Sonar aggregate coverage
85.2%
The combined percentage of executable lines and decision conditions exercised by tests in the coverage report imported into SonarQube.
Scanner-reported aggregate
SleepEdit Security and Quality Evidence
Detailed scan results. Missing measurements remain visible.
Measured baseline
Coverage
Sonar's retained percentage reflects the coverage report supplied to that analysis. It is not presented as coverage of every source language.
Sonar line coverage
87.2%
The percentage of executable source lines run by tests in the coverage report imported into SonarQube.
Scanner-reported lines
Sonar branch coverage
80.4%
The percentage of decision outcomes, such as both true and false paths, exercised by tests in the coverage report imported into SonarQube.
Scanner-reported branches
OpenCover C# coverage
81.01%
C# test coverage measured by OpenCover. The large value is line coverage; branch coverage appears in the supporting detail.
Newest retained OpenCover report; branch coverage 72.96%
JavaScript and TypeScript coverage
92.86%
JavaScript and TypeScript test coverage measured from the verified first-party LCOV report. The large value is line coverage.
Verified first-party LCOV; branch coverage 81.88%
SonarQube measures
Quality and security
Security rating
A · 1.0
Reflects the most severe open vulnerability: a potentially exploitable weakness in the application code.
Sonar scale: lower is better (1 best, 5 worst)
Reliability rating
A · 1.0
Reflects the most severe open bug: a finding that may cause incorrect behavior, crashes, or data loss.
Sonar scale: lower is better (1 best, 5 worst)
Maintainability rating
A · 1.0
Reflects estimated effort to fix maintainability issues relative to code size; it is not a count of code smells.
Sonar scale: lower is better (1 best, 5 worst)
Vulnerabilities
0
Open findings that SonarQube identifies as potentially exploitable weaknesses in the application code.
Security hotspots
0
Security-sensitive code that requires human review. A hotspot is not automatically a confirmed vulnerability.
100% reviewed
Bugs
0
Open reliability findings that may cause incorrect behavior, crashes, or data corruption.
Code smells
42
Open maintainability findings that make code harder to understand, change, or test but are not necessarily functional defects.
Average cyclomatic complexity
2.10
Average number of linearly independent execution paths per function. Lower values generally mean smaller methods that are easier to test and maintain.
3,576 total across 1,704 functions
Average cognitive complexity
1.15
Average score for how difficult each function's control flow is to understand. Nesting and breaks in linear flow increase the score; lower values are easier to follow and maintain.
1,967 total across 1,704 functions
Duplicated lines
0.1%
The percentage of analyzed source lines that SonarQube identifies as duplicated code.
Lines of code
18510
The number of analyzed non-comment source lines reported by SonarQube.
System context
Architecture and trust boundaries
These diagrams document the intended system design and provide context for the security results. They are not scanner measurements.
Clinical note, browser privacy, and AI data flow
Shows browser-only note state, local dictation, server-side PHI screening and image redaction, and external provider boundaries.
Open full-size diagram
Administration, protocol, persistence, and deployment
Shows administrative traffic, hosting and application boundaries, persistent storage, secret injection, logging, and the Vosk software-supply path.
Open full-size diagram42 open findings
Issue distribution
By severity
| Severity | Count |
|---|---|
| MINOR | 25 |
| INFO | 17 |
By type
| Type | Count |
|---|---|
| CODE_SMELL | 42 |
By language
| Language | Count |
|---|---|
| C# | 20 |
| external_roslyn | 17 |
| JavaScript | 5 |
0 retained hotspots
Security hotspots
No matching findings.
No security hotspots were exported.
Retained audits
Dependencies and tests
NuGet vulnerabilities
- Total
- 0
- Critical
- 0
- High
- 0
- Moderate
- 0
- Low
- 0
npm vulnerabilities
- Total
- 0
- Critical
- 0
- High
- 0
- Moderate
- 0
- Low
- 0
.NET tests
- Total
- 689
- Passed
- 689
- Failed
- 0
- Skipped
- 0
First-party automated test source
The physical nonblank source lines in explicitly scoped first-party automated tests. It indicates test investment, not a quality score.
- Nonblank source lines
- 18,357
- Test source files
- 109
| Test area | Files | Nonblank lines |
|---|---|---|
| .NET test project and harness | 56 | 11,761 |
| Browser unit and boundary tests | 21 | 3,630 |
| End-to-end browser tests and fixtures | 23 | 2,340 |
| Security-report and verification tests | 9 | 626 |
Source-level evidence
Detailed SonarQube issues
| File | Line | Severity | Type | Language | Rule | Status | Message |
|---|---|---|---|---|---|---|---|
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 35 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/Components/ProtocolEditor/ProtocolEditorShell.razor.cs | 369 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1816 | OPEN | Change ProtocolEditorShell.DisposeAsync() to call GC.SuppressFinalize(object). This will prevent derived types that introduce a finalizer from needing to re-implement 'IDisposable' to call it. |
SleepEditWeb/Components/Admin/Medications/MedicationStatistics.razor | 38 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/Components/Admin/Theme/ThemeEditorState.cs | 9 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of field 'ColorProperties' from 'System.Collections.Generic.IReadOnlyDictionary<string, System.Reflection.PropertyInfo>' to 'System.Collections.Generic.Dictionary<string, System.Reflection.PropertyInfo>' for improved performance |
SleepEditWeb/Components/Admin/Theme/ThemePaletteEditor.razor.cs | 9 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of field 'ColorProperties' from 'System.Collections.Generic.IReadOnlyDictionary<string, System.Reflection.PropertyInfo>' to 'System.Collections.Generic.Dictionary<string, System.Reflection.PropertyInfo>' for improved performance |
SleepEditWeb/Components/Admin/Theme/ThemePreview.razor.cs | 35 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1816 | OPEN | Change ThemePreview.DisposeAsync() to call GC.SuppressFinalize(object). This will prevent derived types that introduce a finalizer from needing to re-implement 'IDisposable' to call it. |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 461 | MINOR | CODE_SMELL | C# | csharpsquid:S3267 | OPEN | Loops should be simplified using the "Where" LINQ method |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 733 | MINOR | CODE_SMELL | C# | csharpsquid:S3267 | OPEN | Loops should be simplified using the "Where" LINQ method |
SleepEditWeb/wwwroot/js/sleep-note/editor.js | 205 | MINOR | CODE_SMELL | JavaScript | javascript:S1874 | OPEN | The signature '(commandId: string, showUI?: boolean, value?: string): boolean' of 'document.execCommand' is deprecated. |
SleepEditWeb/wwwroot/js/sleep-note/printing.js | 14 | MINOR | CODE_SMELL | JavaScript | javascript:S1874 | OPEN | The signature '(...text: string[]): void' of 'printableWindow.document.write' is deprecated. |
SleepEditWeb/wwwroot/js/protocol-dnd.js | 19 | MINOR | CODE_SMELL | JavaScript | javascript:S7773 | OPEN | Prefer `Number.parseInt` over `parseInt`. |
SleepEditWeb/Controllers/ThemeAdminController.cs | 128 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change return type of method 'InvalidThemeRequest' from 'Microsoft.AspNetCore.Mvc.IActionResult' to 'Microsoft.AspNetCore.Mvc.RedirectToActionResult' for improved performance |
SleepEditWeb/Services/ThemeConfigurationValidator.cs | 62 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of parameter 'errors' from 'System.Collections.Generic.ICollection<string>' to 'System.Collections.Generic.List<string>' for improved performance |
SleepEditWeb/Services/SleepNoteNarrativeGenerator.cs | 154 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change return type of method 'BuildEquipmentChanges' from 'System.Collections.Generic.IReadOnlyList<string>' to 'System.Collections.Generic.List<string>' for improved performance |
SleepEditWeb/Components/ProtocolViewer/ProtocolViewerPanel.razor.cs | 178 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1826 | OPEN | Do not use Enumerable methods on indexable collections. Instead use the collection directly. |
SleepEditWeb/Protocol/Viewer/ProtocolViewerComposer.cs | 22 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of parameter 'lines' from 'System.Collections.Generic.ICollection<string>' to 'System.Collections.Generic.List<string>' for improved performance |
SleepEditWeb/Protocol/Viewer/ProtocolViewerState.cs | 63 | MINOR | CODE_SMELL | C# | csharpsquid:S3267 | OPEN | Loops should be simplified using the "Where" LINQ method |
SleepEditWeb/Data/LiteDbMedicationRepository.cs | 264 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1862 | OPEN | Prefer the string comparison method overload of 'string.StartsWith(string)' that takes a 'StringComparison' enum value to perform a case-insensitive comparison, but keep in mind that this might cause subtle changes in behavior, so make sure to conduct thorough testing after applying the suggestion, or if culturally sensitive comparison is not required, consider using 'StringComparison.OrdinalIgnoreCase' |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 919 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor.cs | 69 | MINOR | CODE_SMELL | C# | csharpsquid:S1192 | OPEN | Define a constant instead of using this literal 'Other' 5 times. |
SleepEditWeb/Services/SleepNoteNarrativeGenerator.cs | 120 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change return type of method 'GenerateMaskCourse' from 'System.Collections.Generic.IReadOnlyList<string>' to 'System.Collections.Generic.List<string>' for improved performance |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 754 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 161 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/Program.cs | 191 | INFO | CODE_SMELL | external_roslyn | external_roslyn:ASP0015 | OPEN | The header 'Cache-Control' can be accessed using the CacheControl property |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 104 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 120 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 136 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 187 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/Components/SleepNote/SleepNoteForm.razor | 203 | MINOR | CODE_SMELL | C# | csharpsquid:S8970 | OPEN | Remove this null-forgiving operator; nullable warnings are disabled here. |
SleepEditWeb/wwwroot/js/protocol-dnd.js | 42 | MINOR | CODE_SMELL | JavaScript | javascript:S7773 | OPEN | Prefer `Number.parseInt` over `parseInt`. |
SleepEditWeb/wwwroot/js/protocol-dnd.js | 43 | MINOR | CODE_SMELL | JavaScript | javascript:S7773 | OPEN | Prefer `Number.parseInt` over `parseInt`. |
SleepEditWeb/Services/ProtocolXmlService.cs | 65 | MINOR | CODE_SMELL | C# | csharpsquid:S6667 | OPEN | Logging in a catch clause should pass the caught exception as a parameter. |
SleepEditWeb/Controllers/ProtocolEditorController.cs | 95 | MINOR | CODE_SMELL | C# | csharpsquid:S1192 | OPEN | Define a constant instead of using this literal 'Request payload is required.' 6 times. |
SleepEditWeb/Services/SleepNoteEditorOrchestrator.cs | 67 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1859 | OPEN | Change type of parameter 'knownMedicationNames' from 'System.Collections.Generic.IReadOnlySet<string>' to 'System.Collections.Generic.HashSet<string>' for improved performance |
SleepEditWeb/Controllers/MedListController.cs | 31 | MINOR | CODE_SMELL | C# | csharpsquid:S1192 | OPEN | Define a constant instead of using this literal 'SelectedMeds' 5 times. |
SleepEditWeb/Services/DrugInfoService.cs | 41 | MINOR | CODE_SMELL | C# | csharpsquid:S1075 | OPEN | Refactor your code not to use hardcoded absolute paths or URIs. |
SleepEditWeb/Data/LiteDbMedicationRepository.cs | 276 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1862 | OPEN | Prefer using 'string.Equals(string, StringComparison)' to perform a case-insensitive comparison, but keep in mind that this might cause subtle changes in behavior, so make sure to conduct thorough testing after applying the suggestion, or if culturally sensitive comparison is not required, consider using 'StringComparison.OrdinalIgnoreCase' |
SleepEditWeb/Data/LiteDbMedicationRepository.cs | 322 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1862 | OPEN | Prefer using 'string.Equals(string, StringComparison)' to perform a case-insensitive comparison, but keep in mind that this might cause subtle changes in behavior, so make sure to conduct thorough testing after applying the suggestion, or if culturally sensitive comparison is not required, consider using 'StringComparison.OrdinalIgnoreCase' |
SleepEditWeb/Controllers/MedListController.cs | 58 | MINOR | CODE_SMELL | C# | csharpsquid:S6610 | OPEN | "StartsWith" overloads that take a "char" should be used |
SleepEditWeb/Controllers/MedListController.cs | 58 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1866 | OPEN | Use 'string.StartsWith(char)' instead of 'string.StartsWith(string)' when you have a string with a single char |
SleepEditWeb/Controllers/MedListController.cs | 59 | MINOR | CODE_SMELL | C# | csharpsquid:S6610 | OPEN | "StartsWith" overloads that take a "char" should be used |
SleepEditWeb/Controllers/MedListController.cs | 59 | INFO | CODE_SMELL | external_roslyn | external_roslyn:CA1866 | OPEN | Use 'string.StartsWith(char)' instead of 'string.StartsWith(string)' when you have a string with a single char |