{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:02.337204Z","repo":{"ref":{"host":"github.com","owner":"Yurzi","name":"nvpaper"},"default_branch":"main","clone_url":"https://github.com/Yurzi/nvpaper.git","html_url":"https://github.com/Yurzi/nvpaper","description":"Minimal pure-Rust video wallpaper for niri / wlr-layer-shell compositors, with dma-buf zerocopy","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":173,"primary_language":"Rust","license_spdx":"MIT","created_at":"2026-06-27T07:21:53Z","pushed_at":"2026-06-27T07:43:25Z","security_policy_url":null,"distribution":{"owner_created_at":"2018-10-01T09:28:21Z","owner_type":"User","release_assets":[]}},"commit_sha":"76c3640761879784ef5f9bb48fd1fa5ef4c3197b","profile":{"lines_by_language":{"Rust":2272},"files_by_category":{"vendored":65,"source":8,"config":2,"docs":2,"generated":1},"source_lines":2272,"test_lines":0},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.7,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":54.9,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":51.0,"duplication":100.0,"lint":100.0,"testing":0.0,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 22% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing."},"security":{"score":67.5,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":42.9,"dependencies":75.3,"ci_actions":null,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 5 known vulnerabilities in 4 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":12.0,"checked":12.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":2.0,"attributed_commits":2.0,"attributed_commit_share":1.0,"effective_loc":2272.0,"attributed_loc":2272.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 2 attributed commits, 2,272 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"76c3640761879784ef5f9bb48fd1fa5ef4c3197b","url":"https://github.com/Yurzi/nvpaper/commit/76c3640761879784ef5f9bb48fd1fa5ef4c3197b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7b8fb4f7a9faee5f2532e924c1a91744eb20815a","url":"https://github.com/Yurzi/nvpaper/commit/7b8fb4f7a9faee5f2532e924c1a91744eb20815a","weight":0.9}],"data":{"attributed_loc_by_commit":{"7b8fb4f7a9faee5f2532e924c1a91744eb20815a":2272,"76c3640761879784ef5f9bb48fd1fa5ef4c3197b":0},"tools":{"claude-code":{"name":"Claude Code","commits":2,"loc":2272,"first_seen":1782544893,"last_seen":1782546167}},"monthly":{"2026-06":{"loc":2272,"attributed_loc":2272}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":0.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":0.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":0.0,"median_loc_per_hour":0.0,"pr_timed_units":0.0,"excluded_import_loc":2272.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["7b8fb4f7a9faee5f2532e924c1a91744eb20815a"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":2272.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":22.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":22.0,"weighted_findings":5.5,"scanned_lines":2272.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":103,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:103"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":110,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:110"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":120,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:120"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":125,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:125"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":143,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:143"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":165,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:165"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":172,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:172"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":189,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:189"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":192,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:192"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":193,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:193"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":203,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:203"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":265,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:265"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":268,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:268"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":287,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:287"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":289,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:289"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":292,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:292"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":300,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:300"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":304,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:304"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":319,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:319"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":359,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:359"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gpu/mod.rs","line":458,"fingerprint":"rust.lang.security.unsafe-usage:src/gpu/mod.rs:458"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"src/main.rs","line":79,"fingerprint":"rust.lang.security.args:src/main.rs:79"}],"evidence":[],"data":{"rulesets":["rust"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":4.0,"vulnerabilities":5.0,"vulns_critical":0.0,"vulns_high":2.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":3.0,"penalty":17.0},"findings":[{"rule_id":"osv/RUSTSEC-2026-0194","severity":"high","message":"quick-xml@0.39.4 (crates.io) is affected by RUSTSEC-2026-0194","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.39.4 (crates.io):RUSTSEC-2026-0194"},{"rule_id":"osv/RUSTSEC-2026-0195","severity":"high","message":"quick-xml@0.39.4 (crates.io) is affected by RUSTSEC-2026-0195","path":"Cargo.lock","line":null,"fingerprint":"quick-xml@0.39.4 (crates.io):RUSTSEC-2026-0195"},{"rule_id":"osv/RUSTSEC-2026-0190","severity":"medium","message":"anyhow@1.0.102 (crates.io) is affected by RUSTSEC-2026-0190","path":"Cargo.lock","line":null,"fingerprint":"anyhow@1.0.102 (crates.io):RUSTSEC-2026-0190"},{"rule_id":"osv/RUSTSEC-2024-0388","severity":"medium","message":"derivative@2.2.0 (crates.io) is affected by RUSTSEC-2024-0388","path":"Cargo.lock","line":null,"fingerprint":"derivative@2.2.0 (crates.io):RUSTSEC-2024-0388"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.4 (crates.io) is affected by RUSTSEC-2026-0486","path":"Cargo.lock","line":null,"fingerprint":"rustix@1.1.4 (crates.io):RUSTSEC-2026-0486"}],"evidence":[],"data":{"ecosystems":["crates.io"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":1.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":70.0,"function_nloc":1640.0,"mean_ccn":4.46,"p90_ccn":15.0,"complex_functions":3.0,"long_functions":3.0,"many_param_functions":1.0,"risky_nloc_share":0.2244},"findings":[],"evidence":[{"kind":"complex-function","description":"connect in src/wayland/mod.rs: complexity 18, 101 lines","ref":"src/wayland/mod.rs","url":"https://github.com/Yurzi/nvpaper/blob/76c3640761879784ef5f9bb48fd1fa5ef4c3197b/src/wayland/mod.rs#L326","weight":0.3},{"kind":"complex-function","description":"run in src/player.rs: complexity 17, 103 lines","ref":"src/player.rs","url":"https://github.com/Yurzi/nvpaper/blob/76c3640761879784ef5f9bb48fd1fa5ef4c3197b/src/player.rs#L18","weight":0.2833333333333333},{"kind":"complex-function","description":"main in src/main.rs: complexity 16, 54 lines","ref":"src/main.rs","url":"https://github.com/Yurzi/nvpaper/blob/76c3640761879784ef5f9bb48fd1fa5ef4c3197b/src/main.rs#L139","weight":0.26666666666666666},{"kind":"complex-function","description":"open in src/gpu/mod.rs: complexity 15, 110 lines","ref":"src/gpu/mod.rs","url":"https://github.com/Yurzi/nvpaper/blob/76c3640761879784ef5f9bb48fd1fa5ef4c3197b/src/gpu/mod.rs#L102","weight":0.25}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1675.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":8.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":2272.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":2272.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":1.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":128.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":2272.0,"other_lines":0.0,"files_blamed":8.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":0.0,"security:ai_findings":22.0,"security:ai_per_kloc":9.683,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":["unreviewed-ai-risk"]}