Leaderboard github.com

2dust/v2rayN

A GUI client for Windows, Linux and macOS, support Xray and sing-box and others

View repository ↗
C#
★ 120,607
commit 2c90ed1a9438
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

explicit

Confidence: 95%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

67/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

64/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

2% explicit

Explicit AI attribution on 2% of first-party code added; an estimated 2% including velocity signals.

How the score is built

Explicitly attributed share2%
Unattributed share in AI-pace bursts4%
Estimated AI-generated share2%
AI tool configuration files0
Work sessions at AI pace3
Releases at AI pace0
Coding-style index (1.0+ means possible)0.02

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
GitHub Copilot coding agent	2	2,897	2026-02-28	2026-05-11
OpenAI Codex	20	1,231	2026-08-14	2026-11-14
Claude Code	13	569	2026-08-09	2026-11-05

Lines added per month all AI-attributed share

2019-1015,735 · 0% AI
2019-11613 · 0% AI
2019-121,133 · 0% AI
2020-0148 · 0% AI
2020-02351 · 0% AI
2020-033,331 · 0% AI
2020-042,331 · 0% AI
2020-0649 · 0% AI
2020-07215 · 0% AI
2020-081,202 · 0% AI
2020-095 · 0% AI
2020-10688 · 0% AI
2020-1116 · 0% AI
2020-122,156 · 0% AI
2021-012,820 · 0% AI
2021-02443 · 0% AI
2021-03130 · 0% AI
2021-0485 · 0% AI
2021-051,317 · 0% AI
2021-062 · 0% AI
2021-07150 · 0% AI
2021-082 · 0% AI
2021-10438 · 0% AI
2021-1155 · 0% AI
2021-121,428 · 0% AI
2022-01608 · 0% AI
2022-02629 · 0% AI
2022-034,053 · 0% AI
2022-041,891 · 0% AI
2022-05309 · 0% AI
2022-06743 · 0% AI
2022-07638 · 0% AI
2022-08413 · 0% AI
2022-0962 · 0% AI
2022-1087 · 0% AI
2022-1158 · 0% AI
2022-1237 · 0% AI
2023-0110,411 · 0% AI
2023-022,878 · 0% AI
2023-03747 · 0% AI
2023-044,115 · 0% AI
2023-051,187 · 0% AI
2023-06139 · 0% AI
2023-07122 · 0% AI
2023-084 · 0% AI
2023-0937 · 0% AI
2023-105 · 0% AI
2023-111,191 · 0% AI
2023-121,882 · 0% AI
2024-011,299 · 0% AI
2024-021,144 · 0% AI
2024-031,168 · 0% AI
2024-041,024 · 0% AI
2024-05884 · 0% AI
2024-063,746 · 0% AI
2024-073,025 · 0% AI
2024-086,519 · 0% AI
2024-092,171 · 0% AI
2024-107,927 · 0% AI
2024-112,726 · 0% AI
2024-121,028 · 0% AI
2025-012,709 · 0% AI
2025-021,865 · 0% AI
2025-031,653 · 0% AI
2025-0421,900 · 0% AI
2025-05204 · 0% AI
2025-06711 · 0% AI
2025-07759 · 0% AI
2025-0810,607 · 0% AI
2025-091,940 · 0% AI
2025-103,843 · 0% AI
2025-112,485 · 0% AI
2025-12271 · 0% AI
2026-01845 · 0% AI
2026-024,237 · 17% AI
2026-032,538 · 0% AI
2026-045,580 · 0% AI
2026-054,337 · 50% AI
2026-062,638 · 0% AI
2026-073,450 · 0% AI
2026-083,952 · 4% AI
2026-093,065 · 5% AI
2026-1027,928 · 0% AI
2026-1110,546 · 14% AI

Findings in AI-attributed lines vs the rest

From git blame: 2,572 lines trace to AI-attributed commits, 71,832 to others. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	0.00	0.10	0.00×
Security	0.00	0.07	0.00×

Evidence by analyzer

Explicit AI attributionok28 items

attributed_commit_share: 1.2%
attributed_commits: 35
attributed_loc: 4,697
attributed_loc_share: 2.2%
commits: 2,989
effective_loc: 217,713
tools_detected: 3

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok3 items

excluded_import_loc: 72,867
flagged_loc: 8,748
flagged_loc_share: 6.0%
flagged_units: 3
max_loc_per_hour: 1,302.35
measured_loc: 144,846
median_loc_per_hour: 35.49
pr_timed_units: 452
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 17,646
work_units: 1,730

Release velocityok

flagged_releases: 0
max_loc_per_day: 2,937.20
releases: 99

Coding styleok1 item

step-by-step narration comment: // First, validate using built-in parser

count:assistant_voice: 0
count:emoji_in_code: 1
count:narrated_steps: 1
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 1
files:narrated_steps: 1
files:placeholder: 0
index: 0.02
lines_scanned: 74,404
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.01
per_kloc:narrated_steps: 0.01
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 2,572
blame_failures: 0
files_blamed: 362
other_lines: 71,832
quality:ai_findings: 0
quality:ai_per_kloc: 0
quality:other_findings: 7
quality:other_per_kloc: 0.10
quality:ratio: 0
security:ai_findings: 0
security:ai_per_kloc: 0
security:other_findings: 5
security:other_per_kloc: 0.07
security:ratio: 0

Code quality

67 adequate

Code quality is adequate: test-to-source ratio 0.19, CI runs tests; 26% of function code in complex or long functions; 13% duplicated lines. Weakest area: type safety.

How the score is built

Complexity46
Duplication46
Lint and smells97
Tests and CI75
Documentation65
Type safety40
Review process90

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 104
function_nloc: 45,810
functions: 2,136
long_functions: 53
many_param_functions: 5
mean_ccn: 4.83
p90_ccn: 10
risky_nloc_share: 26.0%

Duplication (jscpd)ok10 items

compared_lines: 45,195
duplicated_lines: 5,782
duplicated_share: 12.8%
files: 362

Lintok

category:best-practice: 4
category:correctness: 3
findings: 7
scanned_lines: 73,673
weighted_findings: 8

Tests and CIok11 items

CI config: .github/workflows/build-WebAPI.yml .github/workflows/build-WebAPI.yml
CI config: .github/workflows/build-all.yml .github/workflows/build-all.yml
CI config: .github/workflows/build-linux.yml .github/workflows/build-linux.yml
CI config: .github/workflows/build-osx.yml .github/workflows/build-osx.yml
CI config: .github/workflows/build-windows-desktop.yml .github/workflows/build-windows-desktop.yml
CI config: .github/workflows/build-windows-x86.yml .github/workflows/build-windows-x86.yml
CI config: .github/workflows/build-windows.yml .github/workflows/build-windows.yml
CI config: .github/workflows/build.yml .github/workflows/build.yml
CI config: .github/workflows/package-zip.yml .github/workflows/package-zip.yml
CI config: .github/workflows/pub-key.yml .github/workflows/pub-key.yml
CI runs tests (dotnet test)

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: yes
ci_files: 15
cochange_commits: 195
cochange_share: 27.7%
source_lines: 74,404
test_lines: 14,343
test_ratio: 0.19

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 48

Type safetyok

check:low_escape_density: yes
check:strict_config: no
escapes: 0
escapes_per_kloc: 0

Security

64 weak

Security posture is weak: 5 high-severity SAST findings; 72 high-severity workflow issues. Weakest area: ci actions.

How the score is built

Secrets88
Static analysis (SAST)98
Vulnerable dependenciesnot measured
CI workflows0
Security posture60
OpenSSF Scorecard35

Evidence by analyzer

OpenSSF Scorecardok14 items

aggregate: 5.20
check:Binary-Artifacts: yes
check:Branch-Protection: no
check:CII-Best-Practices: no
check:Code-Review: yes
check:Dangerous-Workflow: yes
check:Fuzzing: no
check:License: yes
check:Maintained: yes
check:Packaging: yes
check:Pinned-Dependencies: no
check:SAST: no
check:Security-Policy: no
check:Signed-Releases: yes
check:Token-Permissions: no

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 1
secrets_nonprod: 3

Static analysis (opengrep)ok

findings: 5
findings_high: 5
findings_low: 0
findings_medium: 0
parse_errors: 6
scanned_lines: 73,673
weighted_findings: 3.75

Dependencies (osv-scanner)skipped

CI workflows (zizmor)ok

findings: 141
findings_high: 72
findings_low: 58
findings_medium: 11
penalty: 945.40
workflows: 15

Security postureok1 item

Dependency updates: .github/dependabot.yml .github/dependabot.yml

check:dependency_updates: yes
check:lockfiles: yes
check:security_policy: no
check:signed_commits: yes
signed_commit_share: 79.5%
unpinned_manifests: 0

Release downloadsok6 items

release 7.25.6 ships v2rayN-linux-64.deb (49975 downloads)
release 7.25.6 ships v2rayN-linux-64.zip (45337 downloads)
release 7.25.6 ships v2rayN-linux-arm64.deb (6600 downloads)
release 7.25.6 ships v2rayN-linux-arm64.zip (8945 downloads)
release 7.25.6 ships v2rayN-linux-loong64.deb (4401 downloads)
links to file hosts or shorteners: t.me/ README.md

binary_assets: 195
signals: 2
suspicious: 0

Findings

79 high12 medium54 low12 info

Severity	Rule	Location	Message	Tool
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:213	time.sleep() call; did you mean to leave this in?	Lint
high	`opengrep/python.lang.best-practice.arbitrary-sleep`	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:44	time.sleep() call; did you mean to leave this in?	Lint
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:110	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:114	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:148	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:151	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:154	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:309	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:330	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:333	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:336	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:429	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:457	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:460	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:481	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:56	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:59	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:606	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:860	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:879	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:882	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:884	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:906	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:909	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:932	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-WebAPI.yml:937	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/build-all.yml:100	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/excessive-permissions`	.github/workflows/build-all.yml:11	overly broad permissions [confidence high]	CI workflows (zizmor)
high	`zizmor/excessive-permissions`	.github/workflows/build-all.yml:12	overly broad permissions [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/build-all.yml:44	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/build-all.yml:58	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/build-all.yml:72	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/build-all.yml:86	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-linux.yml:127	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/excessive-permissions`	.github/workflows/build-linux.yml:14	overly broad permissions [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-linux.yml:147	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-linux.yml:165	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-linux.yml:182	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-images`	.github/workflows/build-linux.yml:189	unpinned image references [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-linux.yml:227	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-linux.yml:248	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-linux.yml:63	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-linux.yml:83	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-images`	.github/workflows/build-linux.yml:90	unpinned image references [confidence high]	CI workflows (zizmor)
high	`zizmor/excessive-permissions`	.github/workflows/build-osx.yml:14	overly broad permissions [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-osx.yml:66	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-osx.yml:69	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/build-osx.yml:81	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-osx.yml:84	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/excessive-permissions`	.github/workflows/build-windows-desktop.yml:14	overly broad permissions [confidence high]	CI workflows (zizmor)
high	`zizmor/excessive-permissions`	.github/workflows/build-windows-x86.yml:11	overly broad permissions [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-windows-x86.yml:227	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-windows-x86.yml:33	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build-windows-x86.yml:55	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/excessive-permissions`	.github/workflows/build-windows.yml:14	overly broad permissions [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:136	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:54	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/build.yml:76	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/package-zip.yml:102	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/package-zip.yml:48	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/package-zip.yml:80	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/pub-key.yml:43	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/excessive-permissions`	.github/workflows/release-WebAPI.yml:20	overly broad permissions [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:36	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:39	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:49	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/update-cert.yml:17	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/update-cert.yml:20	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/update-cert.yml:29	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/upload-sign.yml:33	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/upload-sign.yml:53	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/upload-sign.yml:54	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/upload-sign.yml:61	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/upload-sign.yml:70	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:111	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:152	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:206	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:258	Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:85	Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external...	Static analysis (opengrep)
medium	`opengrep/bash.lang.best-practice.useless-cat`	package-debian.sh:208	Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file.	Lint
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:3	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/dependabot-cooldown`	.github/dependabot.yml:8	insufficient cooldown in Dependabot updates [confidence high]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/build-all.yml:25	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/build-linux.yml:26	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/build-linux.yml:41	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/build-osx.yml:26	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/build-osx.yml:41	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/build-windows-desktop.yml:26	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/build-windows-desktop.yml:41	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/build-windows.yml:27	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/winget-publish.yml:12	overly broad permissions [confidence medium]	CI workflows (zizmor)
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	package-osx.sh:10	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	package-osx.sh:8	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	package-osx.sh:9	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/csharp.lang.best-practice.structured-logging`	v2rayN/ServiceLib/Common/Logging.cs:48	String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging...	Lint
low	`gitleaks/generic-api-key`	.github/workflows/build-WebAPI.yml:563	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`zizmor/self-repository`	.github/workflows/build-all.yml:17	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-all.yml:25	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/build-linux.yml:126	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/build-linux.yml:164	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-linux.yml:19	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/build-linux.yml:226	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-linux.yml:254	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-linux.yml:26	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-linux.yml:261	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-linux.yml:268	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-linux.yml:275	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-linux.yml:33	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-linux.yml:41	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/build-linux.yml:62	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-osx.yml:19	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-osx.yml:26	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-osx.yml:33	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-osx.yml:41	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/build-osx.yml:65	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-osx.yml:97	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-windows-desktop.yml:19	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-windows-desktop.yml:26	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-windows-desktop.yml:33	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-windows-desktop.yml:41	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-windows-x86.yml:241	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/build-windows-x86.yml:32	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-windows.yml:19	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/build-windows.yml:27	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:112	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:112	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:118	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:124	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:124	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:129	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:130	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:131	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:132	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/build.yml:133	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/build.yml:53	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/package-zip.yml:114	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/package-zip.yml:47	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/release-WebAPI.yml:25	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/release-WebAPI.yml:36	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/release-WebAPI.yml:48	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/test.yml:35	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`zizmor/artipacked`	.github/workflows/update-cert.yml:16	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
low	`gitleaks/generic-api-key`	v2rayN/ServiceLib.Tests/CoreConfig/V2ray/CoreConfigV2rayServiceTests.cs:106	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	v2rayN/v2rayN.WebAPI/Tests/NativeWebUpdateFileSwapTests.cs:10	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	v2rayN/v2rayN.WebAPI/Tests/NativeWebUpdateHelperTests.cs:79	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
info	`zizmor/template-injection`	.github/workflows/build-WebAPI.yml:923	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/template-injection`	.github/workflows/build-windows-x86.yml:143	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/template-injection`	.github/workflows/build-windows-x86.yml:144	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/template-injection`	.github/workflows/package-zip.yml:87	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/template-injection`	.github/workflows/package-zip.yml:92	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/template-injection`	.github/workflows/package-zip.yml:92	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/template-injection`	.github/workflows/package-zip.yml:98	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/template-injection`	.github/workflows/package-zip.yml:99	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/template-injection`	.github/workflows/package-zip.yml:99	code injection via template expansion [confidence low]	CI workflows (zizmor)
info	`zizmor/superfluous-actions`	.github/workflows/pub-key.yml:43	action functionality is already included by the runner [confidence high]	CI workflows (zizmor)
info	`zizmor/superfluous-actions`	.github/workflows/upload-sign.yml:61	action functionality is already included by the runner [confidence high]	CI workflows (zizmor)
info	`zizmor/superfluous-actions`	.github/workflows/upload-sign.yml:70	action functionality is already included by the runner [confidence high]	CI workflows (zizmor)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	7
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	141
Dependencies (osv-scanner)	Security	skipped	`—`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	5
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	4

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`2c90ed1a9438`	`prov-5+qual-2+sec-2`	2%	67	64

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/2dust/v2rayN/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/2dust/v2rayN/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/2dust/v2rayN/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/2dust/v2rayN/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/2dust/v2rayN/security.svg)](https://repotrust.synapticcyber.com/r/github.com/2dust/v2rayN/)

Full text report

Repository: https://github.com/2dust/v2rayN
Commit: 2c90ed1a9438a499aaaea0b612ffd5d705970106
Generated: 2026-11-14T15:06:23+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	2	explicit	95%	100%
Code quality	67	adequate	90%	100%
Security	64	weak	85%	100%

AI provenance

Explicit AI attribution on 2% of first-party code added; an estimated 2% including velocity signals.

Explicitly attributed share (lower bound): 2.2%
Unattributed share in AI-consistent velocity bursts: 4.0%
Estimated AI-generated share: 2.2%

AI tool	Attributed commits	Lines added
OpenAI Codex	20	1,231
Claude Code	13	569
GitHub Copilot coding agent	2	2,897

Current source lines last changed by AI-attributed commits: 2,572 of 74,404.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	0.0	0.097	0.0x
Security	0.0	0.07	0.0x

Stylometry index: 0.02 per 1,000 lines (narrated steps 1, placeholders 0, assistant phrasing 0, emoji 1). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2025-12	271	0%
2026-01	845	0%
2026-02	4,237	17%
2026-03	2,538	0%
2026-04	5,580	0%
2026-05	4,337	50%
2026-06	2,638	0%
2026-07	3,450	0%
2026-08	3,952	4%
2026-09	3,065	5%
2026-10	27,928	0%
2026-11	10,546	14%

Evidence

OpenAI Codex: PR branch 'codex/fix-parallel-sqlite-schema' (f2f336d97ca6)
OpenAI Codex: PR branch 'codex/ru-missing-ui-translations' (a189c659c6b7)
Claude Code: trailer 'Co-authored-by: Claude' (2010477f38b8)
OpenAI Codex: PR branch 'codex/bump-downloader-6-0-1' (7c49b236a0fc)
OpenAI Codex: PR branch 'codex/fix-web-restart-deadline' (8027b2cf7251)
OpenAI Codex: PR branch 'codex/fix-json-sqlite-aot-warnings' (9a029a3f7eee)
OpenAI Codex: PR branch 'codex/bump-avalonia-desktop-12-1-5' (aa00b2c614d7)
Claude Code: trailer 'Co-authored-by: Claude' (0d9e84556e6c)
Claude Code: trailer 'Co-authored-by: Claude' (ff9fd7b988db)
Claude Code: trailer 'Co-authored-by: Claude' (522bca492c0b)
OpenAI Codex: PR branch 'codex/update-ipnetwork2-5.0.1' (7a52be4150e3)
OpenAI Codex: PR branch 'codex/fix-webapi-wsl-verification' (743eb323c2a2)
OpenAI Codex: PR branch 'codex/fix-macos-instance-lock' (ebabf7901736)
OpenAI Codex: PR branch 'codex/remove-obsolete-ech-force-query' (756916978d02)
OpenAI Codex: PR branch 'codex/update-materialdesignthemes-5.4.0' (a2a8a77ff6a3)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.19, CI runs tests; 26% of function code in complex or long functions; 13% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	46
Duplication	46
Code smells (Opengrep)	97
Tests and CI	75
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	90

Functions: 2,136; mean complexity 4.8, 90th percentile 10; 104 complex and 53 long functions
Duplicated lines: 12.8% of 45,195 compared
Tests: 14,343 test lines for 74,404 source lines (ratio 0.19); CI test commands: dotnet test; 28% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 5 high-severity SAST findings; 72 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	88
Static analysis (Opengrep)	98
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	0
Posture (policy, updates, signing, lockfiles)	60
OpenSSF Scorecard	35

Posture checks passed: dependency updates, signed commits, lockfiles; missing: security policy
OpenSSF Scorecard aggregate: 5.2/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:85
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:111
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:152
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:206
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	v2rayN/v2rayN.WebAPI/Tests/Integration/test-native-update-identity.py:258
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:56
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:59
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:110
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:114
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:148
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:151
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:154
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:309
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:330
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:333
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:336
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:429
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:457
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:460
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:481
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:606
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:860
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:879
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:882
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/build-WebAPI.yml:884

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release 7.25.6 ships v2rayN-linux-64.deb (49975 downloads)
binary-release-asset: release 7.25.6 ships v2rayN-linux-64.zip (45337 downloads)
binary-release-asset: release 7.25.6 ships v2rayN-linux-arm64.deb (6600 downloads)
binary-release-asset: release 7.25.6 ships v2rayN-linux-arm64.zip (8945 downloads)
binary-release-asset: release 7.25.6 ships v2rayN-linux-loong64.deb (4401 downloads)
readme-download-lure: links to file hosts or shorteners: t.me/

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 74,404; test lines: 14,343

Language	Lines
C#	81,648
Shell	5,456
Python	912
PowerShell	731