Sonar aggregate coverage
84.8%
The combined percentage of executable lines and decision conditions exercised by tests in the coverage report imported into SonarQube.
Scanner-reported aggregate
SleepEdit Security and Quality Evidence
Detailed scan results. Missing measurements remain visible.
Measured baseline
Coverage
Sonar's retained percentage reflects the coverage report supplied to that analysis. It is not presented as coverage of every source language.
Sonar line coverage
86.8%
The percentage of executable source lines run by tests in the coverage report imported into SonarQube.
Scanner-reported lines
Sonar branch coverage
80%
The percentage of decision outcomes, such as both true and false paths, exercised by tests in the coverage report imported into SonarQube.
Scanner-reported branches
OpenCover C# coverage
77.7%
C# test coverage measured by OpenCover. The large value is line coverage; branch coverage appears in the supporting detail.
Newest retained OpenCover report; branch coverage 69.75%
JavaScript and TypeScript coverage
95.47%
JavaScript and TypeScript test coverage measured from the verified first-party LCOV report. The large value is line coverage.
Verified first-party LCOV; branch coverage 85.19%
SonarQube measures
Quality and security
Security rating
A · 1.0
Reflects the most severe open vulnerability: a potentially exploitable weakness in the application code.
Sonar scale: lower is better (1 best, 5 worst)
Reliability rating
A · 1.0
Reflects the most severe open bug: a finding that may cause incorrect behavior, crashes, or data loss.
Sonar scale: lower is better (1 best, 5 worst)
Maintainability rating
A · 1.0
Reflects estimated effort to fix maintainability issues relative to code size; it is not a count of code smells.
Sonar scale: lower is better (1 best, 5 worst)
Vulnerabilities
0
Open findings that SonarQube identifies as potentially exploitable weaknesses in the application code.
Security hotspots
0
Security-sensitive code that requires human review. A hotspot is not automatically a confirmed vulnerability.
100% reviewed
Bugs
0
Open reliability findings that may cause incorrect behavior, crashes, or data corruption.
Code smells
42
Open maintainability findings that make code harder to understand, change, or test but are not necessarily functional defects.
Average cyclomatic complexity
2.08
Average number of linearly independent execution paths per function. Lower values generally mean smaller methods that are easier to test and maintain.
4,547 total across 2,188 functions
Average cognitive complexity
1.14
Average score for how difficult each function's control flow is to understand. Nesting and breaks in linear flow increase the score; lower values are easier to follow and maintain.
2,500 total across 2,188 functions
Duplicated lines
0%
The percentage of analyzed source lines that SonarQube identifies as duplicated code.
Lines of code
23746
The number of analyzed non-comment source lines reported by SonarQube.
System context
Architecture and trust boundaries
These diagrams document the intended system design and provide context for the security results. They are not scanner measurements.
Legacy browser privacy and AI data flow
Historical snapshot retained for comparison; it predates the in-process de-identification integration.
Open full-size diagram
Administration, protocol, persistence, and deployment
Shows administrative traffic, hosting and application boundaries, persistent storage, secret injection, logging, and the Vosk software-supply path.
Open full-size diagram42 open findings
Issue distribution
By severity
| Severity | Count |
|---|---|
| MAJOR | 8 |
| MINOR | 16 |
| INFO | 18 |
By type
| Type | Count |
|---|---|
| CODE_SMELL | 42 |
By language
| Language | Count |
|---|---|
| C# | 17 |
| Docker | 1 |
| external_roslyn | 18 |
| JavaScript | 6 |
0 retained hotspots
Security hotspots
No matching findings.
No security hotspots were exported.
Retained audits
Dependencies and tests
NuGet vulnerabilities
- Total
- 0
- Critical
- 0
- High
- 0
- Moderate
- 0
- Low
- 0
npm vulnerabilities
- Total
- 0
- Critical
- 0
- High
- 0
- Moderate
- 0
- Low
- 0
.NET tests
- Total
- 8
- Passed
- 8
- Failed
- 0
- Skipped
- 0
First-party automated test source
The physical nonblank source lines in explicitly scoped first-party automated tests. It indicates test investment, not a quality score.
- Nonblank source lines
- 20,084
- Test source files
- 122
| Test area | Files | Nonblank lines |
|---|---|---|
| .NET test project and harness | 69 | 12,972 |
| Browser unit and boundary tests | 21 | 4,110 |
| End-to-end browser tests and fixtures | 23 | 2,374 |
| Security-report and verification tests | 9 | 628 |
Source-level evidence
Detailed SonarQube issues
| File | Line | Severity | Type | Language | Rule | Status | Message |
|---|---|---|---|---|---|---|---|
SleepEdit.Shared/wwwroot/js/sleep-note/medication-tool.js | 228 | MAJOR | CODE_SMELL | JavaScript | javascript:S7721 | OPEN | Move function 'describeMatchCount' to the outer scope. |
Dockerfile | 52 | MINOR | CODE_SMELL | Docker | docker:S7020 | OPEN | Line is too long. Split it into multiple lines using backslash continuations. |
SleepEdit.Desktop/WindowsTitleBar.cs | 40 | INFO | CODE_SMELL | external_roslyn | external_roslyn:SYSLIB1054 | OPEN | Mark the method 'DwmSetWindowAttribute' with 'LibraryImportAttribute' instead of 'DllImportAttribute' to generate P/Invoke marshalling code at compile time |
SleepEdit.Shared/Components/Admin/Theme/ThemeAdminPanel.razor.cs | 156 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1816 | OPEN | Change ThemeAdminPanel.DisposeAsync() to call GC.SuppressFinalize(object). This will prevent derived types that introduce a finalizer from needing to re-implement 'IDisposable' to call it. |
SleepEdit.Shared/Components/Admin/Theme/ThemeAdminPanel.razor.cs | 164 | MAJOR | CODE_SMELL | C# | csharpsquid:S108 | OPEN | Either remove or fill this block of code. |
SleepEdit.Shared/Components/Admin/Theme/ThemeAdminPanel.razor.cs | 168 | MAJOR | CODE_SMELL | C# | csharpsquid:S4144 | OPEN | Update this method so that its implementation is not identical to 'OnInitialized'. |
SleepEdit.Shared/Components/AiAssistant/AiAssistantPanel.razor | 118 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEdit.Shared/Components/Layout/SharedLayout.razor | 45 | MAJOR | CODE_SMELL | C# | csharpsquid:S108 | OPEN | Either remove or fill this block of code. |
SleepEdit.Shared/Components/SleepNoteEditor/SleepNoteEditorShell.razor | 261 | MAJOR | CODE_SMELL | C# | csharpsquid:S108 | OPEN | Either remove or fill this block of code. |
SleepEdit.Shared/Infrastructure/Theme/UnavailableThemeConfigurationRepository.cs | 12 | MAJOR | CODE_SMELL | C# | csharpsquid:S108 | OPEN | Either remove or fill this block of code. |
SleepEdit.Shared/Infrastructure/Theme/UnavailableThemeConfigurationRepository.cs | 13 | MAJOR | CODE_SMELL | C# | csharpsquid:S108 | OPEN | Either remove or fill this block of code. |
SleepEdit.Shared/Services/AiAssistant/AiAssistantRequestSession.cs | 11 | MAJOR | CODE_SMELL | C# | csharpsquid:S6966 | OPEN | Await CancelAsync instead. |
SleepEdit.Shared/Services/AiAssistant/AiAssistantServiceCollectionExtensions.cs | 15 | MINOR | CODE_SMELL | C# | csharpsquid:S1075 | OPEN | Refactor your code not to use hardcoded absolute paths or URIs. |
SleepEdit.Shared/Services/ProtocolStarterService.cs | 17 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of field 'SeedDeserializer' from 'SleepEditWeb.Infrastructure.ProtocolXml.IProtocolXmlDeserializer' to 'SleepEditWeb.Infrastructure.ProtocolXml.ProtocolXmlDeserializer' for improved performance |
SleepEdit.Shared/Services/ThemeConfigurationValidator.cs | 95 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of parameter 'errors' from 'System.Collections.Generic.ICollection<string>' to 'System.Collections.Generic.List<string>' for improved performance |
SleepEdit.Shared/Components/ProtocolEditor/ProtocolEditorShell.razor.cs | 403 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1816 | OPEN | Change ProtocolEditorShell.DisposeAsync() to call GC.SuppressFinalize(object). This will prevent derived types that introduce a finalizer from needing to re-implement 'IDisposable' to call it. |
SleepEditWeb/Components/Admin/Medications/MedicationStatistics.razor | 38 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEdit.Shared/Components/Admin/Theme/ThemeEditorState.cs | 9 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of field 'ColorProperties' from 'System.Collections.Generic.IReadOnlyDictionary<string, System.Reflection.PropertyInfo>' to 'System.Collections.Generic.Dictionary<string, System.Reflection.PropertyInfo>' for improved performance |
SleepEdit.Shared/Components/Admin/Theme/ThemePaletteEditor.razor.cs | 9 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of field 'ColorProperties' from 'System.Collections.Generic.IReadOnlyDictionary<string, System.Reflection.PropertyInfo>' to 'System.Collections.Generic.Dictionary<string, System.Reflection.PropertyInfo>' for improved performance |
SleepEdit.Shared/Components/Admin/Theme/ThemePreview.razor.cs | 35 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1816 | OPEN | Change ThemePreview.DisposeAsync() to call GC.SuppressFinalize(object). This will prevent derived types that introduce a finalizer from needing to re-implement 'IDisposable' to call it. |
SleepEdit.Shared/wwwroot/js/sleep-note/editor.js | 217 | MINOR | CODE_SMELL | JavaScript | javascript:S1874 | OPEN | The signature '(commandId: string, showUI?: boolean, value?: string): boolean' of 'document.execCommand' is deprecated. |
SleepEdit.Shared/wwwroot/js/sleep-note/printing.js | 14 | MINOR | CODE_SMELL | JavaScript | javascript:S1874 | OPEN | The signature '(...text: string[]): void' of 'printableWindow.document.write' is deprecated. |
SleepEdit.Shared/wwwroot/js/protocol-dnd.js | 19 | MINOR | CODE_SMELL | JavaScript | javascript:S7773 | OPEN | Prefer `Number.parseInt` over `parseInt`. |
SleepEdit.Shared/Services/ThemeConfigurationValidator.cs | 72 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of parameter 'errors' from 'System.Collections.Generic.ICollection<string>' to 'System.Collections.Generic.List<string>' for improved performance |
SleepEditWeb/Controllers/ThemeAdminController.cs | 128 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change return type of method 'InvalidThemeRequest' from 'Microsoft.AspNetCore.Mvc.IActionResult' to 'Microsoft.AspNetCore.Mvc.RedirectToActionResult' for improved performance |
SleepEdit.Shared/Components/ProtocolViewer/ProtocolViewerPanel.razor.cs | 181 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1826 | OPEN | Do not use Enumerable methods on indexable collections. Instead use the collection directly. |
SleepEdit.Shared/Protocol/Viewer/ProtocolViewerComposer.cs | 22 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of parameter 'lines' from 'System.Collections.Generic.ICollection<string>' to 'System.Collections.Generic.List<string>' for improved performance |
SleepEdit.Shared/Protocol/Viewer/ProtocolViewerState.cs | 63 | MINOR | CODE_SMELL | C# | csharpsquid:S3267 | OPEN | Loops should be simplified using the "Where" LINQ method |
SleepEditWeb/Program.cs | 157 | INFO | CODE_SMELL | external_roslyn | external_roslyn:ASP0015 | OPEN | The header 'Cache-Control' can be accessed using the CacheControl property |
SleepEdit.Shared/wwwroot/js/protocol-dnd.js | 42 | MINOR | CODE_SMELL | JavaScript | javascript:S7773 | OPEN | Prefer `Number.parseInt` over `parseInt`. |
SleepEdit.Shared/wwwroot/js/protocol-dnd.js | 43 | MINOR | CODE_SMELL | JavaScript | javascript:S7773 | OPEN | Prefer `Number.parseInt` over `parseInt`. |
SleepEdit.Shared/Services/ProtocolXmlService.cs | 66 | MINOR | CODE_SMELL | C# | csharpsquid:S6667 | OPEN | Logging in a catch clause should pass the caught exception as a parameter. |
SleepEditWeb/Controllers/ProtocolEditorController.cs | 95 | MINOR | CODE_SMELL | C# | csharpsquid:S1192 | OPEN | Define a constant instead of using this literal 'Request payload is required.' 6 times. |
SleepEdit.Shared/Services/SleepNoteEditorOrchestrator.cs | 67 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of parameter 'knownMedicationNames' from 'System.Collections.Generic.IReadOnlySet<string>' to 'System.Collections.Generic.HashSet<string>' for improved performance |
SleepEditWeb/Controllers/MedListController.cs | 31 | MINOR | CODE_SMELL | C# | csharpsquid:S1192 | OPEN | Define a constant instead of using this literal 'SelectedMeds' 5 times. |
SleepEdit.Shared/Services/DrugInfoService.cs | 41 | MINOR | CODE_SMELL | C# | csharpsquid:S1075 | OPEN | Refactor your code not to use hardcoded absolute paths or URIs. |
SleepEdit.Shared/Data/LiteDbMedicationRepository.cs | 282 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1862 | OPEN | Prefer using 'string.Equals(string, StringComparison)' to perform a case-insensitive comparison, but keep in mind that this might cause subtle changes in behavior, so make sure to conduct thorough testing after applying the suggestion, or if culturally sensitive comparison is not required, consider using 'StringComparison.OrdinalIgnoreCase' |
SleepEdit.Shared/Data/LiteDbMedicationRepository.cs | 329 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1862 | OPEN | Prefer using 'string.Equals(string, StringComparison)' to perform a case-insensitive comparison, but keep in mind that this might cause subtle changes in behavior, so make sure to conduct thorough testing after applying the suggestion, or if culturally sensitive comparison is not required, consider using 'StringComparison.OrdinalIgnoreCase' |
SleepEditWeb/Controllers/MedListController.cs | 58 | MINOR | CODE_SMELL | C# | csharpsquid:S6610 | OPEN | "StartsWith" overloads that take a "char" should be used |
SleepEditWeb/Controllers/MedListController.cs | 58 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1866 | OPEN | Use 'string.StartsWith(char)' instead of 'string.StartsWith(string)' when you have a string with a single char |
SleepEditWeb/Controllers/MedListController.cs | 59 | MINOR | CODE_SMELL | C# | csharpsquid:S6610 | OPEN | "StartsWith" overloads that take a "char" should be used |
SleepEditWeb/Controllers/MedListController.cs | 59 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1866 | OPEN | Use 'string.StartsWith(char)' instead of 'string.StartsWith(string)' when you have a string with a single char |