Health — ccantynz/Gluecron.com

Code Issues Pull Requests Actions Security InsightsSettings

69/100

Health score

Insights

1 critical security issue found — immediate action recommended

Strong test suite with 453 test files (Good (50-80%))

31 dependencies scored for hygiene only — no advisory feed was consulted here, so this score is not a vulnerability check. See Security advisories for the OSV cross-check

Very active project — strong development momentum

How to improve this score69 → 95 possible

Gains are computed from the same formula that produced the score — completing everything below is worth 26 points.

+7.5

1. Fix no-eval: Use of eval() — potential code injectionsecurity

3 occurrences in 3 files (src/lib/hosted-claude-loop.ts, src/lib/intelligence.ts, src/lib/workflow-conditionals.ts)

Fix it yourself

Change: Fix no-eval: Use of eval() — potential code injection (no-eval)

3 occurrences in 3 files (src/lib/hosted-claude-loop.ts, src/lib/intelligence.ts, src/lib/workflow-conditionals.ts)

Where — Use of eval() — potential code injection:

src/lib/hosted-claude-loop.ts:15
src/lib/intelligence.ts:469
src/lib/workflow-conditionals.ts:6

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+6.3

2. Fix no-hardcoded-secrets: Hardcoded credential used as a fallback when the environment variable is unsetsecurity

1 occurrence in 1 file (src/lib/intelligence.ts)

Fix it yourself

Change: Fix no-hardcoded-secrets: Hardcoded credential used as a fallback when the environment variable is unset (no-hardcoded-secrets)

1 occurrence in 1 file (src/lib/intelligence.ts)

Where — Hardcoded credential used as a fallback when the environment variable is unset:

src/lib/intelligence.ts:454

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

3. Fix no-inner-html: Direct innerHTML assignment — potential XSSsecurity

10 occurrences in 5 files (src/lib/intelligence.ts, src/lib/markdown-preview.ts, src/routes/connect-claude.tsx, …)

Fix it yourself

Change: Fix no-inner-html: Direct innerHTML assignment — potential XSS (no-inner-html)

10 occurrences in 5 files (src/lib/intelligence.ts, src/lib/markdown-preview.ts, src/routes/connect-claude.tsx, …)

Where — Direct innerHTML assignment — potential XSS:

src/lib/intelligence.ts:650, 655, 680, 814
src/lib/markdown-preview.ts:53, 54
src/routes/connect-claude.tsx:738
src/routes/debt-map.tsx:1120, 1228
src/routes/demo.tsx:176

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

4. Add ~272 test files to reach a 80% test-to-source ratiotesting

453 test files today against ~906 source files (Good (50-80%))

Fix it yourself

Change: Add ~272 test files to reach a 80% test-to-source ratio

453 test files today against ~906 source files (Good (50-80%))

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+1.5

5. Split the largest files to bring average size under 10,000 bytescomplexity

Average is 14,148 bytes across 1101 files; start with pulls.tsx, web.tsx, schema.ts

Fix it yourself

Change: Split the largest files to bring average size under 10,000 bytes

Average is 14,148 bytes across 1101 files; start with pulls.tsx, web.tsx, schema.ts

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

+1.5

6. Add CONTRIBUTING.mddocumentation

Tells collaborators how to work on the repo

Fix it yourself

Change: Add CONTRIBUTING.md

Tells collaborators how to work on the repo

Make the change on a branch, push it, and open a pull request — the health score recomputes on the next visit.

Security25

6 of 25 possible overall points (weight 25%)

37 findings across 6 rules

1 critical · 3 high · 10 medium

Testing75

15 of 20 possible overall points (weight 20%)

453 test files

Coverage estimate: Good (50-80%)

Complexity60

9 of 15 possible overall points (weight 15%)

1101 source files

Avg file size: 14,148 bytes

Largest: pulls.tsx (305,619 bytes)

Dependencies100

15 of 15 possible overall points (weight 15%)

31 dependencies (package.json, mobile/package.json, vscode-extension/package.json, editor-extensions/vscode/package.json)

Lockfile present

Documentation85

9 of 10 possible overall points (weight 10%)

README found

License present

75 doc files

Activity100

15 of 15 possible overall points (weight 15%)

322 commits (30d)

12 contributors

Last push: 0d ago

Security findings37 findings · 6 distinct rules

critical

Hardcoded credential used as a fallback when the environment variable is unset — 1 occurrence in 1 file

no-hardcoded-secrets · intelligence.ts (1)

details

src/lib/intelligence.ts — line 454

high

Use of eval() — potential code injection — 3 occurrences in 3 files

no-eval · hosted-claude-loop.ts (1), intelligence.ts (1), workflow-conditionals.ts (1)

details

src/lib/hosted-claude-loop.ts — line 15

src/lib/intelligence.ts — line 469

src/lib/workflow-conditionals.ts — line 6

medium

Direct innerHTML assignment — potential XSS — 10 occurrences in 5 files

no-inner-html · intelligence.ts (4), markdown-preview.ts (2), debt-map.tsx (2), +2 more

details

src/lib/intelligence.ts — lines 650, 655, 680, 814

src/lib/markdown-preview.ts — lines 53, 54

src/routes/debt-map.tsx — lines 1120, 1228

src/routes/connect-claude.tsx — line 738

src/routes/demo.tsx — line 176

low

Security linter rule disabled — 10 occurrences in 10 files

no-security-disable · self-host-bootstrap.ts (1), cloud-deploy.ts (1), intelligence.ts (1), +7 more

details

scripts/self-host-bootstrap.ts — line 43

src/lib/cloud-deploy.ts — line 577

src/lib/intelligence.ts — line 481

src/lib/post-deploy-smoke.ts — line 15

src/lib/ssh-server.ts — line 33

src/lib/systemd-notify.ts — line 47

src/routes/admin-advancement.tsx — line 26

src/routes/admin-self-host.tsx — line 26

src/routes/admin-status.tsx — line 25

src/routes/audit.tsx — line 20

low

SHA1 hash — consider SHA-256+ — 3 occurrences in 2 files

weak-hash · source-index.ts (2), ai-patch-generator.ts (1)

details

src/lib/selfcheck/source-index.ts — lines 264, 304

src/lib/ai-patch-generator.ts — line 181

info

Security-related TODO found — 10 occurrences in 5 files

security-todo · ai-auto-issues.ts (4), debt-analyzer.ts (3), post-receive.ts (1), +2 more

details

src/lib/ai-auto-issues.ts — lines 10, 35, 329, 384

src/lib/debt-analyzer.ts — lines 82, 84, 295

src/hooks/post-receive.ts — line 372

src/lib/intelligence.ts — line 480

src/routes/automation-settings.tsx — line 302

Zero-config CIAuto-detected · Bun project detected · TypeScript detected · Hono framework

Type check

bun tsc --noEmit

Test

bun test

Type check

bun run typecheck