{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:59:11.899016Z","repo":{"ref":{"host":"github.com","owner":"eli1982","name":"codex-bridge-desktop"},"default_branch":"main","clone_url":"https://github.com/eli1982/codex-bridge-desktop.git","html_url":"https://github.com/eli1982/codex-bridge-desktop","description":"Local Codex and ChatGPT bridge lifecycle app","stars":24,"forks":7,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":76,"primary_language":"PowerShell","license_spdx":"MIT","created_at":"2026-10-07T19:08:53Z","pushed_at":"2026-10-07T20:21:50Z","security_policy_url":"https://github.com/eli1982/codex-bridge-desktop/security/policy","distribution":{"owner_created_at":"2014-11-27T10:14:08Z","owner_type":"User","release_assets":[]}},"commit_sha":"4c4bb4967bc186704b92256b57a41b9e23a45ea5","profile":{"lines_by_language":{"PowerShell":1304,"Python":714,"C#":195,"Shell":114},"files_by_category":{"source":14,"docs":11,"binary":5,"config":4,"other":3,"test":2},"source_lines":2159,"test_lines":168},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.42,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":65.4,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":70.1,"duplication":100.0,"lint":4.4,"testing":68.9,"docs":100.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.08, CI runs tests; 12% of function code in complex or long functions; 0% duplicated lines. Weakest area: lint."},"security":{"score":72.4,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":40.3,"dependencies":null,"ci_actions":90.8,"posture":40.0,"scorecard":null},"summary":"Security posture is adequate: 2 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":6.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":2345.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-10":{"loc":2345,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":2.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":293.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":49.5,"median_loc_per_hour":49.5,"pr_timed_units":0.0,"excluded_import_loc":2052.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["3685d5dff01c48db19e123bc78d0be601cd31e56"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":2159.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":5.0,"findings_high":2.0,"findings_medium":3.0,"findings_low":0.0,"weighted_findings":2.6,"scanned_lines":855.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"unix/bridge.py","line":160,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:unix/bridge.py:160"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"unix/bridge.py","line":284,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:unix/bridge.py:284"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/ci_build_gate.py","line":32,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/ci_build_gate.py:32"},{"rule_id":"opengrep/python.lang.security.audit.insecure-file-permissions","severity":"medium","message":"These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. [confidence medium]","path":"unix/bridge.py","line":33,"fingerprint":"python.lang.security.audit.insecure-file-permissions:unix/bridge.py:33"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"unix/bridge.py","line":101,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:unix/bridge.py:101"}],"evidence":[],"data":{"rulesets":["python","csharp","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":5.0,"findings_high":0.0,"findings_medium":4.0,"findings_low":1.0,"penalty":5.8},"findings":[{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/checks.yml","line":23,"fingerprint":"artipacked:.github/workflows/checks.yml:23"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/checks.yml","line":36,"fingerprint":"artipacked:.github/workflows/checks.yml:36"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/checks.yml","line":66,"fingerprint":"artipacked:.github/workflows/checks.yml:66"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/checks.yml","line":101,"fingerprint":"artipacked:.github/workflows/checks.yml:101"},{"rule_id":"zizmor/excessive-permissions","severity":"low","message":"overly broad permissions [confidence high]","path":".github/workflows/checks.yml","line":10,"fingerprint":"excessive-permissions:.github/workflows/checks.yml:10"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":31.0,"function_nloc":515.0,"mean_ccn":5.03,"p90_ccn":12.0,"complex_functions":1.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.1184},"findings":[],"evidence":[{"kind":"complex-function","description":"daemon in unix/bridge.py: complexity 22, 61 lines","ref":"unix/bridge.py","url":"https://github.com/eli1982/codex-bridge-desktop/blob/4c4bb4967bc186704b92256b57a41b9e23a45ea5/unix/bridge.py#L182","weight":0.36666666666666664}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1774.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":14.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":6.0,"weighted_findings":12.5,"scanned_lines":855.0,"category:best-practice":4.0,"category:correctness":2.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"unix/bridge.py","line":148,"fingerprint":"python.lang.best-practice.arbitrary-sleep:unix/bridge.py:148"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"unix/bridge.py","line":172,"fingerprint":"python.lang.best-practice.arbitrary-sleep:unix/bridge.py:172"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"unix/bridge.py","line":220,"fingerprint":"python.lang.best-practice.arbitrary-sleep:unix/bridge.py:220"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"unix/bridge.py","line":295,"fingerprint":"python.lang.best-practice.arbitrary-sleep:unix/bridge.py:295"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/build-unix.sh","line":56,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/build-unix.sh:56"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"scripts/build-unix.sh","line":57,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:scripts/build-unix.sh:57"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1556,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":168.0,"source_lines":2159.0,"test_ratio":0.0778,"ci_files":1.0,"cochange_share":1.0,"cochange_commits":3.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/checks.yml","ref":".github/workflows/checks.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (unittest)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["unittest"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":56.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}