Every commit scored for change-risk against this repo's own history, so 'elevated' means elevated here rather than on some global curve.
Needs review
32 commits sit in this repo's top risk tercile, which is 33% of the 96scored. The cut is drawn against this codebase's own history rather than a global curve, so a quiet repo still fills its top band, and here it starts at 8.0 out of 10. What pushes a commit up is size and spread together: a large change confined to one area scores below a smaller one scattered across a dozen files.
Commit categories over time, read off the subject line. Fixes carry the accent because that is the series this chart exists to show.
Consistently other-driven across its history.
Ranked by change-risk, highest first. Priority is a tercile of this repo's own distribution, so a quiet repo still fills its top band.
| # | Commit | Author | When | Lines | Risk | Top driver |
|---|---|---|---|---|---|---|
| 1 | 863cc1dbfirst commit | VGR | 1mo ago | +29.2K -0 | 99%Elevated | more lines added than baseline |
| 2 | 1ab30ca4Sprint 4 — Scalabilite du modele (index, owner->id, bornes, tests charge) (#9) | Vincent G.claudeassisted | 1mo ago | +880 -143 | 98%Elevated | more lines added than baseline |
| 3 | ee71c82fIntégrité: atomicité verrou optimiste + transactions tâches/projet (P1), cascade Map + snapshots localStorage cloisonnés (P2) | VGRclaudeassisted | 1mo ago | +596 -124 | 98%Elevated | more lines added than baseline |
| 4 | cbdcfd9fOutillage: ESLint + Prettier + CI GitHub Actions (lot C revue) | Vincentclaudeassisted | 1mo ago | +971 -5 | 96%Elevated | more lines added than baseline |
| 5 | 337e8e1fSécurité : remplacer xlsx (SheetJS, abandonné) par exceljs (maintenu) (#16) | Vincent G.claudeassisted | 1mo ago | +682 -132 | 95%Elevated | more lines added than baseline |
| 6 | b4b67fbcSprint 3 — TeamPlanningView + TaskEditDrawer (extraction composables + test montage) (#11) | Vincent G.claudeassisted | 1mo ago | +313 -223 | 95%Elevated | more lines added than baseline |
| 7 | 42395dafSprint 3 — Frontend (lazy-load exports + extraction composables, rendu identique) (#10) | Vincent G.claudeassisted | 1mo ago | +282 -178 | 93%Elevated | more lines added than baseline |
| 8 | 128ab37eChore : bumps majeurs vite 6→8, vitest 3→4, jsdom 24→29 (PR Dependabot #38-40) | VGRclaudeassisted | 3w ago | +508 -1.0K | 92%Elevated | more lines added than baseline |
| 9 | 5026887fRefactor : responsables/assignés = tables d'association (fin du double-stockage) | VGRclaudeassisted | 4w ago | +235 -78 | 92%Elevated | more lines added than baseline |
| 10 | 220e5100Majeurs : contrat tâche/settings/macro, config mail, résilience front, docs | VGRclaudeautonomous | 4w ago | +334 -418 | 88%Elevated | more lines added than baseline |
| 11 | a16ca9dcSecurite pieces jointes : allowlist, download nosniff, nettoyage orphelins (#13) | Vincent G.claudeassisted | 1mo ago | +227 -16 | 88%Elevated | more lines added than baseline |
| 12 | e4236754Docs: README complet, guide de deploiement, .env.example (lot D revue) | Vincentclaudeassisted | 1mo ago | +258 -1 | 88%Elevated | more lines added than baseline |
| 13 | bef834feRefresh token en cookie HttpOnly + hash en base (P1) | Vincentclaudeassisted | 1mo ago | +269 -73 | 88%Elevated | more lines added than baseline |
| 14 | 8a5f28e3Corrige l'isolation inter-workspaces et la validation des taches (P0/P1) | Vincentclaudeassisted | 1mo ago | +193 -6 | 88%Elevated | more lines added than baseline |
| 15 | 2285ffcaPerf : virtualisation du Gantt projet (panneau piste) | VGRclaudeautonomous | 4w ago | +206 -11 | 85%Elevated | more lines added than baseline |
| 16 | 3c7b4817Chore : bumps Dependabot sûrs (deps mineures/patch + actions GitHub) | VGRclaudeassisted | 3w ago | +313 -275 | 83%Elevated | more lines added than baseline |
| 17 | f92c4366Feat : sections actifs/désactivés (admin) + graphes budget macro (wrap, tooltip, labels) | VGRclaudeassisted | 4w ago | +174 -44 | 83%Elevated | more lines added than baseline |
| 18 | 760cf8a1Maintenance : purge périodique des périmés (sessions/tokens/invitations) + orphelins (#14) | Vincent G.claudeassisted | 1mo ago | +203 -0 | 83%Elevated | more lines added than baseline |
| 19 | 5187b58cFeat : machine à états statut <-> avancement (transitions complètes) | VGRclaudeassisted | 3w ago | +157 -52 | 80%Elevated | more lines added than baseline |
| 20 | 4e2e4f22Sécurité/intégrité : IDOR macro + FK/unicité sur MacroDependency | VGRclaudeautonomous | 4w ago | +144 -3 | 80%Elevated | more lines added than baseline |
| 21 | 78ac49a7UI: permissions refletees selon le role du workspace (lot A revue) | Vincentclaudeassisted | 1mo ago | +154 -8 | 80%Elevated | more lines added than baseline |
| 22 | 216b9aa4Sécu/deps : migration vite 6 + vitest 3 (lève l'allowlist d'audit) | VGRclaudeautonomous | 4w ago | +318 -224 | 76%Elevated | more lines added than baseline |
| 23 | 04113e42Mineurs (backend/shared) : correctness, validation, index | VGRclaudeautonomous | 4w ago | +158 -43 | 76%Elevated | more lines added than baseline |
| 24 | 69df7209Sécurité : corrige 5 failles critiques (XSS, brute-force, invitations, RGPD) | VGRclaudeassisted | 4w ago | +149 -10 | 76%Elevated | more lines added than baseline |
| 25 | 7a2cc8beRefonte UI (finalisation) : police, cards, autofocus, alignements | Vincentclaudeassisted | 1mo ago | +129 -81 | 76%Elevated | more lines added than baseline |
| 26 | 0005f7ccRefonte UI (suite) : fond gris, sidebar, alertes, cards, icônes SVG | Vincentclaudeassisted | 1mo ago | +161 -94 | 76%Elevated | more lines added than baseline |
| 27 | 3a2bf97aDurcit la config: secrets JWT obligatoires en prod + inscription privee (P1) | Vincentclaudeassisted | 1mo ago | +115 -19 | 72%Elevated | more lines added than baseline |
| 28 | 5f721cb7Front : messages d'erreur lisibles (corrige le contrat API mal lu) | VGRclaudeassisted | 3w ago | +109 -9 | 71%Elevated | more lines added than baseline |
| 29 | 23f42b37Budgets : Float -> Decimal(14,2) (arrondi exact) + conversion en number | VGRclaudeautonomous | 4w ago | +118 -13 | 71%Elevated | more lines added than baseline |
| 30 | 3543cb12Sécurité/robustesse : rate-limit keyé sur identité vérifiée, guardrail APP_URL prod, arrêt gracieux | VGRclaudeassisted | 3w ago | +99 -7 | 68%Elevated | more lines added than baseline |
| 31 | dfdf5c81Sécurité : rejet serveur des cycles de dépendances (create/update tâche) | VGRclaudeassisted | 3w ago | +115 -0 | 68%Elevated | more lines added than baseline |
| 32 | 847bc494Sécurité : intégrité des références projet/tenant (macroSwimlane, restore phase/swimlane, op-task category) | VGRclaudeassisted | 3w ago | +113 -3 | 68%Elevated | more lines added than baseline |
| 33 | bbc614cdSécurité : upgrade fastify 4 → 5 (+ plugins @fastify/*) (#17) | Vincent G.claudeassisted | 1mo ago | +146 -199 | 66%Typical | more lines added than baseline |
| 34 | 80d141bbExploitation (Sprint 2): readiness PostgreSQL, request-id + logs structurés, audit deps en CI | VGRclaudeassisted | 1mo ago | +94 -1 | 66%Typical | more lines added than baseline |
| 35 | 6530b8eeSécurité : un ADMIN ne peut plus rétrograder ni retirer le OWNER de l'espace | VGRclaudeassisted | 3w ago | +84 -2 | 63%Typical | more lines added than baseline |
| 36 | 711b751aSécurité : invalide le grace-cache de refresh au logout/révocation | VGRclaudeautonomous | 4w ago | +78 -3 | 63%Typical | more lines added than baseline |
| 37 | 66549bb8Refonte UI : cards macro, Gantt (Ajuster/link-dots), tooltip sparkline | Vincentclaudeassisted | 1mo ago | +96 -71 | 63%Typical | more lines added than baseline |
| 38 | 0a3244d7Correctness : verrou optimiste sur le déplacement de tâche (drag) | VGRclaudeautonomous | 4w ago | +93 -19 | 60%Typical | more lines added than baseline |
| 39 | e2abb95bSécurité deps : bump nodemailer + audit CI bloquant (allowlist documentée) (#15) | Vincent G.claudeassisted | 1mo ago | +125 -36 | 60%Typical | more lines added than baseline |
| 40 | fda0ffedRefonte UI : theme clair aligne sur le handoff (application globale) | Vincentclaudeassisted | 1mo ago | +72 -65 | 59%Typical | more lines added than baseline |
| 41 | 56c53a15Feat : invariant statut <-> avancement (DONE <=> 100%) | VGRclaudeassisted | 3w ago | +67 -5 | 57%Typical | more lines added than baseline |
| 42 | db93b0eaObservabilité : journaliser les HttpError 5xx (logs + /admin/health) | VGRclaudeassisted | 3w ago | +62 -10 | 57%Typical | more lines added than baseline |
| 43 | fa0d59cbCorrectness : drag Gantt owner robuste, labels keyés stable, upload/export refresh 401 | VGRclaudeassisted | 3w ago | +57 -19 | 55%Typical | more lines added than baseline |
| 44 | fd6ae145Correctness : move n'écrit plus la colonne owner supprimée + durcit le backfill | VGRclaudeassisted | 4w ago | +76 -5 | 55%Typical | more lines added than baseline |
| 45 | 04cb2d01Sécurité : révocation sur démotion admin + purge refresh sur delete-me + getInvitation masque les invitations inactives | VGRclaudeassisted | 3w ago | +60 -3 | 54%Typical | more lines added than baseline |
| 46 | 8d158d19Contrat : create/update renvoient changedIds (successeurs décalés) | VGRclaudeassisted | 3w ago | +45 -12 | 52%Typical | more lines added than baseline |
| 47 | 6b543842Sécurité : changer son mot de passe révoque les autres sessions | VGRclaudeassisted | 3w ago | +48 -2 | 52%Typical | more lines added than baseline |
| 48 | a32e0811Dédup : extrait useTrackViewport (partagé Project/Owner Gantt) | VGRclaudeautonomous | 4w ago | +44 -43 | 52%Typical | more lines added than baseline |
| 49 | 51f0c007Robustesse : refuser de démarrer en prod avec DATABASE_URL/CORS par défaut | VGRclaudeassisted | 3w ago | +44 -6 | 48%Typical | more lines added than baseline |
| 50 | 9a379069Sécurité : la liste des invitations n'expose plus le jeton (révocation par id) | VGRclaudeassisted | 3w ago | +44 -14 | 48%Typical | more lines added than baseline |
Two views of the same model: where the cuts fall, and what commit shape lands you above them.
Every scored commit, binned on the raw 0 to 10 score rather than the percentile. Percentile ranks are uniform by construction, so that axis has no shape to draw. The dashed lines are the tercile cuts behind each row's priority pill.
The 96 most recent commits, on their own recency sample rather than the feed above: that defaults to risk-sorted, so reusing it would plot only the top tercile and call it the spread. Big and scattered is what the model penalises. Click a dot to open it.
ssuyk/pm has 159 commits in its history from 3 contributors, the first of them Jun 30, 2026. In the last 90 days 231 files were touched, 519 times in total, most often tasks.service.ts. Every commit is scored for change risk from its size, spread and the history of the files it touches.
