f31d", "files": 320, "appFindings": 126, "vendoredFindings": 7, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "d07661588910a493", "files": 54, "appFindings": 10, "vendoredFindings": 0, "grade": "D", "score": 60, "detectedPlatforms": [ "lovable" ] }, { "id": "f644aecef389b6c6", "files": 171, "appFindings": 94, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] }, { "id": "fe1ab56a1f1a6c33", "files": 489, "appFindings": 272, "vendoredFindings": 28, "grade": "F", "score": 0, "detectedPlatforms": [ "lovable" ] } ], "medianProjectFiles": 160 }, { "id": "v0", "name": "v0", "marker": "v0-user-next config merge in the Next.js config", "attributionConfidence": "scaffold", "universeSize": 1372, "sampled": 25, "scanned": 25, "excluded": 7, "underSampled": false, "minReportableN": 10, "appCode": { "reposWithCritical": 14, "pctWithCritical": 0.56, "reposWithHighOrWorse": 20, "pctWithHighOrWorse": 0.8, "medianFindings": 36, "meanFindings": 44.52, "gradeDistribution": { "A+": 2, "A": 3, "B": 1, "C": 0, "D": 1, "F": 18 }, "topRules": [ { "rule": "VC106", "title": "Magic Numbers in Code", "repos": 22, "occurrences": 175 }, { "rule": "VC097", "title": "Console.log Left in Production Code", "repos": 20, "occurrences": 101 }, { "rule": "VC003", "title": "API Route Missing Authentication", "repos": 11, "occurrences": 55 }, { "rule": "VC065", "title": "Unprotected Next.js API Route", "repos": 11, "occurrences": 53 }, { "rule": "VC154", "title": "API Route Without Request Body Validation", "repos": 10, "occurrences": 36 }, { "rule": "VC008", "title": "API Endpoint Without Rate Limiting", "repos": 10, "occurrences": 13 }, { "rule": "VC100", "title": "N+1 Query Pattern Detected", "repos": 8, "occurrences": 23 }, { "rule": "VC007", "title": "Potential Cross-Site Scripting (XSS)", "repos": 7, "occurrences": 39 }, { "rule": "VC025", "title": "Unsanitized Filename in File Operations", "repos": 6, "occurrences": 16 }, { "rule": "VC043", "title": "Timing-Unsafe Secret Comparison", "repos": 6, "occurrences": 14 } ] }, "vendoredCode": { "reposWithCritical": 20, "pctWithCritical": 0.8, "reposWithHighOrWorse": 23, "pctWithHighOrWorse": 0.92, "medianFindings": 5, "meanFindings": 5.84, "gradeDistribution": { "A+": 25, "A": 0, "B": 0, "C": 0, "D": 0, "F": 0 }, "topRules": [ { "rule": "ENTROPY", "title": "High-Entropy String Detected (Possible Secret)", "repos": 22, "occurrences": 43 }, { "rule": "VC017", "title": "Insecure Cookie Settings", "repos": 22, "occurrences": 23 }, { "rule": "VC007", "title": "Potential Cross-Site Scripting (XSS)", "repos": 20, "occurrences": 21 }, { "rule": "VC063", "title": "Unsanitized dangerouslySetInnerHTML", "repos": 20, "occurrences": 20 }, { "rule": "VC106", "title": "Magic Numbers in Code", "repos": 3, "occurrences": 11 }, { "rule": "VC097", "title": "Console.log Left in Production Code", "repos": 2, "occurrences": 4 }, { "rule": "VC098", "title": "Synchronous File Operations", "repos": 2, "occurrences": 4 }, { "rule": "VC091", "title": "Potential Race Condition (TOCTOU)", "repos": 2, "occurrences": 2 }, { "rule": "VC100", "title": "N+1 Query Pattern Detected", "repos": 1, "occurrences": 6 }, { "rule": "VC104", "title": "Empty Catch Block", "repos": 1, "occurrences": 4 } ] }, "repos": [ { "id": "104d2c5d368a8efe", "files": 82, "appFindings": 5, "vendoredFindings": 5, "grade": "A", "score": 93, "detectedPlatforms": [ "v0" ] }, { "id": "10a362938a91a258", "files": 113, "appFindings": 14, "vendoredFindings": 5, "grade": "F", "score": 56, "detectedPlatforms": [] }, { "id": "15a3ba8c01d8bbd6", "files": 131, "appFindings": 49, "vendoredFindings": 4, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "200c98a5cee03c02", "files": 33, "appFindings": 4, "vendoredFindings": 0, "grade": "B", "score": 82, "detectedPlatforms": [] }, { "id": "2974bc64e4179197", "files": 87, "appFindings": 1, "vendoredFindings": 5, "grade": "A+", "score": 99, "detectedPlatforms": [] }, { "id": "385fddc8174fd9e6", "files": 88, "appFindings": 47, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "4413d0c608521d90", "files": 96, "appFindings": 46, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "4e554b3d5eb19c74", "files": 94, "appFindings": 32, "vendoredFindings": 7, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "50da00a88abdb6d9", "files": 86, "appFindings": 48, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "585196e56c46b116", "files": 156, "appFindings": 49, "vendoredFindings": 10, "grade": "F", "score": 0, "detectedPlatforms": [ "claude-code", "v0" ] }, { "id": "75b3f0e02e7b55e4", "files": 119, "appFindings": 48, "vendoredFindings": 3, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "7de15f02005b3fb1", "files": 175, "appFindings": 80, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "8bb34af512ec1f26", "files": 81, "appFindings": 5, "vendoredFindings": 6, "grade": "A", "score": 95, "detectedPlatforms": [ "v0" ] }, { "id": "937aaa9e91f2922c", "files": 92, "appFindings": 50, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "a4746276a8004d36", "files": 180, "appFindings": 79, "vendoredFindings": 1, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "ba60e5e3bd44bf07", "files": 80, "appFindings": 21, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "c1d01645041e42d7", "files": 711, "appFindings": 275, "vendoredFindings": 34, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "cf2d71f8cf79650f", "files": 83, "appFindings": 5, "vendoredFindings": 5, "grade": "A", "score": 95, "detectedPlatforms": [ "claude-code" ] }, { "id": "e220d8a21bcb01e5", "files": 92, "appFindings": 19, "vendoredFindings": 5, "grade": "D", "score": 61, "detectedPlatforms": [] }, { "id": "e287f4fb4175deb7", "files": 90, "appFindings": 29, "vendoredFindings": 6, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "eac59daf1ef786f3", "files": 96, "appFindings": 89, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "ecc4f49447618216", "files": 196, "appFindings": 57, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "ed31a65e19a9a0dc", "files": 158, "appFindings": 36, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] }, { "id": "f94ea8fd1e7a0e93", "files": 12, "appFindings": 1, "vendoredFindings": 0, "grade": "A+", "score": 99, "detectedPlatforms": [] }, { "id": "fd625a14ec7c2f95", "files": 125, "appFindings": 24, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "v0" ] } ], "medianProjectFiles": 94 }, { "id": "bolt", "name": "Bolt", "marker": "bolt-vite-react-ts template in .bolt/config.json", "attributionConfidence": "scaffold", "universeSize": 1312, "sampled": 12, "scanned": 12, "excluded": 86, "underSampled": false, "minReportableN": 10, "appCode": { "reposWithCritical": 5, "pctWithCritical": 0.4167, "reposWithHighOrWorse": 12, "pctWithHighOrWorse": 1, "medianFindings": 13, "meanFindings": 25, "gradeDistribution": { "A+": 0, "A": 0, "B": 3, "C": 2, "D": 1, "F": 6 }, "topRules": [ { "rule": "VC027", "title": "Missing Security Meta Tags / Headers", "repos": 12, "occurrences": 44 }, { "rule": "VC056", "title": "Clickjacking — Missing X-Frame-Options", "repos": 12, "occurrences": 23 }, { "rule": "VC020", "title": "Missing Content Security Policy (CSP)", "repos": 12, "occurrences": 22 }, { "rule": "VC106", "title": "Magic Numbers in Code", "repos": 7, "occurrences": 24 }, { "rule": "VC097", "title": "Console.log Left in Production Code", "repos": 7, "occurrences": 16 }, { "rule": "VC003", "title": "API Route Missing Authentication", "repos": 3, "occurrences": 45 }, { "rule": "VC037", "title": "Stack Traces Exposed in API Responses", "repos": 3, "occurrences": 8 }, { "rule": "VC065", "title": "Unprotected Next.js API Route", "repos": 2, "occurrences": 14 }, { "rule": "VC148", "title": "Secret Leaked in Error Response", "repos": 2, "occurrences": 7 }, { "rule": "VC154", "title": "API Route Without Request Body Validation", "repos": 2, "occurrences": 7 } ] }, "vendoredCode": { "reposWithCritical": 0, "pctWithCritical": 0, "reposWithHighOrWorse": 0, "pctWithHighOrWorse": 0, "medianFindings": 0, "meanFindings": 0, "gradeDistribution": { "A+": 12, "A": 0, "B": 0, "C": 0, "D": 0, "F": 0 }, "topRules": [] }, "repos": [ { "id": "042da428ea00e767", "files": 33, "appFindings": 33, "vendoredFindings": 0, "grade": "F", "score": 0, "detectedPlatforms": [ "bolt" ] }, { "id": "064432fc3fcb264f", "files": 106, "appFindings": 48, "vendoredFindings": 0, "grade": "F", "score": 0, "detectedPlatforms": [ "bolt" ] }, { "id": "09a05ff0ba899fdc", "files": 23, "appFindings": 9, "vendoredFindings": 0, "grade": "C", "score": 79, "detectedPlatforms": [ "bolt" ] }, { "id": "0ae35acc9ba84116", "files": 201, "appFindings": 15, "vendoredFindings": 0, "grade": "C", "score": 72, "detectedPlatforms": [ "bolt" ] }, { "id": "0cf0d32a456e7a0e", "files": 28, "appFindings": 11, "vendoredFindings": 0, "grade": "D", "score": 65, "detectedPlatforms": [ "bolt" ] }, { "id": "0ec400f246a86b09", "files": 149, "appFindings": 106, "vendoredFindings": 0, "grade": "F", "score": 0, "detectedPlatforms": [ "bolt" ] }, { "id": "274ebe5013fe4f6e", "files": 17, "appFindings": 5, "vendoredFindings": 0, "grade": "B", "score": 81, "detectedPlatforms": [ "bolt" ] }, { "id": "4ceae2de1d118dc9", "files": 117, "appFindings": 28, "vendoredFindings": 0, "grade": "F", "score": 0, "detectedPlatforms": [ "bolt" ] }, { "id": "557c509db1fc8264", "files": 51, "appFindings": 10, "vendoredFindings": 0, "grade": "F", "score": 54, "detectedPlatforms": [ "bolt" ] }, { "id": "669498ea0e15f23d", "files": 12, "appFindings": 23, "vendoredFindings": 0, "grade": "F", "score": 0, "detectedPlatforms": [ "bolt" ] }, { "id": "96f63102e22c2a04", "files": 17, "appFindings": 8, "vendoredFindings": 0, "grade": "B", "score": 81, "detectedPlatforms": [ "claude-code", "bolt" ] }, { "id": "f70540f169dd4564", "files": 19, "appFindings": 4, "vendoredFindings": 0, "grade": "B", "score": 84, "detectedPlatforms": [ "bolt" ] } ], "medianProjectFiles": 30.5 }, { "id": "base44", "name": "Base44", "marker": "@base44/sdk in package.json", "attributionConfidence": "scaffold", "universeSize": 1248, "sampled": 25, "scanned": 25, "excluded": 8, "underSampled": false, "minReportableN": 10, "appCode": { "reposWithCritical": 15, "pctWithCritical": 0.6, "reposWithHighOrWorse": 25, "pctWithHighOrWorse": 1, "medianFindings": 29, "meanFindings": 133.96, "gradeDistribution": { "A+": 0, "A": 0, "B": 3, "C": 3, "D": 0, "F": 19 }, "topRules": [ { "rule": "VC027", "title": "Missing Security Meta Tags / Headers", "repos": 25, "occurrences": 189 }, { "rule": "VC056", "title": "Clickjacking — Missing X-Frame-Options", "repos": 25, "occurrences": 97 }, { "rule": "VC020", "title": "Missing Content Security Policy (CSP)", "repos": 25, "occurrences": 95 }, { "rule": "VC106", "title": "Magic Numbers in Code", "repos": 24, "occurrences": 559 }, { "rule": "VC010", "title": "Client-Side Only Authorization", "repos": 19, "occurrences": 66 }, { "rule": "VC016", "title": "Unvalidated Redirect", "repos": 18, "occurrences": 128 }, { "rule": "VC100", "title": "N+1 Query Pattern Detected", "repos": 14, "occurrences": 284 }, { "rule": "VC097", "title": "Console.log Left in Production Code", "repos": 14, "occurrences": 205 }, { "rule": "VC037", "title": "Stack Traces Exposed in API Responses", "repos": 13, "occurrences": 468 }, { "rule": "VC104", "title": "Empty Catch Block", "repos": 12, "occurrences": 173 } ] }, "vendoredCode": { "reposWithCritical": 21, "pctWithCritical": 0.84, "reposWithHighOrWorse": 21, "pctWithHighOrWorse": 0.84, "medianFindings": 5, "meanFindings": 16.04, "gradeDistribution": { "A+": 4, "A": 0, "B": 0, "C": 0, "D": 15, "F": 6 }, "topRules": [ { "rule": "ENTROPY", "title": "High-Entropy String Detected (Possible Secret)", "repos": 21, "occurrences": 154 }, { "rule": "VC007", "title": "Potential Cross-Site Scripting (XSS)", "repos": 21, "occurrences": 79 }, { "rule": "VC063", "title": "Unsanitized dangerouslySetInnerHTML", "repos": 21, "occurrences": 79 }, { "rule": "VC017", "title": "Insecure Cookie Settings", "repos": 21, "occurrences": 77 }, { "rule": "VC097", "title": "Console.log Left in Production Code", "repos": 3, "occurrences": 3 }, { "rule": "VC016", "title": "Unvalidated Redirect", "repos": 2, "occurrences": 2 }, { "rule": "VC103", "title": "TODO/FIXME Left in Code", "repos": 1, "occurrences": 2 }, { "rule": "VC004", "title": "Supabase Client Without Row Level Security", "repos": 1, "occurrences": 1 }, { "rule": "VC025", "title": "Unsanitized Filename in File Operations", "repos": 1, "occurrences": 1 }, { "rule": "VC034", "title": "Insecure Randomness for Security-Sensitive Values", "repos": 1, "occurrences": 1 } ] }, "repos": [ { "id": "0c8b92b3cafb59d4", "files": 144, "appFindings": 48, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "21b44795bc833bcf", "files": 95, "appFindings": 22, "vendoredFindings": 5, "grade": "F", "score": 16, "detectedPlatforms": [] }, { "id": "26ef4c8f35c5bc03", "files": 298, "appFindings": 213, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "3616603a2db04c8e", "files": 98, "appFindings": 39, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "42742157e9c66e9e", "files": 81, "appFindings": 23, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "5882cdab0dd47065", "files": 212, "appFindings": 182, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "64a3843238d460bd", "files": 133, "appFindings": 177, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "667966290fc902c5", "files": 4974, "appFindings": 853, "vendoredFindings": 290, "grade": "F", "score": 0, "detectedPlatforms": [ "bolt", "claude-code", "lovable", "v0" ] }, { "id": "700c31c18eefbf1c", "files": 14, "appFindings": 5, "vendoredFindings": 0, "grade": "B", "score": 83, "detectedPlatforms": [] }, { "id": "84ff90f6087f98a5", "files": 105, "appFindings": 24, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [ "claude-code" ] }, { "id": "9c97d2f247a438f8", "files": 50, "appFindings": 13, "vendoredFindings": 0, "grade": "C", "score": 70, "detectedPlatforms": [] }, { "id": "a40620912ceb7c89", "files": 1592, "appFindings": 380, "vendoredFindings": 6, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "adc73d339720aeae", "files": 84, "appFindings": 6, "vendoredFindings": 7, "grade": "B", "score": 82, "detectedPlatforms": [] }, { "id": "c459163c6f2752f4", "files": 271, "appFindings": 119, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "d5b8ac056eec538d", "files": 82, "appFindings": 5, "vendoredFindings": 5, "grade": "B", "score": 83, "detectedPlatforms": [] }, { "id": "d645385eba2b9566", "files": 432, "appFindings": 391, "vendoredFindings": 7, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "d7efced252953f1a", "files": 94, "appFindings": 29, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "d9e42d15addfc183", "files": 240, "appFindings": 223, "vendoredFindings": 9, "grade": "F", "score": 0, "detectedPlatforms": [ "cursor" ] }, { "id": "db364d4404547ddb", "files": 908, "appFindings": 412, "vendoredFindings": 7, "grade": "F", "score": 0, "detectedPlatforms": [ "bolt" ] }, { "id": "e1b8f39ae1e568b8", "files": 61, "appFindings": 18, "vendoredFindings": 0, "grade": "F", "score": 28, "detectedPlatforms": [] }, { "id": "e217df74edba1e30", "files": 142, "appFindings": 16, "vendoredFindings": 5, "grade": "C", "score": 72, "detectedPlatforms": [] }, { "id": "e80c5b7da53ab7fa", "files": 97, "appFindings": 100, "vendoredFindings": 5, "grade": "F", "score": 0, "detectedPlatforms": [] }, { "id": "ea74efab410123b4", "files": 33, "appFindings": 9, "vendoredFindings": 0, "grade": "C", "score": 79, "detectedPlatforms": [] }, { "id": "eef807edafbcb773", "files": 89, "appFindings": 21, "vendoredFindings": 5, "grade": "F", "score": 23, "detectedPlatforms": [] }, { "id": "f20a00119dd93c29", "files": 119, "appFindings": 21, "vendoredFindings": 5, "grade": "F", "score": 4, "detectedPlatforms": [] } ], "medianProjectFiles": 105 } ] }