{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:07.426456Z","repo":{"ref":{"host":"github.com","owner":"romiojoseph","name":"cardboard"},"default_branch":"main","clone_url":"https://github.com/romiojoseph/cardboard.git","html_url":"https://github.com/romiojoseph/cardboard","description":"A simple, local note editor for Android and Windows.","stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":2554,"primary_language":"Dart","license_spdx":"Apache-2.0","created_at":"2026-07-21T09:03:46Z","pushed_at":"2026-09-06T10:07:28Z","security_policy_url":null,"distribution":{"owner_created_at":"2019-09-18T09:59:30Z","owner_type":"User","release_assets":[]}},"commit_sha":"f90adefa0dbcc21794897c190b871320308eb4c6","profile":{"lines_by_language":{"Dart":5803,"C++":494,"PowerShell":261,"C":185,"Kotlin":115},"files_by_category":{"source":46,"other":42,"config":15,"binary":12,"docs":5,"oversized":1,"test":1},"source_lines":6849,"test_lines":9},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.41,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":0.146},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":71.1,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":100.0,"duplication":76.0,"lint":100.0,"testing":30.1,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 5% duplicated lines. Weakest area: testing."},"security":{"score":86.7,"confidence":0.85,"coverage":1.0,"label":"strong","breakdown":{"secrets":100.0,"sast":100.0,"dependencies":100.0,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is strong: no high-impact findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":3.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":8700.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2026-07":{"loc":0,"attributed_loc":0},"2026-08":{"loc":4285,"attributed_loc":0},"2026-09":{"loc":4415,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":0.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":0.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":0.0,"median_loc_per_hour":0.0,"pr_timed_units":0.0,"excluded_import_loc":8700.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["2abb8bd815a0e286acb1f767bdcde9b2fe3f898d","f90adefa0dbcc21794897c190b871320308eb4c6"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":1.0,"flagged_releases":0.0,"max_loc_per_day":0.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"0.0.1","to":"1.0.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":6849.0,"index":0.146,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.146,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, find the length of the string with a safe upper bound (CWE-126).","ref":"windows/runner/utils.cpp:48","url":"https://github.com/romiojoseph/cardboard/blob/f90adefa0dbcc21794897c190b871320308eb4c6/windows/runner/utils.cpp#L48","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":0.0,"scanned_lines":794.0,"parse_errors":1.0},"findings":[],"evidence":[],"data":{"rulesets":["c","kotlin"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["Pub"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.3333,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":33.0,"function_nloc":319.0,"mean_ccn":2.15,"p90_ccn":4.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":4763.0,"duplicated_lines":218.0,"duplicated_share":0.0458,"files":46.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: lib/services/sync_server.dart:105 and lib/services/sync_server.dart:129","ref":"lib/services/sync_server.dart","url":"https://github.com/romiojoseph/cardboard/blob/f90adefa0dbcc21794897c190b871320308eb4c6/lib/services/sync_server.dart#L105","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/utils/markdown_utils.dart:111 and lib/utils/markdown_utils.dart:142","ref":"lib/utils/markdown_utils.dart","url":"https://github.com/romiojoseph/cardboard/blob/f90adefa0dbcc21794897c190b871320308eb4c6/lib/utils/markdown_utils.dart#L111","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/widgets/app_button.dart:31 and lib/widgets/app_button.dart:48","ref":"lib/widgets/app_button.dart","url":"https://github.com/romiojoseph/cardboard/blob/f90adefa0dbcc21794897c190b871320308eb4c6/lib/widgets/app_button.dart#L31","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/widgets/export_dialog.dart:32 and lib/widgets/export_dialog.dart:45","ref":"lib/widgets/export_dialog.dart","url":"https://github.com/romiojoseph/cardboard/blob/f90adefa0dbcc21794897c190b871320308eb4c6/lib/widgets/export_dialog.dart#L32","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/widgets/lan_sync_dialog.dart:246 and lib/widgets/lan_sync_dialog.dart:287","ref":"lib/widgets/lan_sync_dialog.dart","url":"https://github.com/romiojoseph/cardboard/blob/f90adefa0dbcc21794897c190b871320308eb4c6/lib/widgets/lan_sync_dialog.dart#L246","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: lib/widgets/markdown_editing_controller.dart:156 and lib/widgets/markdown_editing_controller.dart:171","ref":"lib/widgets/markdown_editing_controller.dart","url":"https://github.com/romiojoseph/cardboard/blob/f90adefa0dbcc21794897c190b871320308eb4c6/lib/widgets/markdown_editing_controller.dart#L156","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":794.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0026,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":9.0,"source_lines":6849.0,"test_ratio":0.0013,"ci_files":0.0,"cochange_share":0.5,"cochange_commits":2.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":39.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}