{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:23:14.877631Z","repo":{"ref":{"host":"github.com","owner":"kstenerud","name":"iOS-Universal-Framework"},"default_branch":"master","clone_url":"https://github.com/kstenerud/iOS-Universal-Framework.git","html_url":"https://github.com/kstenerud/iOS-Universal-Framework","description":"An XCode project template to build universal frameworks (arm7, arm7s, and simulator) for iOS / iPhone.","stars":2925,"forks":465,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":740,"primary_language":"Python","license_spdx":null,"created_at":"2011-03-06T16:31:39Z","pushed_at":"2020-10-01T20:18:58Z","security_policy_url":null,"distribution":{"owner_created_at":"2010-04-17T00:53:51Z","owner_type":"User","release_assets":[]}},"commit_sha":"7b88ec6b294ac83eb96251d7ea869300e7b1ff9b","profile":{"lines_by_language":{"Python":962,"Shell":575,"C":26,"Objective-C":26},"files_by_category":{"source":12,"other":9,"binary":3,"docs":2,"config":1},"source_lines":1589,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.58,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":33.3,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":100.0,"duplication":25.1,"lint":1.5,"testing":0.0,"docs":40.0,"type_safety":40.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 23% duplicated lines. Weakest area: testing."},"security":{"score":67.4,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":60.4,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 3 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":73.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":2672.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2011-03":{"loc":492,"attributed_loc":0},"2011-04":{"loc":0,"attributed_loc":0},"2011-05":{"loc":203,"attributed_loc":0},"2011-06":{"loc":0,"attributed_loc":0},"2011-07":{"loc":284,"attributed_loc":0},"2011-08":{"loc":104,"attributed_loc":0},"2011-09":{"loc":0,"attributed_loc":0},"2011-12":{"loc":0,"attributed_loc":0},"2012-02":{"loc":196,"attributed_loc":0},"2012-03":{"loc":0,"attributed_loc":0},"2012-05":{"loc":707,"attributed_loc":0},"2012-06":{"loc":624,"attributed_loc":0},"2012-11":{"loc":0,"attributed_loc":0},"2013-01":{"loc":1,"attributed_loc":0},"2013-03":{"loc":0,"attributed_loc":0},"2013-06":{"loc":0,"attributed_loc":0},"2013-09":{"loc":2,"attributed_loc":0},"2013-10":{"loc":1,"attributed_loc":0},"2013-11":{"loc":12,"attributed_loc":0},"2013-12":{"loc":0,"attributed_loc":0},"2014-03":{"loc":5,"attributed_loc":0},"2014-04":{"loc":0,"attributed_loc":0},"2014-09":{"loc":0,"attributed_loc":0},"2016-06":{"loc":41,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":24.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":2672.0,"pre_ai_era_burst_loc":0.0,"measured_loc":2672.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":176.75,"median_loc_per_hour":60.0,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":1.0,"flagged_releases":0.0,"max_loc_per_day":0.3},"findings":[],"evidence":[],"data":{"releases":[{"from":"Mk4-end-of-life","to":"Mk5-end-of-life","loc":4,"days":14.44,"loc_per_day":0.3,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":1589.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":3.0,"findings_high":3.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":2.25,"scanned_lines":1563.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"devel/build.py","line":4,"fingerprint":"python.lang.security.use-defused-xml:devel/build.py:4"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"devel/src/BuildFW.py","line":536,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:devel/src/BuildFW.py:536"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"devel/src/BuildFW.py","line":548,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:devel/src/BuildFW.py:548"}],"evidence":[],"data":{"rulesets":["python","bash","c"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":57.0,"function_nloc":436.0,"mean_ccn":2.93,"p90_ccn":7.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1184.0,"duplicated_lines":273.0,"duplicated_share":0.2306,"files":12.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: Fake Framework/Templates/Framework & Library/Fake Static iOS Framework.xctemplate/___PACKAGENAMEASIDENTIFIER___.h:2 and Real Framework/Templates/Framework & Library/Static iOS Framework.xctemplate/___PACKAGENAMEASIDENTIFIER___.h:2","ref":"Fake Framework/Templates/Framework & Library/Fake Static iOS Framework.xctemplate/___PACKAGENAMEASIDENTIFIER___.h","url":"https://github.com/kstenerud/iOS-Universal-Framework/blob/7b88ec6b294ac83eb96251d7ea869300e7b1ff9b/Fake Framework/Templates/Framework & Library/Fake Static iOS Framework.xctemplate/___PACKAGENAMEASIDENTIFIER___.h#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Fake Framework/Templates/Framework & Library/Fake Static iOS Framework.xctemplate/___PACKAGENAMEASIDENTIFIER___.m:2 and Real Framework/Templates/Framework & Library/Static iOS Framework.xctemplate/___PACKAGENAMEASIDENTIFIER___.m:2","ref":"Fake Framework/Templates/Framework & Library/Fake Static iOS Framework.xctemplate/___PACKAGENAMEASIDENTIFIER___.m","url":"https://github.com/kstenerud/iOS-Universal-Framework/blob/7b88ec6b294ac83eb96251d7ea869300e7b1ff9b/Fake Framework/Templates/Framework & Library/Fake Static iOS Framework.xctemplate/___PACKAGENAMEASIDENTIFIER___.m#L2","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Fake Framework/install.sh:1 and Fake Framework/uninstall.sh:1","ref":"Fake Framework/install.sh","url":"https://github.com/kstenerud/iOS-Universal-Framework/blob/7b88ec6b294ac83eb96251d7ea869300e7b1ff9b/Fake Framework/install.sh#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Fake Framework/install.sh:30 and Real Framework/install.sh:79","ref":"Fake Framework/install.sh","url":"https://github.com/kstenerud/iOS-Universal-Framework/blob/7b88ec6b294ac83eb96251d7ea869300e7b1ff9b/Fake Framework/install.sh#L30","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Fake Framework/uninstall.sh:44 and Real Framework/uninstall.sh:104","ref":"Fake Framework/uninstall.sh","url":"https://github.com/kstenerud/iOS-Universal-Framework/blob/7b88ec6b294ac83eb96251d7ea869300e7b1ff9b/Fake Framework/uninstall.sh#L44","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Real Framework/install.sh:16 and Real Framework/uninstall.sh:18","ref":"Real Framework/install.sh","url":"https://github.com/kstenerud/iOS-Universal-Framework/blob/7b88ec6b294ac83eb96251d7ea869300e7b1ff9b/Real Framework/install.sh#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: Real Framework/uninstall.sh:8 and Real Framework/uninstall_legacy.sh:8","ref":"Real Framework/uninstall.sh","url":"https://github.com/kstenerud/iOS-Universal-Framework/blob/7b88ec6b294ac83eb96251d7ea869300e7b1ff9b/Real Framework/uninstall.sh#L8","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":15.0,"weighted_findings":26.25,"scanned_lines":1563.0,"category:best-practice":7.0,"category:correctness":8.0},"findings":[{"rule_id":"opengrep/python.lang.correctness.return-in-init","severity":"high","message":"`return` should never appear inside a class __init__ function. This will cause a runtime error.","path":"devel/src/BuildFW.py","line":195,"fingerprint":"python.lang.correctness.return-in-init:devel/src/BuildFW.py:195"},{"rule_id":"opengrep/python.lang.correctness.return-in-init","severity":"high","message":"`return` should never appear inside a class __init__ function. This will cause a runtime error.","path":"devel/src/BuildFW.py","line":196,"fingerprint":"python.lang.correctness.return-in-init:devel/src/BuildFW.py:196"},{"rule_id":"opengrep/python.lang.correctness.return-in-init","severity":"high","message":"`return` should never appear inside a class __init__ function. This will cause a runtime error.","path":"devel/src/BuildFW.py","line":197,"fingerprint":"python.lang.correctness.return-in-init:devel/src/BuildFW.py:197"},{"rule_id":"opengrep/python.lang.correctness.return-in-init","severity":"high","message":"`return` should never appear inside a class __init__ function. This will cause a runtime error.","path":"devel/src/BuildFW.py","line":198,"fingerprint":"python.lang.correctness.return-in-init:devel/src/BuildFW.py:198"},{"rule_id":"opengrep/python.lang.correctness.return-in-init","severity":"high","message":"`return` should never appear inside a class __init__ function. This will cause a runtime error.","path":"devel/src/BuildFW.py","line":199,"fingerprint":"python.lang.correctness.return-in-init:devel/src/BuildFW.py:199"},{"rule_id":"opengrep/python.lang.correctness.no-strings-as-booleans","severity":"high","message":"Using strings as booleans in Python has unexpected results. `\"one\" and \"two\"` will return \"two\". `\"one\" or \"two\"` will return \"one\". In Python, strings are truthy, and strings with a non-zero length evaluate to True.","path":"devel/src/BuildFW.py","line":840,"fingerprint":"python.lang.correctness.no-strings-as-booleans:devel/src/BuildFW.py:840"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"devel/build.py","line":7,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:devel/build.py:7"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"devel/build.py","line":18,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:devel/build.py:18"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"devel/src/BuildFW.py","line":167,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:devel/src/BuildFW.py:167"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"devel/src/BuildFW.py","line":174,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:devel/src/BuildFW.py:174"},{"rule_id":"opengrep/python.lang.correctness.use-sys-exit","severity":"medium","message":"Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations.","path":"update_project.py","line":25,"fingerprint":"python.lang.correctness.use-sys-exit:update_project.py:25"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"update_project.py","line":31,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:update_project.py:31"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"update_project.py","line":36,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:update_project.py:36"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"update_project.py","line":61,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:update_project.py:61"},{"rule_id":"opengrep/python.lang.correctness.useless-eqeq","severity":"low","message":"This expression is always True: `config_framework_type == config_framework_type` or `config_framework_type != config_framework_type`. If testing for floating point NaN, use `math.isnan(config_framework_type)`, or `cmath.isnan(config_framework_type)` if the number is complex.","path":"devel/src/BuildFW.py","line":824,"fingerprint":"python.lang.correctness.useless-eqeq:devel/src/BuildFW.py:824"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":1589.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":29.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":482.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}