How we measure

From repository to city

Four steps, all of them on your machine.

1. RepositoryA local folder or a clone.
3. ReadFolders, lines, branches, git history, imports.
5. Scan locallyTrivy · gitleaks · debt rules.
7. City + reportBuildings, districts, findings, a grade.

In the local version, nothing but the chat leaves your machine.

Anatomy of a building

One folder with code in it. Nine things about it are readable at a glance.

What “complexity” counts

Decision points per file, summed per folder. A fast heuristic, not full cyclomatic complexity.

export function settle(orders, rates) {  let total = 0;  for (const order of orders) {    if (!order.paid || order.voided) continue;    const rate = rates[order.currency];    while (order.items.length && rate) {      const item = order.items.pop();      switch (item.kind) {        case 'refund': total -= price(item, rate); break;        case 'fee':    total += fee(item, rate);   break;      }      try { audit(item); } catch (e) { report(e); }    }  }  return total;}

Click a decision point to remove it, as if you had simplified the code, and watch the tower come down.

switch and try are not counted — only if for while case catch && ||.

Where findings come from

Three instruments. Two are standard tools; the third is a handful of rules with no tool behind it.

• Trivy

  ReadsLockfiles and manifests (npm, yarn, pnpm, pip, poetry, go.mod, Cargo, pom, gradle), built jars for Java, and Dockerfile, compose, Kubernetes and Terraform.

  EmitsVulnerabilities and misconfigurations. Severity is Trivy’s.

• gitleaks

  ReadsThe working tree, with the default rule set.

  EmitsPossible secrets, all counted as High today: they are not yet sorted into likely and doubtful, and that inflates risk. Only the rule and file:line are kept.

• Debt rules

  ReadsEvery source file, plus commit counts from git.

  EmitsTODO/FIXME/HACK/XXX = Low · over 500 lines = Medium · more than 0.25 branches per line in files over 50 lines = Medium · hotspot (commits × complexity in the top 5% of the repo) = High.

• SARIF reports

  ReadsThe .sarif files you drop into .codemap/: Snyk, Semgrep, CodeQL, ESLint, Checkov and any tool that exports SARIF 2.1.0.

  EmitsWith a security-severity: a vulnerability (≥ 9 Critical, ≥ 7 High, ≥ 4 Medium). Without one: debt, Medium for error and Low otherwise. Whatever the tool suppressed stays out.

Four severities

• Critical
• High
• Medium
• Low

Hotspots

Every dot is a real folder of expressjs/express: to the right, how much it changed over the last 12 months; upwards, how much logic it holds. The 5 % with the largest product of the two gets a red mast.

Risk of one building

The grade, live

These sliders feed the product’s own scoring function — the same module the dashboard imports. Move them.

The four lenses

The same city, four values, one ramp. Each lens normalises to 0–1 and paints the facades.

• Risk

  Decide what to fix first.

  no findingscritical

  log(1 + risk) / log(81)Logarithmic: one critical already shows, a hundred do not saturate.

• Debt

  Plan refactors and see which district is rotting.

  0 h16 h or more

  hours / 1616 hours is two working days: from there on, full red.

• Pulse

  Tell living code from sleeping code. Asleep and risky is the worst combination.

  a year agotoday

  1 − days / 365Touched today = 1; untouched for a year = 0.

• Traffic

  Find the corridors the whole team walks down.

  0 commitsthe busiest

  commits / max(commits)Relative to the busiest building in the repository.

The same eight buildings, painted by each lens.

Districts and links