AI Assessment
VERDICT
The repository is production-ready from a security perspective but has moderate code quality issues that should be addressed before major releases. Scanner reports zero security, secrets, or dependency vulnerabilities.
TOP RISKS
→ Ten instances of 145-line duplicated code blocks flagged across src/lib/parsers/android/aab-parser.js, specs/002-sort-by-size/checklists/requirements.md, and sample-files/README.md. This reduces maintainability and increases bug-fix complexity.
→ High cyclomatic complexity (CCN 35) flagged in src/lib/parsers/common/types.js:16 and src/lib/parsers/android/proto/resources-proto.js:259. The scanner detected this pattern 15 times across multiple parser files, suggesting the detectContentType function or similar logic branches extensively.
→ No CI/CD pipeline, SECURITY.md policy file, or CODEOWNERS configuration detected. These governance gaps increase operational risk despite code quality being acceptable.
WHAT TO FIX FIRST
Refactor the detectContentType function in src/lib/parsers/common/types.js to reduce CCN 35 down to acceptable levels (target: <10). This single finding appears 15 times across the codebase and directly impacts testability and maintainability.
RECOMMENDATION
Verify the HIGH duplicated code findings against actual file content—README files sometimes trigger false positives. The medium-severity complexity issues are real and worth addressing through function decomposition. Add missing governance files (CI/CD workflow, SECURITY.md, CODEOWNERS) to complete the production readiness profile.
Category Breakdown
Findings(56 in 5 groups)
Duplicate found between sample-files/README.md:3 and public/sample-files/README.md:3. Consider extracting shared logic into a reusable function or module.
Affected files
Function "detectContentType ( path )" has a cyclomatic complexity of 35 (77 lines, 1 parameters). This function is very complex. Consider breaking it into smaller, more focused functions.
Affected files
and 10 more files...
No CI/CD configuration was found (GitHub Actions, GitLab CI, CircleCI, etc.). Continuous integration helps catch issues before they reach production.
Affected files
This repository has no SECURITY.md file. A security policy helps users report vulnerabilities responsibly and shows that the project takes security seriously.
Affected files
This repository has no CODEOWNERS file. CODEOWNERS ensures that pull requests are automatically assigned to the right reviewers, improving code review coverage.
Affected files
Share your ShipScanner
Show the world your code quality. Your report has a beautiful preview image built in.
Embed Trust Badge
Show your code quality score in your README. The badge updates automatically every time you re-scan.
[](https://shipscanner.dev/report/cmmxgt7760003js046flgtuoq)