{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:30:49.601639Z","repo":{"ref":{"host":"github.com","owner":"pcwalton","name":"sprocketnes"},"default_branch":"master","clone_url":"https://github.com/pcwalton/sprocketnes.git","html_url":"https://github.com/pcwalton/sprocketnes","description":"NES emulator written in Rust","stars":757,"forks":54,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":355,"primary_language":"Rust","license_spdx":"MIT","created_at":"2012-10-14T06:22:28Z","pushed_at":"2019-10-23T12:28:56Z","security_policy_url":null,"distribution":{"owner_created_at":"2009-11-25T04:40:05Z","owner_type":"User","release_assets":[]}},"commit_sha":"163e5da03c6c1db2f78898a001f13d4dd739f0ff","profile":{"lines_by_language":{"Rust":5189},"files_by_category":{"source":14,"config":2,"other":1,"generated":1,"docs":1},"source_lines":5189,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":66.2,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":100.0,"duplication":98.3,"lint":100.0,"testing":0.0,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing."},"security":{"score":73.5,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":80.3,"dependencies":70.5,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 3 known vulnerabilities in 3 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":4.0,"checked":4.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":171.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":11828.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2013-01":{"loc":2202,"attributed_loc":0},"2013-02":{"loc":3200,"attributed_loc":0},"2013-03":{"loc":1083,"attributed_loc":0},"2013-07":{"loc":270,"attributed_loc":0},"2013-08":{"loc":48,"attributed_loc":0},"2013-09":{"loc":23,"attributed_loc":0},"2013-11":{"loc":68,"attributed_loc":0},"2014-01":{"loc":337,"attributed_loc":0},"2014-03":{"loc":186,"attributed_loc":0},"2014-04":{"loc":169,"attributed_loc":0},"2014-05":{"loc":740,"attributed_loc":0},"2014-07":{"loc":282,"attributed_loc":0},"2014-08":{"loc":51,"attributed_loc":0},"2014-10":{"loc":77,"attributed_loc":0},"2014-11":{"loc":16,"attributed_loc":0},"2015-04":{"loc":99,"attributed_loc":0},"2015-07":{"loc":1306,"attributed_loc":0},"2015-12":{"loc":0,"attributed_loc":0},"2019-01":{"loc":1671,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":88.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":11828.0,"pre_ai_era_burst_loc":0.0,"measured_loc":11828.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":342.2427035330261,"median_loc_per_hour":62.0,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":5189.0,"index":0.193,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.193,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, mix all sample buffers into the first one.","ref":"src/apu.rs:763","url":"https://github.com/pcwalton/sprocketnes/blob/163e5da03c6c1db2f78898a001f13d4dd739f0ff/src/apu.rs#L763","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":13.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":13.0,"weighted_findings":3.25,"scanned_lines":5189.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/apu.rs","line":788,"fingerprint":"rust.lang.security.unsafe-usage:src/apu.rs:788"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/apu.rs","line":797,"fingerprint":"rust.lang.security.unsafe-usage:src/apu.rs:797"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/audio.rs","line":43,"fingerprint":"rust.lang.security.unsafe-usage:src/audio.rs:43"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/audio.rs","line":71,"fingerprint":"rust.lang.security.unsafe-usage:src/audio.rs:71"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/audio.rs","line":73,"fingerprint":"rust.lang.security.unsafe-usage:src/audio.rs:73"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/audio.rs","line":85,"fingerprint":"rust.lang.security.unsafe-usage:src/audio.rs:85"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/audio.rs","line":105,"fingerprint":"rust.lang.security.unsafe-usage:src/audio.rs:105"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/audio.rs","line":117,"fingerprint":"rust.lang.security.unsafe-usage:src/audio.rs:117"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"src/bin/nes.rs","line":33,"fingerprint":"rust.lang.security.args:src/bin/nes.rs:33"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/gfx.rs","line":412,"fingerprint":"rust.lang.security.unsafe-usage:src/gfx.rs:412"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/speex.rs","line":47,"fingerprint":"rust.lang.security.unsafe-usage:src/speex.rs:47"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/speex.rs","line":65,"fingerprint":"rust.lang.security.unsafe-usage:src/speex.rs:65"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"src/speex.rs","line":87,"fingerprint":"rust.lang.security.unsafe-usage:src/speex.rs:87"}],"evidence":[],"data":{"rulesets":["rust"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":3.0,"vulnerabilities":3.0,"vulns_critical":1.0,"vulns_high":0.0,"vulns_medium":1.0,"vulns_low":0.0,"vulns_unknown":1.0,"penalty":21.0},"findings":[{"rule_id":"osv/GHSA-mmc9-pwm7-qj5w","severity":"critical","message":"rand_core@0.3.0 (crates.io) is affected by RUSTSEC-2019-0035, GHSA-mmc9-pwm7-qj5w","path":"Cargo.lock","line":null,"fingerprint":"rand_core@0.3.0 (crates.io):GHSA-mmc9-pwm7-qj5w"},{"rule_id":"osv/RUSTSEC-2025-0124","severity":"medium","message":"rand_os@0.1.1 (crates.io) is affected by RUSTSEC-2025-0124","path":"Cargo.lock","line":null,"fingerprint":"rand_os@0.1.1 (crates.io):RUSTSEC-2025-0124"},{"rule_id":"osv/GHSA-wcg3-cvx6-7396","severity":"medium","message":"time@0.1.42 (crates.io) is affected by RUSTSEC-2020-0071, GHSA-wcg3-cvx6-7396","path":"Cargo.lock","line":null,"fingerprint":"time@0.1.42 (crates.io):GHSA-wcg3-cvx6-7396"}],"evidence":[],"data":{"ecosystems":["crates.io"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0234,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":377.0,"function_nloc":2701.0,"mean_ccn":1.76,"p90_ccn":4.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":3437.0,"duplicated_lines":10.0,"duplicated_share":0.0029,"files":14.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/apu.rs:492 and src/apu.rs:495","ref":"src/apu.rs","url":"https://github.com/pcwalton/sprocketnes/blob/163e5da03c6c1db2f78898a001f13d4dd739f0ff/src/apu.rs#L492","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":5189.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":5189.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":149.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":31.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"COPYING","ref":"COPYING","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}