{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:22:02.002757Z","repo":{"ref":{"host":"github.com","owner":"zenazn","name":"goji"},"default_branch":"master","clone_url":"https://github.com/zenazn/goji.git","html_url":"https://github.com/zenazn/goji","description":"Goji is a minimalistic web framework for Golang that's high in antioxidants.","stars":3642,"forks":219,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":301,"primary_language":"Go","license_spdx":"MIT","created_at":"2014-03-01T23:59:25Z","pushed_at":"2020-10-27T15:42:27Z","security_policy_url":null,"distribution":{"owner_created_at":"2008-06-07T23:03:43Z","owner_type":"User","release_assets":[]}},"commit_sha":"a16712d37ba72246f71f9c8012974d46f8e61d16","profile":{"lines_by_language":{"Go":6458},"files_by_category":{"source":54,"test":19,"docs":3,"config":2},"source_lines":4348,"test_lines":2110},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":76.0,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":85.8,"duplication":69.0,"lint":100.0,"testing":86.8,"docs":65.0,"type_safety":null,"process":15.0},"summary":"Code quality is adequate: test-to-source ratio 0.49, CI runs tests; 5% of function code in complex or long functions; 6% duplicated lines. Weakest area: process."},"security":{"score":69.0,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":86.9,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":25.0},"summary":"Security posture is weak: no high-impact findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":2.5,"check:Code-Review":3.0,"check:Maintained":0.0,"check:Binary-Artifacts":10.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:Fuzzing":0.0,"check:License":10.0,"check:Branch-Protection":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 3/10 (Found 10/29 approved changesets -- score normalized to 3)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/zenazn/goji","weight":0.7},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/zenazn/goji","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/zenazn/goji","weight":0.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/zenazn/goji","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/zenazn/goji","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/zenazn/goji","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/zenazn/goji","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/zenazn/goji","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/zenazn/goji","weight":1.0}],"data":{"date":"2026-11-09","commit":"a16712d37ba72246f71f9c8012974d46f8e61d16","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":227.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":10739.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2014-03":{"loc":5198,"attributed_loc":0},"2014-04":{"loc":785,"attributed_loc":0},"2014-05":{"loc":742,"attributed_loc":0},"2014-06":{"loc":113,"attributed_loc":0},"2014-07":{"loc":43,"attributed_loc":0},"2014-08":{"loc":218,"attributed_loc":0},"2014-09":{"loc":351,"attributed_loc":0},"2014-10":{"loc":552,"attributed_loc":0},"2014-11":{"loc":201,"attributed_loc":0},"2014-12":{"loc":1136,"attributed_loc":0},"2015-01":{"loc":419,"attributed_loc":0},"2015-02":{"loc":233,"attributed_loc":0},"2015-04":{"loc":311,"attributed_loc":0},"2015-05":{"loc":94,"attributed_loc":0},"2015-06":{"loc":21,"attributed_loc":0},"2015-07":{"loc":1,"attributed_loc":0},"2015-08":{"loc":31,"attributed_loc":0},"2015-11":{"loc":22,"attributed_loc":0},"2016-01":{"loc":88,"attributed_loc":0},"2016-02":{"loc":0,"attributed_loc":0},"2016-03":{"loc":46,"attributed_loc":0},"2016-05":{"loc":0,"attributed_loc":0},"2016-08":{"loc":22,"attributed_loc":0},"2017-08":{"loc":20,"attributed_loc":0},"2018-03":{"loc":1,"attributed_loc":0},"2018-08":{"loc":1,"attributed_loc":0},"2018-09":{"loc":10,"attributed_loc":0},"2018-10":{"loc":0,"attributed_loc":0},"2018-12":{"loc":41,"attributed_loc":0},"2019-05":{"loc":39,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":113.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":10739.0,"pre_ai_era_burst_loc":0.0,"measured_loc":10739.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":287.5,"median_loc_per_hour":78.42832133826103,"pr_timed_units":4.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":6.0,"flagged_releases":0.0,"max_loc_per_day":153.5},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.8","to":"v0.8.1","loc":23,"days":1.84,"loc_per_day":12.5,"flagged":false},{"from":"v0.8.1","to":"v0.8.2","loc":1237,"days":62.14,"loc_per_day":19.9,"flagged":false},{"from":"v0.8.2","to":"v0.8.3","loc":299,"days":1.95,"loc_per_day":153.5,"flagged":false},{"from":"v0.8.3","to":"v0.9.0","loc":68,"days":24.98,"loc_per_day":2.7,"flagged":false},{"from":"v0.9.0","to":"v1.0","loc":847,"days":461.96,"loc_per_day":1.8,"flagged":false},{"from":"v1.0","to":"v1.0.1","loc":134,"days":1120.25,"loc_per_day":0.1,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":4348.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"findings_high":0.0,"findings_medium":4.0,"findings_low":0.0,"weighted_findings":1.75,"scanned_lines":4348.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"graceful/clone16.go","line":11,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:graceful/clone16.go:11"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"web/atomic.go","line":11,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:web/atomic.go:11"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"web/atomic.go","line":16,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:web/atomic.go:16"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"web/atomic.go","line":17,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:web/atomic.go:17"}],"evidence":[],"data":{"rulesets":["go"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":280.0,"function_nloc":2179.0,"mean_ccn":2.14,"p90_ccn":4.0,"complex_functions":2.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0509},"findings":[],"evidence":[{"kind":"complex-function","description":"match in web/string_pattern.go: complexity 19, 54 lines","ref":"web/string_pattern.go","url":"https://github.com/zenazn/goji/blob/a16712d37ba72246f71f9c8012974d46f8e61d16/web/string_pattern.go#L28","weight":0.31666666666666665},{"kind":"complex-function","description":"route in web/bytecode_runner.go: complexity 17, 57 lines","ref":"web/bytecode_runner.go","url":"https://github.com/zenazn/goji/blob/a16712d37ba72246f71f9c8012974d46f8e61d16/web/bytecode_runner.go#L23","weight":0.2833333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":2923.0,"duplicated_lines":181.0,"duplicated_share":0.0619,"files":54.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: graceful/middleware.go:22 and web/mutil/writer_proxy.go:35","ref":"graceful/middleware.go","url":"https://github.com/zenazn/goji/blob/a16712d37ba72246f71f9c8012974d46f8e61d16/graceful/middleware.go#L22","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: graceful/serve.go:16 and graceful/serve13.go:62","ref":"graceful/serve.go","url":"https://github.com/zenazn/goji/blob/a16712d37ba72246f71f9c8012974d46f8e61d16/graceful/serve.go#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: web/mutil/writer_proxy.go:6 and web/mutil/writer_proxy_go1_8.go:6","ref":"web/mutil/writer_proxy.go","url":"https://github.com/zenazn/goji/blob/a16712d37ba72246f71f9c8012974d46f8e61d16/web/mutil/writer_proxy.go#L6","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":4348.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.9706,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.75,"test_lines":2110.0,"source_lines":4348.0,"test_ratio":0.4853,"ci_files":1.0,"cochange_share":0.1875,"cochange_commits":176.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":131.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}