{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:02.747190Z","repo":{"ref":{"host":"github.com","owner":"aosus","name":"matrix-privacy-link-bot"},"default_branch":"master","clone_url":"https://github.com/aosus/matrix-privacy-link-bot.git","html_url":"https://github.com/aosus/matrix-privacy-link-bot","description":"A matrix bot that automatically replies with a link to alternative frontends","stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":190,"primary_language":"Python","license_spdx":"AGPL-3.0","created_at":"2022-11-29T21:28:41Z","pushed_at":"2026-01-28T14:31:56Z","security_policy_url":null,"distribution":{"owner_created_at":"2015-12-26T22:53:08Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"4f06ced27d8abcc0ee79b47cb1bc7dcc1e80b521","profile":{"lines_by_language":{"Python":609},"files_by_category":{"config":6,"docs":2,"other":1,"source":1,"test":1},"source_lines":422,"test_lines":187},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.9,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":58.0,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":22.7,"duplication":100.0,"lint":60.7,"testing":60.2,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.44, no CI test run detected; 49% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity."},"security":{"score":69.2,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":91.6,"dependencies":null,"ci_actions":34.0,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 6 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":82.0,"attributed_commits":20.0,"attributed_commit_share":0.24390243902439024,"effective_loc":810.0,"attributed_loc":810.0,"attributed_loc_share":1.0,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Jules: 11 attributed commits, 512 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 9 attributed commits, 298 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"4dd511f03c7bf28c66b140645f728d7dd407980c","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/4dd511f03c7bf28c66b140645f728d7dd407980c","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"0ade7bc7ef3654699cf78a6c1960417c2860f7fd","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/0ade7bc7ef3654699cf78a6c1960417c2860f7fd","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"eb9e0a83132e23671c1ad17e2d58284bf09a6019","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/eb9e0a83132e23671c1ad17e2d58284bf09a6019","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"8013a93c7030934466803f3de6d4e036427670a0","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/8013a93c7030934466803f3de6d4e036427670a0","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"0deffa98441f60e63f1726fb748d5cc1be1b6191","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/0deffa98441f60e63f1726fb748d5cc1be1b6191","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"c14cd999c96772926881971e35bab896ea7ed444","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/c14cd999c96772926881971e35bab896ea7ed444","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"f03cf9a405e0b971cfb80f373d25e51c44851d5b","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/f03cf9a405e0b971cfb80f373d25e51c44851d5b","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"95e2286744e8e7c64aa2343a1bc112087606e54d","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/95e2286744e8e7c64aa2343a1bc112087606e54d","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"cdf0cf1d8a57ba198e37b1f8ba0033b15d8f7fa4","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/cdf0cf1d8a57ba198e37b1f8ba0033b15d8f7fa4","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"0cec670d83cfaee101dcce0018ed63bf9ce6d5f7","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/0cec670d83cfaee101dcce0018ed63bf9ce6d5f7","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"ee7e3c9fddb0c7a2949a8ca0829b16dc8fca7dd1","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/ee7e3c9fddb0c7a2949a8ca0829b16dc8fca7dd1","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"03ab72b127dce648ae551df2596788dc36e60d92","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/03ab72b127dce648ae551df2596788dc36e60d92","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"38b115ad6a3a3f8b6437aa164fb80983ee69cc01","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/38b115ad6a3a3f8b6437aa164fb80983ee69cc01","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"3d0cfe9af985424dea1948d006e432d8851f65d2","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/3d0cfe9af985424dea1948d006e432d8851f65d2","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"3d1071bff42a5ce54cbef6d526524f55416f640d","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/3d1071bff42a5ce54cbef6d526524f55416f640d","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"47d35394a629085dd6d9b65367e9b372cf5860e9","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/47d35394a629085dd6d9b65367e9b372cf5860e9","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"5db963467e05bf0c028c826f7cc363ae86de9ec9","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/5db963467e05bf0c028c826f7cc363ae86de9ec9","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"e9b53d8e05804ad3d2ae8ae76502cd67600778c7","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/e9b53d8e05804ad3d2ae8ae76502cd67600778c7","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"9713d2caf3aea04b9882193e6584d5b5b78fcc4a","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/9713d2caf3aea04b9882193e6584d5b5b78fcc4a","weight":0.9},{"kind":"attributed-commit","description":"Jules: author google-labs-jules[bot]","ref":"70a22d3469a86833184b97c307911f6f44f73d3a","url":"https://github.com/aosus/matrix-privacy-link-bot/commit/70a22d3469a86833184b97c307911f6f44f73d3a","weight":0.9}],"data":{"attributed_loc_by_commit":{"70a22d3469a86833184b97c307911f6f44f73d3a":240,"9713d2caf3aea04b9882193e6584d5b5b78fcc4a":0,"e9b53d8e05804ad3d2ae8ae76502cd67600778c7":48,"5db963467e05bf0c028c826f7cc363ae86de9ec9":30,"47d35394a629085dd6d9b65367e9b372cf5860e9":69,"3d1071bff42a5ce54cbef6d526524f55416f640d":6,"3d0cfe9af985424dea1948d006e432d8851f65d2":10,"38b115ad6a3a3f8b6437aa164fb80983ee69cc01":27,"03ab72b127dce648ae551df2596788dc36e60d92":14,"ee7e3c9fddb0c7a2949a8ca0829b16dc8fca7dd1":8,"0cec670d83cfaee101dcce0018ed63bf9ce6d5f7":60,"cdf0cf1d8a57ba198e37b1f8ba0033b15d8f7fa4":0,"95e2286744e8e7c64aa2343a1bc112087606e54d":0,"f03cf9a405e0b971cfb80f373d25e51c44851d5b":24,"c14cd999c96772926881971e35bab896ea7ed444":0,"0deffa98441f60e63f1726fb748d5cc1be1b6191":67,"8013a93c7030934466803f3de6d4e036427670a0":0,"eb9e0a83132e23671c1ad17e2d58284bf09a6019":185,"0ade7bc7ef3654699cf78a6c1960417c2860f7fd":0,"4dd511f03c7bf28c66b140645f728d7dd407980c":22},"tools":{"jules":{"name":"Jules","commits":11,"loc":512,"first_seen":1750885902,"last_seen":1750979151},"github-copilot":{"name":"GitHub Copilot coding agent","commits":9,"loc":298,"first_seen":1754417585,"last_seen":1769610338}},"monthly":{"2021-03":{"loc":0,"attributed_loc":0},"2021-04":{"loc":0,"attributed_loc":0},"2021-05":{"loc":0,"attributed_loc":0},"2021-06":{"loc":0,"attributed_loc":0},"2021-08":{"loc":0,"attributed_loc":0},"2022-01":{"loc":0,"attributed_loc":0},"2022-03":{"loc":0,"attributed_loc":0},"2022-11":{"loc":0,"attributed_loc":0},"2025-06":{"loc":512,"attributed_loc":512},"2025-08":{"loc":91,"attributed_loc":91},"2026-01":{"loc":207,"attributed_loc":207}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":6.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":810.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":60.0,"median_loc_per_hour":51.25171939477304,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":422.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1.0,"findings_high":0.0,"findings_medium":1.0,"findings_low":0.0,"weighted_findings":0.25,"scanned_lines":422.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"matrix_bot.py","line":189,"fingerprint":"python.lang.security.audit.regex_dos:matrix_bot.py:189"}],"evidence":[],"data":{"rulesets":["python","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":7.0,"findings_high":6.0,"findings_medium":1.0,"findings_low":0.0,"penalty":64.8},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker-publish.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/docker-publish.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker-publish.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/docker-publish.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker-publish.yml","line":31,"fingerprint":"unpinned-uses:.github/workflows/docker-publish.yml:31"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker-publish.yml","line":39,"fingerprint":"unpinned-uses:.github/workflows/docker-publish.yml:39"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker-publish.yml","line":47,"fingerprint":"unpinned-uses:.github/workflows/docker-publish.yml:47"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/docker-publish.yml","line":26,"fingerprint":"cache-poisoning:.github/workflows/docker-publish.yml:26"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/docker-publish.yml","line":22,"fingerprint":"artipacked:.github/workflows/docker-publish.yml:22"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.2927,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":10.0,"function_nloc":237.0,"mean_ccn":6.8,"p90_ccn":16.0,"complex_functions":2.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.4937},"findings":[],"evidence":[{"kind":"complex-function","description":"mk_newlinks in matrix_bot.py: complexity 16, 48 lines","ref":"matrix_bot.py","url":"https://github.com/aosus/matrix-privacy-link-bot/blob/4f06ced27d8abcc0ee79b47cb1bc7dcc1e80b521/matrix_bot.py#L47","weight":0.26666666666666666},{"kind":"complex-function","description":"main in matrix_bot.py: complexity 16, 69 lines","ref":"matrix_bot.py","url":"https://github.com/aosus/matrix-privacy-link-bot/blob/4f06ced27d8abcc0ee79b47cb1bc7dcc1e80b521/matrix_bot.py#L278","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":326.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":1.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"weighted_findings":2.0,"scanned_lines":422.0,"category:best-practice":2.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"matrix_bot.py","line":142,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:matrix_bot.py:142"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"matrix_bot.py","line":153,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:matrix_bot.py:153"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.8863,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.3077,"test_lines":187.0,"source_lines":422.0,"test_ratio":0.4431,"ci_files":1.0,"cochange_share":0.0769,"cochange_commits":13.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/docker-publish.yml","ref":".github/workflows/docker-publish.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":60.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":422.0,"other_lines":0.0,"files_blamed":1.0,"blame_failures":0.0,"quality:ai_findings":2.0,"quality:ai_per_kloc":4.739,"quality:other_findings":0.0,"security:ai_findings":1.0,"security:ai_per_kloc":2.37,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}