{
 "title": "State of vibe-coded app security 2026",
 "publisher": "AppLedger (Contenta Software)",
 "url": "https://appledger.net/reports/vibe-coded-app-security-2026/",
 "license": "CC BY 4.0",
 "version": 2,
 "collected": "2026-10-14",
 "method": {
  "engine": "AppLedger 0.2.2, same code path as the hosted check (files a hosted check would upload, then Trivy + Opengrep, plus the secrets-file check from file names)",
  "trivy": "0.74.0, vulnerability database updated 2026-10-13",
  "opengrep": "1.30.2 with the semgrep-rules community snapshot of 2025-01-26",
  "security_only": "Scores, grades and levels in this file leave out Opengrep rules whose own metadata category is not 'security' (for example i18n and React style rules). *_engine_raw fields keep them.",
  "score": "Start at 100; each 'Fix before sharing' finding keeps 75%, each 'Fix soon' 93%, each 'Good to know' 99%. Grades: A 90+, B 75+, C 55+, D 30+, F below 30.",
  "secrets": "Exposed-secret findings come from pattern matching (Trivy secret rules, Opengrep generic secret rules) and from secrets-file names tracked by git (contents not read). Values were never printed, stored, used or validated. Some may be test or placeholder keys, or publishable keys meant for the browser."
 },
 "selection": {
  "lovable": "Public, non-fork GitHub repositories found with code search for 'lovable-tagger' in package.json or 'Welcome to your Lovable project' in README.md; marker verified at the repository root after cloning; pushed in 2026.",
  "claude": "Public, non-fork GitHub repositories with a CLAUDE.md at the root (code search on common build terms), an app manifest (package.json, requirements.txt, pyproject.toml, go.mod, ...) at the root or one level down, pushed in 2026, and no Lovable markers.",
  "excluded": "Forks, GitHub templates, archived repos, names/descriptions/topics suggesting templates, starters, tutorials, examples or agent/prompt tooling, repos over 50 MB, repos with fewer than 5 source files, and AppLedger's own repository.",
  "order": "Candidates were shuffled with a fixed seed and taken in order until 50 per builder were scanned.",
  "candidates_found": {
   "claude": 1842,
   "lovable": 485
  },
  "metadata_reviewed": {
   "lovable": 420,
   "claude": 260
  },
  "outcomes": {
   "lovable": {
    "fork/template/archived": 5,
    "not pushed in 2026": 101,
    "over 50 MB": 9,
    "scanned": 50,
    "template/tutorial/tooling by name": 1
   },
   "claude": {
    "marker not verified": 3,
    "not pushed in 2026": 4,
    "over 50 MB": 8,
    "scanned": 50,
    "template/tutorial/tooling by name": 4,
    "under 5 source files": 1
   }
  }
 },
 "summary": {
  "all": {
   "repos": 100,
   "median_score": 28.5,
   "median_score_engine_raw": 0.0,
   "grades": {
    "A": 6,
    "B": 8,
    "C": 10,
    "D": 25,
    "F": 51
   },
   "grades_engine_raw": {
    "A": 3,
    "B": 3,
    "C": 6,
    "D": 4,
    "F": 84
   },
   "with_fix_before_sharing": {
    "n": 72,
    "of": 100,
    "pct": 72.0
   },
   "with_fix_before_sharing_excluding_secrets_files": {
    "n": 59,
    "of": 100,
    "pct": 59.0
   },
   "with_fix_soon_or_worse": {
    "n": 96,
    "of": 100,
    "pct": 96.0
   },
   "with_no_findings": {
    "n": 2,
    "of": 100,
    "pct": 2.0
   },
   "with_exposed_secret_any": {
    "n": 46,
    "of": 100,
    "pct": 46.0
   },
   "with_secret_in_code": {
    "n": 18,
    "of": 100,
    "pct": 18.0
   },
   "with_secret_in_code_outside_example_test_docs": {
    "n": 17,
    "of": 100,
    "pct": 17.0
   },
   "with_secrets_file_in_git": {
    "n": 37,
    "of": 100,
    "pct": 37.0
   },
   "with_vulnerable_dependency": {
    "n": 91,
    "of": 100,
    "pct": 91.0
   },
   "with_critical_dependency": {
    "n": 46,
    "of": 100,
    "pct": 46.0
   },
   "with_high_or_critical_dependency": {
    "n": 91,
    "of": 100,
    "pct": 91.0
   },
   "with_code_security_pattern": {
    "n": 45,
    "of": 100,
    "pct": 45.0
   },
   "with_code_security_blocker": {
    "n": 5,
    "of": 100,
    "pct": 5.0
   },
   "with_fix_before_sharing_strict": {
    "n": 49,
    "of": 100,
    "pct": 49.0
   },
   "blocker_reasons": {
    "critical_dependency": {
     "n": 46,
     "of": 100,
     "pct": 46.0
    },
    "jwt_format_token": {
     "n": 16,
     "of": 100,
     "pct": 16.0
    },
    "publishable_key": {
     "n": 1,
     "of": 100,
     "pct": 1.0
    },
    "other_key_pattern": {
     "n": 1,
     "of": 100,
     "pct": 1.0
    },
    "secrets_file_in_git": {
     "n": 37,
     "of": 100,
     "pct": 37.0
    },
    "risky_code_pattern": {
     "n": 5,
     "of": 100,
     "pct": 5.0
    }
   },
   "with_secret_hint_jwt": {
    "n": 19,
    "of": 100,
    "pct": 19.0
   },
   "with_secret_hint_other": {
    "n": 31,
    "of": 100,
    "pct": 31.0
   },
   "with_any_secret_signal_other_than_jwt": {
    "n": 31,
    "of": 100,
    "pct": 31.0
   },
   "with_setup_issue": {
    "n": 17,
    "of": 100,
    "pct": 17.0
   },
   "median_vulnerable_packages": 13.0,
   "median_files_scanned": 135.5,
   "top_critical_packages": [
    {
     "package": "next",
     "repos": 16,
     "pct": 16.0
    },
    {
     "package": "proxy-addr",
     "repos": 14,
     "pct": 14.0
    },
    {
     "package": "websocket-driver",
     "repos": 8,
     "pct": 8.0
    },
    {
     "package": "protobufjs",
     "repos": 8,
     "pct": 8.0
    },
    {
     "package": "anyio",
     "repos": 7,
     "pct": 7.0
    },
    {
     "package": "pyjwt",
     "repos": 6,
     "pct": 6.0
    },
    {
     "package": "tar",
     "repos": 4,
     "pct": 4.0
    },
    {
     "package": "next-auth",
     "repos": 4,
     "pct": 4.0
    }
   ],
   "opengrep_secret_rule_ids": {
    "detected-jwt-token": 19,
    "jwt": 17,
    "detected-google-oauth-url": 2,
    "detected-generic-api-key": 5,
    "generic-api-key": 16,
    "detected-google-api-key": 5,
    "detected-google-cloud-api-key": 4,
    "gcp-api-key": 4,
    "hashicorp-tf-password": 11,
    "private-key": 2,
    "detected-bcrypt-hash": 4,
    "square-access-token": 1,
    "github-pat": 1
   },
   "top_vulnerable_packages": [
    {
     "package": "source-map-js",
     "repos": 61,
     "pct": 61.0
    },
    {
     "package": "nanoid",
     "repos": 57,
     "pct": 57.0
    },
    {
     "package": "postcss",
     "repos": 56,
     "pct": 56.0
    },
    {
     "package": "react-router",
     "repos": 53,
     "pct": 53.0
    },
    {
     "package": "lodash",
     "repos": 53,
     "pct": 53.0
    },
    {
     "package": "@remix-run/router",
     "repos": 48,
     "pct": 48.0
    },
    {
     "package": "postcss-selector-parser",
     "repos": 44,
     "pct": 44.0
    },
    {
     "package": "brace-expansion",
     "repos": 43,
     "pct": 43.0
    },
    {
     "package": "braces",
     "repos": 43,
     "pct": 43.0
    },
    {
     "package": "ws",
     "repos": 41,
     "pct": 41.0
    }
   ],
   "top_code_security_patterns": [
    {
     "pattern": "detect-non-literal-regexp",
     "repos": 15,
     "pct": 15.0
    },
    {
     "pattern": "Someone could read files on your server",
     "repos": 13,
     "pct": 13.0
    },
    {
     "pattern": "detect-non-literal-fs-filename",
     "repos": 11,
     "pct": 11.0
    },
    {
     "pattern": "react-dangerouslysetinnerhtml",
     "repos": 4,
     "pct": 4.0
    },
    {
     "pattern": "detect-redos",
     "repos": 3,
     "pct": 3.0
    },
    {
     "pattern": "Someone could run commands on your server",
     "repos": 3,
     "pct": 3.0
    },
    {
     "pattern": "wildcard-cors",
     "repos": 3,
     "pct": 3.0
    },
    {
     "pattern": "insecure-hash-algorithm-md5",
     "repos": 3,
     "pct": 3.0
    },
    {
     "pattern": "raw-html-format",
     "repos": 3,
     "pct": 3.0
    },
    {
     "pattern": "python-logger-credential-disclosure",
     "repos": 3,
     "pct": 3.0
    }
   ],
   "top_code_hints": [
    {
     "pattern": "html-in-template-string",
     "repos": 30
    },
    {
     "pattern": "unsafe-formatstring",
     "repos": 27
    },
    {
     "pattern": "unsafe-dynamic-method",
     "repos": 11
    },
    {
     "pattern": "insecure-document-method",
     "repos": 10
    },
    {
     "pattern": "insecure-innerhtml",
     "repos": 10
    },
    {
     "pattern": "detect-insecure-websocket",
     "repos": 6
    },
    {
     "pattern": "Someone could read or change your whole database",
     "repos": 6
    },
    {
     "pattern": "dynamic-urllib-use-detected",
     "repos": 6
    }
   ],
   "excluded_non_security_rules": [
    {
     "rule": "jsx-not-internationalized",
     "category": "portability",
     "repos": 75
    },
    {
     "rule": "react-props-spreading",
     "category": "best-practice",
     "repos": 65
    },
    {
     "rule": "dockerfile-source-not-pinned",
     "category": "best-practice",
     "repos": 19
    },
    {
     "rule": "useless-ternary",
     "category": "correctness",
     "repos": 13
    },
    {
     "rule": "react-props-in-state",
     "category": "best-practice",
     "repos": 12
    },
    {
     "rule": "prefer-json-notation",
     "category": "best-practice",
     "repos": 9
    },
    {
     "rule": "remove-package-cache",
     "category": "best-practice",
     "repos": 7
    },
    {
     "rule": "missing-image-version",
     "category": "best-practice",
     "repos": 7
    },
    {
     "rule": "i18next-key-format",
     "category": "portability",
     "repos": 6
    },
    {
     "rule": "use-raise-for-status",
     "category": "best-practice",
     "repos": 5
    }
   ],
   "secret_rule_ids": {
    "jwt-token": 28,
    "stripe-publishable-token": 1,
    "detected-github-token": 1
   },
   "secret_finding_context": {
    "other_file": 28,
    "example_test_or_docs_file": 2
   },
   "setup_ids": {
    "DS-0002": 13,
    "DS-0026": 14,
    "AWS-0040": 1,
    "AWS-0041": 1,
    "AWS-0104": 1,
    "KSV-0014": 2,
    "KSV-0118": 2,
    "KSV-01010": 2,
    "KSV-0003": 2,
    "KSV-0004": 2,
    "KSV-0011": 2,
    "KSV-0013": 2,
    "KSV-0015": 2,
    "KSV-0016": 2,
    "KSV-0018": 2,
    "KSV-0020": 2,
    "KSV-0021": 2,
    "KSV-0030": 2,
    "KSV-0104": 2,
    "KSV-0106": 2,
    "KSV-0125": 2,
    "KSV-0001": 2,
    "KSV-0012": 2,
    "AWS-0038": 1,
    "AWS-0133": 1,
    "AWS-0176": 1,
    "AWS-0177": 1,
    "AWS-0089": 1,
    "AWS-0017": 1,
    "AWS-0098": 1,
    "KSV-0041": 1,
    "DS-0029": 2,
    "KSV-0110": 1,
    "DS-0017": 1,
    "DS-0013": 1
   },
   "lovable_repos_with_claude_md": 0,
   "with_fix_before_sharing_current_rules": {
    "n": 68,
    "of": 100,
    "pct": 68.0,
    "note": "Repositories with at least one 'Fix before sharing' finding under AppLedger's rules from 0.2.4 on, where JWT-format tokens are 'Fix soon' (often public Supabase keys) and publishable keys are not reported."
   }
  },
  "lovable": {
   "repos": 50,
   "median_score": 32.0,
   "median_score_engine_raw": 0.0,
   "grades": {
    "A": 1,
    "B": 2,
    "C": 4,
    "D": 19,
    "F": 24
   },
   "grades_engine_raw": {
    "A": 0,
    "B": 0,
    "C": 0,
    "D": 1,
    "F": 49
   },
   "with_fix_before_sharing": {
    "n": 39,
    "of": 50,
    "pct": 78.0
   },
   "with_fix_before_sharing_excluding_secrets_files": {
    "n": 28,
    "of": 50,
    "pct": 56.0
   },
   "with_fix_soon_or_worse": {
    "n": 50,
    "of": 50,
    "pct": 100.0
   },
   "with_no_findings": {
    "n": 0,
    "of": 50,
    "pct": 0.0
   },
   "with_exposed_secret_any": {
    "n": 31,
    "of": 50,
    "pct": 62.0
   },
   "with_secret_in_code": {
    "n": 16,
    "of": 50,
    "pct": 32.0
   },
   "with_secret_in_code_outside_example_test_docs": {
    "n": 16,
    "of": 50,
    "pct": 32.0
   },
   "with_secrets_file_in_git": {
    "n": 23,
    "of": 50,
    "pct": 46.0
   },
   "with_vulnerable_dependency": {
    "n": 50,
    "of": 50,
    "pct": 100.0
   },
   "with_critical_dependency": {
    "n": 19,
    "of": 50,
    "pct": 38.0
   },
   "with_high_or_critical_dependency": {
    "n": 50,
    "of": 50,
    "pct": 100.0
   },
   "with_code_security_pattern": {
    "n": 11,
    "of": 50,
    "pct": 22.0
   },
   "with_code_security_blocker": {
    "n": 1,
    "of": 50,
    "pct": 2.0
   },
   "with_fix_before_sharing_strict": {
    "n": 19,
    "of": 50,
    "pct": 38.0
   },
   "blocker_reasons": {
    "critical_dependency": {
     "n": 19,
     "of": 50,
     "pct": 38.0
    },
    "jwt_format_token": {
     "n": 15,
     "of": 50,
     "pct": 30.0
    },
    "publishable_key": {
     "n": 1,
     "of": 50,
     "pct": 2.0
    },
    "other_key_pattern": {
     "n": 0,
     "of": 50,
     "pct": 0.0
    },
    "secrets_file_in_git": {
     "n": 23,
     "of": 50,
     "pct": 46.0
    },
    "risky_code_pattern": {
     "n": 1,
     "of": 50,
     "pct": 2.0
    }
   },
   "with_secret_hint_jwt": {
    "n": 17,
    "of": 50,
    "pct": 34.0
   },
   "with_secret_hint_other": {
    "n": 15,
    "of": 50,
    "pct": 30.0
   },
   "with_any_secret_signal_other_than_jwt": {
    "n": 15,
    "of": 50,
    "pct": 30.0
   },
   "with_setup_issue": {
    "n": 2,
    "of": 50,
    "pct": 4.0
   },
   "median_vulnerable_packages": 15.0,
   "median_files_scanned": 114.5,
   "top_critical_packages": [
    {
     "package": "websocket-driver",
     "repos": 7,
     "pct": 14.0
    },
    {
     "package": "protobufjs",
     "repos": 7,
     "pct": 14.0
    },
    {
     "package": "proxy-addr",
     "repos": 7,
     "pct": 14.0
    },
    {
     "package": "jspdf",
     "repos": 3,
     "pct": 6.0
    },
    {
     "package": "tar",
     "repos": 2,
     "pct": 4.0
    },
    {
     "package": "@capacitor/android",
     "repos": 1,
     "pct": 2.0
    },
    {
     "package": "@capacitor/ios",
     "repos": 1,
     "pct": 2.0
    },
    {
     "package": "shell-quote",
     "repos": 1,
     "pct": 2.0
    }
   ],
   "opengrep_secret_rule_ids": {
    "detected-jwt-token": 17,
    "jwt": 16,
    "detected-google-oauth-url": 1,
    "detected-generic-api-key": 4,
    "generic-api-key": 10,
    "detected-google-api-key": 4,
    "detected-google-cloud-api-key": 4,
    "gcp-api-key": 4,
    "hashicorp-tf-password": 3,
    "private-key": 1
   },
   "top_vulnerable_packages": [
    {
     "package": "react-router",
     "repos": 48,
     "pct": 96.0
    },
    {
     "package": "@remix-run/router",
     "repos": 46,
     "pct": 92.0
    },
    {
     "package": "lodash",
     "repos": 44,
     "pct": 88.0
    },
    {
     "package": "nanoid",
     "repos": 37,
     "pct": 74.0
    },
    {
     "package": "source-map-js",
     "repos": 37,
     "pct": 74.0
    },
    {
     "package": "postcss",
     "repos": 35,
     "pct": 70.0
    },
    {
     "package": "postcss-selector-parser",
     "repos": 34,
     "pct": 68.0
    },
    {
     "package": "braces",
     "repos": 34,
     "pct": 68.0
    },
    {
     "package": "picomatch",
     "repos": 32,
     "pct": 64.0
    },
    {
     "package": "brace-expansion",
     "repos": 32,
     "pct": 64.0
    }
   ],
   "top_code_security_patterns": [
    {
     "pattern": "detect-non-literal-regexp",
     "repos": 5,
     "pct": 10.0
    },
    {
     "pattern": "Someone could read files on your server",
     "repos": 2,
     "pct": 4.0
    },
    {
     "pattern": "detect-non-literal-fs-filename",
     "repos": 2,
     "pct": 4.0
    },
    {
     "pattern": "wildcard-cors",
     "repos": 2,
     "pct": 4.0
    },
    {
     "pattern": "js-open-redirect",
     "repos": 1,
     "pct": 2.0
    },
    {
     "pattern": "detect-redos",
     "repos": 1,
     "pct": 2.0
    },
    {
     "pattern": "Someone could run commands on your server",
     "repos": 1,
     "pct": 2.0
    },
    {
     "pattern": "detect-non-literal-require",
     "repos": 1,
     "pct": 2.0
    },
    {
     "pattern": "react-dangerouslysetinnerhtml",
     "repos": 1,
     "pct": 2.0
    }
   ],
   "top_code_hints": [
    {
     "pattern": "unsafe-formatstring",
     "repos": 13
    },
    {
     "pattern": "html-in-template-string",
     "repos": 12
    },
    {
     "pattern": "unsafe-dynamic-method",
     "repos": 4
    },
    {
     "pattern": "insecure-document-method",
     "repos": 3
    },
    {
     "pattern": "insecure-innerhtml",
     "repos": 3
    },
    {
     "pattern": "secret-in-build-arg",
     "repos": 2
    },
    {
     "pattern": "incomplete-sanitization",
     "repos": 2
    },
    {
     "pattern": "spawn-shell-true",
     "repos": 1
    }
   ],
   "excluded_non_security_rules": [
    {
     "rule": "jsx-not-internationalized",
     "category": "portability",
     "repos": 49
    },
    {
     "rule": "react-props-spreading",
     "category": "best-practice",
     "repos": 47
    },
    {
     "rule": "useless-ternary",
     "category": "correctness",
     "repos": 7
    },
    {
     "rule": "react-props-in-state",
     "category": "best-practice",
     "repos": 5
    },
    {
     "rule": "i18next-key-format",
     "category": "portability",
     "repos": 4
    },
    {
     "rule": "dockerfile-source-not-pinned",
     "category": "best-practice",
     "repos": 2
    },
    {
     "rule": "jsx-label-not-i18n",
     "category": "portability",
     "repos": 1
    },
    {
     "rule": "prefer-json-notation",
     "category": "best-practice",
     "repos": 1
    }
   ],
   "secret_rule_ids": {
    "jwt-token": 27,
    "stripe-publishable-token": 1
   },
   "secret_finding_context": {
    "other_file": 27,
    "example_test_or_docs_file": 1
   },
   "setup_ids": {
    "DS-0002": 2,
    "DS-0026": 1
   },
   "lovable_repos_with_claude_md": 0,
   "with_fix_before_sharing_current_rules": {
    "n": 35,
    "of": 50,
    "pct": 70.0,
    "note": "Repositories with at least one 'Fix before sharing' finding under AppLedger's rules from 0.2.4 on, where JWT-format tokens are 'Fix soon' (often public Supabase keys) and publishable keys are not reported."
   }
  },
  "claude": {
   "repos": 50,
   "median_score": 27.0,
   "median_score_engine_raw": 5.0,
   "grades": {
    "A": 5,
    "B": 6,
    "C": 6,
    "D": 6,
    "F": 27
   },
   "grades_engine_raw": {
    "A": 3,
    "B": 3,
    "C": 6,
    "D": 3,
    "F": 35
   },
   "with_fix_before_sharing": {
    "n": 33,
    "of": 50,
    "pct": 66.0
   },
   "with_fix_before_sharing_excluding_secrets_files": {
    "n": 31,
    "of": 50,
    "pct": 62.0
   },
   "with_fix_soon_or_worse": {
    "n": 46,
    "of": 50,
    "pct": 92.0
   },
   "with_no_findings": {
    "n": 2,
    "of": 50,
    "pct": 4.0
   },
   "with_exposed_secret_any": {
    "n": 15,
    "of": 50,
    "pct": 30.0
   },
   "with_secret_in_code": {
    "n": 2,
    "of": 50,
    "pct": 4.0
   },
   "with_secret_in_code_outside_example_test_docs": {
    "n": 1,
    "of": 50,
    "pct": 2.0
   },
   "with_secrets_file_in_git": {
    "n": 14,
    "of": 50,
    "pct": 28.0
   },
   "with_vulnerable_dependency": {
    "n": 41,
    "of": 50,
    "pct": 82.0
   },
   "with_critical_dependency": {
    "n": 27,
    "of": 50,
    "pct": 54.0
   },
   "with_high_or_critical_dependency": {
    "n": 41,
    "of": 50,
    "pct": 82.0
   },
   "with_code_security_pattern": {
    "n": 34,
    "of": 50,
    "pct": 68.0
   },
   "with_code_security_blocker": {
    "n": 4,
    "of": 50,
    "pct": 8.0
   },
   "with_fix_before_sharing_strict": {
    "n": 30,
    "of": 50,
    "pct": 60.0
   },
   "blocker_reasons": {
    "critical_dependency": {
     "n": 27,
     "of": 50,
     "pct": 54.0
    },
    "jwt_format_token": {
     "n": 1,
     "of": 50,
     "pct": 2.0
    },
    "publishable_key": {
     "n": 0,
     "of": 50,
     "pct": 0.0
    },
    "other_key_pattern": {
     "n": 1,
     "of": 50,
     "pct": 2.0
    },
    "secrets_file_in_git": {
     "n": 14,
     "of": 50,
     "pct": 28.0
    },
    "risky_code_pattern": {
     "n": 4,
     "of": 50,
     "pct": 8.0
    }
   },
   "with_secret_hint_jwt": {
    "n": 2,
    "of": 50,
    "pct": 4.0
   },
   "with_secret_hint_other": {
    "n": 16,
    "of": 50,
    "pct": 32.0
   },
   "with_any_secret_signal_other_than_jwt": {
    "n": 16,
    "of": 50,
    "pct": 32.0
   },
   "with_setup_issue": {
    "n": 15,
    "of": 50,
    "pct": 30.0
   },
   "median_vulnerable_packages": 9.5,
   "median_files_scanned": 174.5,
   "top_critical_packages": [
    {
     "package": "next",
     "repos": 16,
     "pct": 32.0
    },
    {
     "package": "proxy-addr",
     "repos": 7,
     "pct": 14.0
    },
    {
     "package": "anyio",
     "repos": 7,
     "pct": 14.0
    },
    {
     "package": "pyjwt",
     "repos": 5,
     "pct": 10.0
    },
    {
     "package": "next-auth",
     "repos": 4,
     "pct": 8.0
    },
    {
     "package": "fast-xml-parser",
     "repos": 3,
     "pct": 6.0
    },
    {
     "package": "seroval",
     "repos": 2,
     "pct": 4.0
    },
    {
     "package": "shell-quote",
     "repos": 2,
     "pct": 4.0
    }
   ],
   "opengrep_secret_rule_ids": {
    "hashicorp-tf-password": 8,
    "detected-bcrypt-hash": 4,
    "generic-api-key": 6,
    "detected-generic-api-key": 1,
    "private-key": 1,
    "detected-jwt-token": 2,
    "square-access-token": 1,
    "jwt": 1,
    "github-pat": 1,
    "detected-google-api-key": 1,
    "detected-google-oauth-url": 1
   },
   "top_vulnerable_packages": [
    {
     "package": "source-map-js",
     "repos": 24,
     "pct": 48.0
    },
    {
     "package": "postcss",
     "repos": 21,
     "pct": 42.0
    },
    {
     "package": "nanoid",
     "repos": 20,
     "pct": 40.0
    },
    {
     "package": "next",
     "repos": 16,
     "pct": 32.0
    },
    {
     "package": "sharp",
     "repos": 15,
     "pct": 30.0
    },
    {
     "package": "baseline-browser-mapping",
     "repos": 13,
     "pct": 26.0
    },
    {
     "package": "brace-expansion",
     "repos": 11,
     "pct": 22.0
    },
    {
     "package": "browserslist",
     "repos": 11,
     "pct": 22.0
    },
    {
     "package": "postcss-selector-parser",
     "repos": 10,
     "pct": 20.0
    },
    {
     "package": "uuid",
     "repos": 10,
     "pct": 20.0
    }
   ],
   "top_code_security_patterns": [
    {
     "pattern": "Someone could read files on your server",
     "repos": 11,
     "pct": 22.0
    },
    {
     "pattern": "detect-non-literal-regexp",
     "repos": 10,
     "pct": 20.0
    },
    {
     "pattern": "detect-non-literal-fs-filename",
     "repos": 9,
     "pct": 18.0
    },
    {
     "pattern": "insecure-hash-algorithm-md5",
     "repos": 3,
     "pct": 6.0
    },
    {
     "pattern": "raw-html-format",
     "repos": 3,
     "pct": 6.0
    },
    {
     "pattern": "react-dangerouslysetinnerhtml",
     "repos": 3,
     "pct": 6.0
    },
    {
     "pattern": "python-logger-credential-disclosure",
     "repos": 3,
     "pct": 6.0
    },
    {
     "pattern": "cookie-missing-secure",
     "repos": 2,
     "pct": 4.0
    },
    {
     "pattern": "use-tls",
     "repos": 2,
     "pct": 4.0
    },
    {
     "pattern": "js-open-redirect-from-function",
     "repos": 2,
     "pct": 4.0
    }
   ],
   "top_code_hints": [
    {
     "pattern": "html-in-template-string",
     "repos": 18
    },
    {
     "pattern": "unsafe-formatstring",
     "repos": 14
    },
    {
     "pattern": "unsafe-dynamic-method",
     "repos": 7
    },
    {
     "pattern": "insecure-document-method",
     "repos": 7
    },
    {
     "pattern": "insecure-innerhtml",
     "repos": 7
    },
    {
     "pattern": "detect-insecure-websocket",
     "repos": 6
    },
    {
     "pattern": "Someone could read or change your whole database",
     "repos": 6
    },
    {
     "pattern": "react-href-var",
     "repos": 5
    }
   ],
   "excluded_non_security_rules": [
    {
     "rule": "jsx-not-internationalized",
     "category": "portability",
     "repos": 26
    },
    {
     "rule": "react-props-spreading",
     "category": "best-practice",
     "repos": 18
    },
    {
     "rule": "dockerfile-source-not-pinned",
     "category": "best-practice",
     "repos": 17
    },
    {
     "rule": "prefer-json-notation",
     "category": "best-practice",
     "repos": 8
    },
    {
     "rule": "remove-package-cache",
     "category": "best-practice",
     "repos": 7
    },
    {
     "rule": "react-props-in-state",
     "category": "best-practice",
     "repos": 7
    },
    {
     "rule": "missing-image-version",
     "category": "best-practice",
     "repos": 7
    },
    {
     "rule": "useless-ternary",
     "category": "correctness",
     "repos": 6
    },
    {
     "rule": "use-raise-for-status",
     "category": "best-practice",
     "repos": 5
    },
    {
     "rule": "missing-no-install-recommends",
     "category": "best-practice",
     "repos": 2
    }
   ],
   "secret_rule_ids": {
    "jwt-token": 1,
    "detected-github-token": 1
   },
   "secret_finding_context": {
    "other_file": 1,
    "example_test_or_docs_file": 1
   },
   "setup_ids": {
    "AWS-0040": 1,
    "AWS-0041": 1,
    "AWS-0104": 1,
    "DS-0002": 11,
    "KSV-0014": 2,
    "KSV-0118": 2,
    "KSV-01010": 2,
    "KSV-0003": 2,
    "KSV-0004": 2,
    "KSV-0011": 2,
    "KSV-0013": 2,
    "KSV-0015": 2,
    "KSV-0016": 2,
    "KSV-0018": 2,
    "KSV-0020": 2,
    "KSV-0021": 2,
    "KSV-0030": 2,
    "KSV-0104": 2,
    "KSV-0106": 2,
    "KSV-0125": 2,
    "KSV-0001": 2,
    "KSV-0012": 2,
    "AWS-0038": 1,
    "AWS-0133": 1,
    "AWS-0176": 1,
    "AWS-0177": 1,
    "AWS-0089": 1,
    "AWS-0017": 1,
    "AWS-0098": 1,
    "KSV-0041": 1,
    "DS-0029": 2,
    "DS-0026": 13,
    "KSV-0110": 1,
    "DS-0017": 1,
    "DS-0013": 1
   },
   "lovable_repos_with_claude_md": 0,
   "with_fix_before_sharing_current_rules": {
    "n": 33,
    "of": 50,
    "pct": 66.0,
    "note": "Repositories with at least one 'Fix before sharing' finding under AppLedger's rules from 0.2.4 on, where JWT-format tokens are 'Fix soon' (often public Supabase keys) and publishable keys are not reported."
   }
  }
 },
 "repos_anonymous": [
  {
   "builder": "lovable",
   "score": 18,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "jwt_format_token"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_in_code"
   ]
  },
  {
   "builder": "claude",
   "score": 35,
   "grade": "D",
   "score_engine_raw": 34,
   "grade_engine_raw": "D",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 47,
   "grade": "D",
   "score_engine_raw": 12,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 26,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 76,
   "grade": "B",
   "score_engine_raw": 76,
   "grade_engine_raw": "B",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 1,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 72,
   "grade": "C",
   "score_engine_raw": 58,
   "grade_engine_raw": "C",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 100,
   "grade": "A",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": []
  },
  {
   "builder": "claude",
   "score": 21,
   "grade": "F",
   "score_engine_raw": 21,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "risky_code_pattern"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 11,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 29,
   "grade": "F",
   "score_engine_raw": 28,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "risky_code_pattern"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 34,
   "grade": "D",
   "score_engine_raw": 34,
   "grade_engine_raw": "D",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 17,
   "grade": "F",
   "score_engine_raw": 1,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 6,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 35,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 60,
   "grade": "C",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 9,
   "grade": "F",
   "score_engine_raw": 9,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 1,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "jwt_format_token",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "secret_in_code"
   ]
  },
  {
   "builder": "lovable",
   "score": 84,
   "grade": "B",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 17,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 14,
   "grade": "F",
   "score_engine_raw": 1,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 22,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important"
   ]
  },
  {
   "builder": "lovable",
   "score": 19,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "jwt_format_token",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "secret_in_code"
   ]
  },
  {
   "builder": "lovable",
   "score": 15,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "jwt_format_token",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "secret_in_code"
   ]
  },
  {
   "builder": "claude",
   "score": 100,
   "grade": "A",
   "score_engine_raw": 100,
   "grade_engine_raw": "A",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": []
  },
  {
   "builder": "lovable",
   "score": 46,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 86,
   "grade": "B",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 93,
   "grade": "A",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security"
   ]
  },
  {
   "builder": "claude",
   "score": 10,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 23,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 34,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "publishable_key",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "secret_in_code"
   ]
  },
  {
   "builder": "lovable",
   "score": 57,
   "grade": "C",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "jwt_format_token"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_in_code"
   ]
  },
  {
   "builder": "claude",
   "score": 18,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 19,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 2,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "jwt_format_token"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_in_code"
   ]
  },
  {
   "builder": "lovable",
   "score": 28,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 79,
   "grade": "B",
   "score_engine_raw": 59,
   "grade_engine_raw": "C",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint"
   ]
  },
  {
   "builder": "claude",
   "score": 8,
   "grade": "F",
   "score_engine_raw": 8,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 40,
   "grade": "D",
   "score_engine_raw": 24,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 40,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 97,
   "grade": "A",
   "score_engine_raw": 97,
   "grade_engine_raw": "A",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security_hint"
   ]
  },
  {
   "builder": "lovable",
   "score": 39,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 35,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 35,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 22,
   "grade": "F",
   "score_engine_raw": 18,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 88,
   "grade": "B",
   "score_engine_raw": 88,
   "grade_engine_raw": "B",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 46,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 13,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 2,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "setup"
   ]
  },
  {
   "builder": "lovable",
   "score": 43,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 24,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "jwt_format_token",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "secret_in_code",
    "setup"
   ]
  },
  {
   "builder": "lovable",
   "score": 17,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "jwt_format_token",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "secret_in_code"
   ]
  },
  {
   "builder": "lovable",
   "score": 47,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 23,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "jwt_format_token"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_in_code"
   ]
  },
  {
   "builder": "claude",
   "score": 5,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "jwt_format_token",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "secret_in_code",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 6,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 79,
   "grade": "B",
   "score_engine_raw": 67,
   "grade_engine_raw": "C",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint",
    "setup"
   ]
  },
  {
   "builder": "lovable",
   "score": 33,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "jwt_format_token",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "secret_in_code"
   ]
  },
  {
   "builder": "claude",
   "score": 84,
   "grade": "B",
   "score_engine_raw": 64,
   "grade_engine_raw": "C",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security_hint",
    "outdated_important",
    "setup"
   ]
  },
  {
   "builder": "lovable",
   "score": 19,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 82,
   "grade": "B",
   "score_engine_raw": 82,
   "grade_engine_raw": "B",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint"
   ]
  },
  {
   "builder": "claude",
   "score": 68,
   "grade": "C",
   "score_engine_raw": 68,
   "grade_engine_raw": "C",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 1,
   "grade": "F",
   "score_engine_raw": 1,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 97,
   "grade": "A",
   "score_engine_raw": 97,
   "grade_engine_raw": "A",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security_hint"
   ]
  },
  {
   "builder": "claude",
   "score": 70,
   "grade": "C",
   "score_engine_raw": 15,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 28,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "other_key_pattern"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_in_code"
   ]
  },
  {
   "builder": "claude",
   "score": 30,
   "grade": "D",
   "score_engine_raw": 30,
   "grade_engine_raw": "D",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 54,
   "grade": "D",
   "score_engine_raw": 49,
   "grade_engine_raw": "D",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 6,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "risky_code_pattern"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 54,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "jwt_format_token"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_in_code"
   ]
  },
  {
   "builder": "claude",
   "score": 65,
   "grade": "C",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "claude",
   "score": 23,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 35,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 92,
   "grade": "A",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 8,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "jwt_format_token",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "secret_in_code"
   ]
  },
  {
   "builder": "lovable",
   "score": 23,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 46,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 60,
   "grade": "C",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 69,
   "grade": "C",
   "score_engine_raw": 69,
   "grade_engine_raw": "C",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint"
   ]
  },
  {
   "builder": "claude",
   "score": 0,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git",
    "risky_code_pattern"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "setup"
   ]
  },
  {
   "builder": "lovable",
   "score": 19,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 60,
   "grade": "C",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 26,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 63,
   "grade": "C",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 49,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "outdated_blocker",
    "outdated_important"
   ]
  },
  {
   "builder": "claude",
   "score": 13,
   "grade": "F",
   "score_engine_raw": 1,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 8,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 7,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "jwt_format_token"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_in_code"
   ]
  },
  {
   "builder": "lovable",
   "score": 19,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "lovable",
   "score": 28,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 37,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 40,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "setup"
   ]
  },
  {
   "builder": "lovable",
   "score": 18,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 13,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git",
    "risky_code_pattern"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked"
   ]
  },
  {
   "builder": "claude",
   "score": 21,
   "grade": "F",
   "score_engine_raw": 21,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": false,
   "blocker_reasons": [],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor"
   ]
  },
  {
   "builder": "lovable",
   "score": 31,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "jwt_format_token"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_important",
    "outdated_minor",
    "secret_in_code"
   ]
  },
  {
   "builder": "claude",
   "score": 21,
   "grade": "F",
   "score_engine_raw": 19,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 2,
   "grade": "F",
   "score_engine_raw": 2,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "secrets_file_in_git"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_file_tracked",
    "setup"
   ]
  },
  {
   "builder": "claude",
   "score": 45,
   "grade": "D",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "setup"
   ]
  },
  {
   "builder": "lovable",
   "score": 1,
   "grade": "F",
   "score_engine_raw": 0,
   "grade_engine_raw": "F",
   "has_fix_before_sharing": true,
   "blocker_reasons": [
    "critical_dependency",
    "jwt_format_token"
   ],
   "has": [
    "code_security",
    "code_security_hint",
    "outdated_blocker",
    "outdated_important",
    "outdated_minor",
    "secret_in_code"
   ]
  }
 ],
 "repos_anonymous_note": "One row per scanned repository, in random order, without names or exact finding counts. 'has' lists the finding categories present; outdated_* are vulnerable packages by level (blocker = critical, important = high, minor = medium/low)."
}