vercel/turborepo
Canonical Turborepo monorepo (~1100 JS/TS files across 19 workspace packages).
- Upstream: turborepo
- Pinned commit:
fc62fe0d9c347d1d24f0ed8946284856593ddb93 - Reference: v2.9.14 release tag
- Scan run: 2026-05-18T05:16:25Z (brass commit
35e97b5b)
Headline metrics
- Total findings: 210
- Critical issues (top-N AI output): 50
- Scan wall time (aggregate scanner-seconds): 131.03 s
- Pysa cache size: 0.0 MB
Severity breakdown
| Severity | Count |
|---|---|
| medium | 119 |
| high | 57 |
| low | 33 |
| info | 1 |
Scanner contribution
| Scanner | Findings | Share |
|---|---|---|
Brass2PrivacyScanner | 128 | 61.0% |
SecretsScanner | 72 | 34.3% |
JavaScriptTypeScriptScanner | 7 | 3.3% |
ContentModerationScanner | 3 | 1.4% |
Reproduce locally
git clone https://github.com/<owner>/turborepo.git
cd turborepo && git checkout fc62fe0d9c347d1d24f0ed8946284856593ddb93
brasscoders --offline scan .Numbers from your local run may differ slightly (Python version, scanner version pins) — published baselines are recorded from the canonical CI environment (Ubuntu, Python 3.12, dev-pinned scanner versions). The ±20% findings tolerance and ≤50% wall-time tolerance are wide enough to absorb normal environment drift.