Every commit scored for change-risk against this repo's own history, so 'elevated' means elevated here rather than on some global curve.
Needs review
165 commits sit in this repo's top risk tercile, which is 33% of the 500scored. The cut is drawn against this codebase's own history rather than a global curve, so a quiet repo still fills its top band, and here it starts at 7.4 out of 10. What pushes a commit up is size and spread together: a large change confined to one area scores below a smaller one scattered across a dozen files.
Commit categories over time, read off the subject line. Fixes carry the accent because that is the series this chart exists to show.
Began other-led, now leaning fix.
Ranked by change-risk, highest first. Priority is a tercile of this repo's own distribution, so a quiet repo still fills its top band.
| # | Commit | Author | When | Lines | Risk | Top driver |
|---|---|---|---|---|---|---|
| 1 | d1692f5fAdd unit tests lifting backend coverage 41% to 55% and add a CI coverage-floor gate | Murtaza Nasir | 1mo ago | +9.6K -6 | 100%Elevated | more lines added than baseline |
| 2 | 3d7444ebClose mutation-sweep survivors (batch 1): SSO redirect, email-verify, webhook SSRF, group auto-share, inquire filters, recordings downloads, LLM tracking | Murtaza Nasir | 1mo ago | +1.1K -1 | 99%Elevated | more lines added than baseline |
| 3 | 0bc72079Add dual local/S3 storage layer (ported from #268) | Dmitry Abramov | 2mo ago | +1.8K -192 | 99%Elevated | more lines added than baseline |
| 4 | f3ac64afTests: cover sharing/folders/groups/SSO authz holes + fix job-queue worker test isolation | Murtaza Nasir | 2mo ago | +1.8K -0 | 99%Elevated | more lines added than baseline |
| 5 | 228ad15eWebhooks Phase 1: models, dispatcher with HMAC + retry + SSRF guard, v1 CRUD, lifecycle event emission (#275) | Murtaza Nasir | 2mo ago | +1.6K -0 | 99%Elevated | more lines added than baseline |
| 6 | d37cf769Add vitest unit tests for frontend utils and persistence modules (0% to 92-100%) | Murtaza Nasir | 1mo ago | +1.1K -0 | 99%Elevated | more lines added than baseline |
| 7 | 033ad583Phase A: server-side recording-session backend with async ffmpeg stitch (#287 c/d) | Murtaza Nasir | 2mo ago | +1.5K -0 | 99%Elevated | more lines added than baseline |
| 8 | e45f7c43Add ASR Voice Recorder webhook integration | cybersader | 4w ago | +912 -85 | 98%Elevated | more lines added than baseline |
| 9 | 7903a211Add markdown transcript export, bulk export of existing recordings to disk, and audio-level recording merge; remove orphaned bulk-action-bar template | Murtaza Nasir | 1mo ago | +1.3K -114 | 98%Elevated | more lines added than baseline |
| 10 | 622e418bClose mutation-sweep survivors (batch 2a): storage guards, embeddings chunking, admin share-cleanup/usage, retention global-flag | Murtaza Nasir | 1mo ago | +652 -1 | 98%Elevated | more lines added than baseline |
| 11 | 29d11fe5Tag/Folder modal Sharing empty-state + consistent height; alphabetical language dropdowns; localization sweep for Stats, Processing Queue, Reprocess modal — addresses three user-reported issues; (1) Tag/Folder edit modal Sharing tab now surfaces a role-appropriate empty state when internal sharing is on but the user has no admin groups (was just a blank tab) — site admins see a link to Admin → Groups, regular users see 'Ask your administrator to create a group and add you', applies to both tag a | Murtaza Nasir | 2mo ago | +759 -99 | 98%Elevated | more lines added than baseline |
| 12 | 019a67fbAdd mobile external microphone selection | cybersader | 4w ago | +697 -105 | 97%Elevated | more lines added than baseline |
| 13 | 10e1d577Recording sessions: segment-aware stitch assembly, dispatch stitch jobs, auto-finalize abandoned sessions, set title/meeting_date at finalize | Murtaza Nasir | 2mo ago | +669 -231 | 97%Elevated | more lines added than baseline |
| 14 | cb8b71ceTests: convert false guards to real assertions | Murtaza Nasir | 2mo ago | +452 -924 | 97%Elevated | more lines added than baseline |
| 15 | 71d69413Fix CSRF bypass via unauthenticated API token parameter and SSO-only account takeover, preserving the safe add-password flow (CWE-287) | Murtaza Nasir | 2mo ago | +763 -34 | 97%Elevated | more lines added than baseline |
| 16 | d9803e1bfeat: configurable auto-export filename templates with rename migration for existing exports (#348) | Murtaza Nasir | 2w ago | +915 -18 | 97%Elevated | more lines added than baseline |
| 17 | 2f7d5871feat: add MOSS-Transcribe-Diarize connector (Mossland API) (#330) | siva-sub | 1mo ago | +724 -2 | 97%Elevated | more lines added than baseline |
| 18 | 8417fe60Upload-modal localization sweep — Linux platform hint / disable audio-processing toggle / input-device picker / Options group label / tab-audio-only tooltip / detected-virtual-device hint / mix-help / Linux pactl monitor hint / open-guide button + folderManagement keys for the next batch — addresses user-reported hard-coded English visible in the upload modal even when the rest of the UI is in Chinese/Spanish/etc.; adds 19 new recording.* keys plus upload.options plus folderManagement.* keys (tr | Murtaza Nasir | 2mo ago | +448 -49 | 97%Elevated | more lines added than baseline |
| 19 | dd34c3bcPass A foundation: primitives.css with design tokens (spacing scale 4/8/12/16/24/32/48/64, type tokens, radii, shadows, transitions) and primitive class definitions (surface, tabs, toggle, btn, field, spinner, empty, banner, float-panel, rail, t-* type scale) plus a 57-replacement sweep of hardcoded Tailwind colour utilities (bg-red-600, text-blue-500 etc.) to their CSS-variable equivalents across admin, account, and inquire so every theme + light/dark combination renders correctly | Murtaza Nasir | 2mo ago | +680 -45 | 97%Elevated | more lines added than baseline |
| 20 | 02caa225Phase B: client streaming + finalize for server-side recording chunks (#287 c/d) | Murtaza Nasir | 2mo ago | +653 -8 | 97%Elevated | more lines added than baseline |
| 21 | 664e8360Docs: document v0.9.0 API endpoints (folders CRUD, users/me, webhooks, connector discovery, per-request transcribe overrides, new recording fields) | Murtaza Nasir | 2mo ago | +475 -6 | 96%Elevated | more lines added than baseline |
| 22 | 5afaaee9Webhooks Phase 2: account-settings tab with list/edit/test/deliveries/rotate + 16 i18n keys per locale (#275) | Murtaza Nasir | 2mo ago | +509 -7 | 96%Elevated | more lines added than baseline |
| 23 | f1016a07feat: parse meeting date from filename on upload with preset patterns, custom regex, and timezone-aware conversion (#342) | Murtaza Nasir | 2w ago | +617 -6 | 95%Elevated | more lines added than baseline |
| 24 | 7b5b4166Add contextual speaker auto-labelling for connectors without voice embeddings: branch per-recording (embeddings -> voice match, none -> LLM match constrained to saved profiles), prefix-cache-friendly transcript-first prompt with an admin-editable guidance suffix, show the auto-label toggle for embedding-less connectors while hiding the confidence threshold, and clear stale embeddings on reprocess | Murtaza Nasir | 1mo ago | +542 -40 | 95%Elevated | more lines added than baseline |
| 25 | 75823eefUnify transcription param resolution behind one shared resolver so merge, reprocess, share, auto-process, and stitch all honor tag/folder/env/account defaults identically to uploads | Murtaza Nasir | 1mo ago | +416 -215 | 95%Elevated | more lines added than baseline |
| 26 | 72aaaca5Harden app from audit: enforce auth rate limits (was a no-op), fix bulk-toggle IDOR, re-validate webhook URLs at delivery against DNS rebinding, stop leaking exception text; bound all ffmpeg/ffprobe subprocesses with timeouts, clean up incognito/converted/extracted temp files on every path, stop post-completion side effects from corrupting finished recordings; close the recording AudioContext and display stream on stop/discard/error to fix the record-cycle leak, and unstick the incognito upload | Murtaza Nasir | 1mo ago | +633 -66 | 95%Elevated | more lines added than baseline |
| 27 | 77bdebb2Add opt-in tab/window/screen video capture to system-audio recording (#303): keep the display video track through MediaRecorder, live preview, video mime support in recording sessions with probe-resolved mime after stitch, RECORDING_VIDEO_KBPS bitrate cap, docs and all-locale strings | Murtaza Nasir | 1mo ago | +640 -248 | 95%Elevated | more lines added than baseline |
| 28 | 68b47392Add AssemblyAI transcription connector (async upload/poll API, diarization, speaker hints, word boost) with config docs and unit tests | Murtaza Nasir | 1mo ago | +490 -1 | 95%Elevated | more lines added than baseline |
| 29 | 9d8d9acfClose mutation-sweep survivors (batch 2b): audio config flags, file-monitor admin scan, job-queue round-robin/filename, auth registration/SSO-init | Murtaza Nasir | 1mo ago | +327 -0 | 95%Elevated | more lines added than baseline |
| 30 | f8b35d5fSystem audio capture: platform detection + per-OS help modal + virtual audio device discovery — (1) new utils/platform.js exports detectPlatform() (returns {os, browser} from navigator), getAudioCapabilities() (returns supportsTabAudio / supportsWindowAudio / supportsSystemAudio flags driven by the browser+OS matrix — only Chrome/Edge on Windows or ChromeOS deliver true OS-wide capture; macOS/Linux are tab-audio-only; Firefox/Safari can't capture audio via getDisplayMedia at all) and enumerateVi | Murtaza Nasir | 2mo ago | +409 -42 | 95%Elevated | more lines added than baseline |
| 31 | 1dd82964Migrate 10 modals to use modal-header / modal-title / modal-close / modal-body / modal-footer + btn primitives (add-speaker, bulk-reprocess, bulk-tag, text-editor, edit-text, duplicates, shares-list, color-scheme, edit-participants, edit-speakers, customize-summary-prompt) — each gets the unified header pattern (icon + title + subtitle + close), consistent body padding, footer with btn--ghost cancel + btn--primary action; gradient buttons replaced with btn--primary; ad-hoc input classes replaced | Murtaza Nasir | 2mo ago | +275 -484 | 95%Elevated | more lines added than baseline |
| 32 | dfcae881Pass B: right-rail tab strip rebuilt with primitives — single 40px row carrying Summary/Notes/Events tabs (with inline word/item counts) on the left and per-tab action toolbar on the right; tab content now uses .prose-flush class (no inner card chrome) so prose flows on the rail surface; editing mode replaces action icons with Cancel/Save in the same strip; summary/notes word counts exposed as Vue computeds with k-suffix formatting | Murtaza Nasir | 2mo ago | +371 -149 | 95%Elevated | more lines added than baseline |
| 33 | 0f0fbc3fLocale updates: German translation backfill plus new keys for share-target, proxy 413, and recording recovery (#286, #285, #283, #297) | Murtaza Nasir | 2mo ago | +333 -228 | 95%Elevated | more lines added than baseline |
| 34 | 5b9a2c35Refresh CSRF token before XHR upload and retry once on rejection (#302) | François Catuhe | 2mo ago | +249 -4 | 93%Elevated | more lines added than baseline |
| 35 | bcfec4ddMigrate group/admin/account/inquire modals to design-system header/body/footer structure (fix flush-content regression) | Murtaza Nasir | 2mo ago | +298 -292 | 93%Elevated | more lines added than baseline |
| 36 | a3ccab41In-app recording: real resume into same session, unified recovery modal, IndexedDB rolling buffer, live sidebar/queue updates, configurable chunk cadence | Murtaza Nasir | 2mo ago | +417 -100 | 93%Elevated | more lines added than baseline |
| 37 | 84e01058Add per-upload Keep audio only override and larger size limit for audio-only video uploads, with admin setting max_audio_only_video_size_mb (default 4x max_file_size_mb) and a post-extraction size guard against oversized stored audio | Murtaza Nasir | 2mo ago | +478 -75 | 93%Elevated | more lines added than baseline |
| 38 | b0d9d2afFrontend resilience: failed-upload recovery, nav guard, chunking msg fix, chat partial preserve, markRaw multi-upload perf (#297, #287, #283, #282, #280) | Murtaza Nasir | 2mo ago | +270 -26 | 93%Elevated | more lines added than baseline |
| 39 | 165933edLocalize prompt variables, append/replace mode, customize-summary modal, ASR editor save UX, and prompt-preview legend across all six languages | Murtaza Nasir | 3mo ago | +276 -54 | 93%Elevated | more lines added than baseline |
| 40 | 5d701608feat: localize bulk-reprocess modal, toasts, and remaining hardcoded detail-view tooltips across all seven locales (supersedes #351) | Murtaza Nasir | 2w ago | +295 -124 | 91%Elevated | more lines added than baseline |
| 41 | f7bf7589Fix three reported security advisories: SSO account-takeover secure-by-default verified-email (GHSA-w4q5-3526-j82j), webhook SSRF via connect-time peer-IP pinning (GHSA-2m89-mxcv-gv93), and stored XSS via tag color with hex validation plus quote-escaping (GHSA-pp32-69wg-97h3) | Murtaza Nasir | 1mo ago | +390 -46 | 91%Elevated | more lines added than baseline |
| 42 | 60a4cac8Add needs filters for recordings | Fran Fitzpatrick | 1mo ago | +321 -5 | 91%Elevated | more lines added than baseline |
| 43 | 166b5a21feat: opt-in prefix-cache-friendly title/summary prompts | fcatuhe | 1mo ago | +320 -12 | 91%Elevated | more lines added than baseline |
| 44 | f92977bbAdd Transcription Prompts settings subtab and pick-from-saved picker in account/tag/folder editors (#309) | Murtaza Nasir | 1mo ago | +348 -2 | 91%Elevated | more lines added than baseline |
| 45 | 1be430bbAdd transcription initial-prompt template library with CRUD API and admin default initial prompt (#309) | Murtaza Nasir | 1mo ago | +392 -0 | 91%Elevated | more lines added than baseline |
| 46 | 4b2f8fa2recordings: probe-driven video MIME (stop guessing), reindex Inquire chunks on transcript/speaker edits, configurable RECORDING_CHUNK_SECONDS | Murtaza Nasir | 2mo ago | +329 -8 | 91%Elevated | more lines added than baseline |
| 47 | 60100563Ship the floating dockable chat panel: new components/detail/floating-chat.html (Teleported to body) with FAB at bottom-right when collapsed, opens into a 380x520 panel docked-se by default; header drag-to-snap supports 4-corner snap (within 100px) plus free-floating; maximize toggles to fill the viewport-less-header; per-recording position persisted in localStorage; .floating-chat-* CSS primitives in primitives.css handle all 4 states + responsive (mobile hides the floating chat — mobile uses t | Murtaza Nasir | 2mo ago | +452 -3 | 91%Elevated | more lines added than baseline |
| 48 | 426a0a80Add per-feature transcript timestamp toggles for summary and chat with default-or-template format selection (#304) | Murtaza Nasir | 1mo ago | +351 -15 | 90%Elevated | more lines added than baseline |
| 49 | 591cdbe6Fix TransactionInactiveError when persisting failed uploads to IndexedDB | jjsmackayclaudeassisted | 1mo ago | +188 -23 | 90%Elevated | more lines added than baseline |
| 50 | 23ff883fAdd Forgejo Actions CI: tests + multi-arch Docker build to Docker Hub | Murtaza Nasir | 2mo ago | +217 -0 | 90%Elevated | more lines added than baseline |
Two views of the same model: where the cuts fall, and what commit shape lands you above them.
Every scored commit, binned on the raw 0 to 10 score rather than the percentile. Percentile ranks are uniform by construction, so that axis has no shape to draw. The dashed lines are the tercile cuts behind each row's priority pill.
The 200 most recent commits, on their own recency sample rather than the feed above: that defaults to risk-sorted, so reusing it would plot only the top tercile and call it the spread. Big and scattered is what the model penalises. Click a dot to open it.
murtaza-nasir/speakr has 621 commits in its history from 15 contributors, the first of them Feb 10, 2026. In the last 90 days 196 files were touched, 693 times in total, most often app.modular.js. Every commit is scored for change risk from its size, spread and the history of the files it touches.
