Leaderboard github.com
AdrianVollmer/XTreeViewer
A blazing fast TUI (Terminal User Interface) application for viewing tree structures from serialized data files.
unreviewed-ai-risk
AI provenance
85%
explicit
- Confidence
- 87%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
63/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
77/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
85% explicit
Explicit AI attribution on 85% of first-party code added; an estimated 85% including velocity signals.
How the score is built
- Explicitly attributed share85%
- Unattributed share in AI-pace bursts0%
- Estimated AI-generated share85%
- AI tool configuration files0
- Work sessions at AI pace1
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.00
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 39 | 5,809 | 2025-12-21 | 2026-01-15 |
Lines added per month all AI-attributed share
- 2025-126,697 · 85% AI
- 2026-01141 · 100% AI
Findings in AI-attributed lines vs the rest
From git blame: 5,000 lines trace to AI-attributed commits, 820 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.00 | — |
| Security | 0.00 | 0.00 | — |
Evidence by analyzer
Explicit AI attributionok26 items
- Claude Code: 39 attributed commits, 5,809 lines added
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- Claude Code: author email [email protected]
- attributed_commit_share
- 56.5%
- attributed_commits
- 39
- attributed_loc
- 5,809
- attributed_loc_share
- 85.0%
- commits
- 69
- effective_loc
- 6,838
- tools_detected
- 1
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok1 item
- excluded_import_loc
- 0
- flagged_loc
- 1,346
- flagged_loc_share
- 19.7%
- flagged_units
- 1
- max_loc_per_hour
- 549.57
- measured_loc
- 6,838
- median_loc_per_hour
- 153.63
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 13
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 7.70
- releases
- 2
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0
- lines_scanned
- 5,820
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 5,000
- blame_failures
- 0
- files_blamed
- 20
- other_lines
- 820
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 0
- quality:other_per_kloc
- 0
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 0
- security:other_per_kloc
- 0
Code quality
63 weak
Code quality is weak: test-to-source ratio 0.04, no CI test run detected; 20% of function code in complex or long functions; 8% duplicated lines. Weakest area: testing.
How the score is built
- Complexity55
- Duplication63
- Lint and smells100
- Tests and CI42
- Documentation80
- Type safetynot measured
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok8 items
- build_ldif_index in src/parser/ldif.rs: complexity 36, 225 lines
- handle_normal_key in src/ui/app.rs: complexity 33, 110 lines
- run in src/main.rs: complexity 20, 50 lines
- parse_entry in src/parser/ldif.rs: complexity 16, 51 lines
- parse in src/parser/xml.rs: complexity 16, 70 lines
- node_to_json in src/ui/app.rs: complexity 16, 49 lines
- perform_search in src/ui/app.rs: complexity 16, 52 lines
- create_list_item in src/ui/tree_view.rs: complexity 16, 72 lines
- complex_functions
- 8
- function_nloc
- 3,372
- functions
- 217
- long_functions
- 2
- many_param_functions
- 0
- mean_ccn
- 3.42
- p90_ccn
- 8
- risky_nloc_share
- 20.1%
Duplication (jscpd)ok9 items
- 6+ duplicated lines: src/parser/html.rs:87 and src/parser/xml.rs:140
- 6+ duplicated lines: src/parser/json.rs:25 and src/parser/yaml.rs:32
- 6+ duplicated lines: src/parser/json.rs:43 and src/parser/jsonlines.rs:39
- 6+ duplicated lines: src/parser/ldif.rs:440 and src/parser/ldif.rs:502
- 6+ duplicated lines: src/parser/xml.rs:43 and src/parser/xml.rs:94
- 6+ duplicated lines: src/tree/mod.rs:191 and src/tree/mod.rs:348
- 6+ duplicated lines: src/tree/mod.rs:319 and src/tree/streaming.rs:400
- 6+ duplicated lines: src/ui/app.rs:739 and src/ui/app.rs:754
- 6+ duplicated lines: src/ui/tree_view.rs:249 and src/ui/tree_view.rs:315
- compared_lines
- 3,944
- duplicated_lines
- 303
- duplicated_share
- 7.7%
- files
- 20
Lintok
- findings
- 0
- scanned_lines
- 5,820
- weighted_findings
- 0
Tests and CIok1 item
- CI config: .github/workflows/release.yml
.github/workflows/release.yml
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 1
- cochange_commits
- 43
- cochange_share
- 11.6%
- source_lines
- 5,820
- test_lines
- 214
- test_ratio
- 0.04
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 44
Type safetyskipped
Security
77 adequate
Security posture is adequate: 4 high-severity workflow issues. Weakest area: posture.
How the score is built
- Secrets100
- Static analysis (SAST)100
- Vulnerable dependenciesnot measured
- CI workflows44
- Security posture20
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 18
- declared
- 18
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 0
- findings_high
- 0
- findings_low
- 0
- findings_medium
- 0
- parse_errors
- 0
- scanned_lines
- 5,820
- weighted_findings
- 0
Dependencies (osv-scanner)skipped
CI workflows (zizmor)ok
- findings
- 6
- findings_high
- 4
- findings_low
- 1
- findings_medium
- 1
- penalty
- 49.20
- workflows
- 1
Security postureok1 item
- Cargo.toml has no lockfile alongside it (unpinned dependencies)
Cargo.toml
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- no
- check:signed_commits
- yes
- signed_commit_share
- 60.9%
- unpinned_manifests
- 1
Release downloadsok5 items
- release v0.1.2 ships xtv-aarch64-apple-darwin.tar.xz (2 downloads)
- release v0.1.2 ships xtv-aarch64-pc-windows-msvc.zip (1 downloads)
- release v0.1.2 ships xtv-aarch64-unknown-linux-musl.tar.xz (1 downloads)
- release v0.1.2 ships xtv-armv7-unknown-linux-musleabi.tar.xz (1 downloads)
- release v0.1.2 ships xtv-riscv64gc-unknown-linux-gnu.tar.xz (1 downloads)
- binary_assets
- 16
- signals
- 1
- suspicious
- 0
Findings
4 high1 medium1 info
6 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:49 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:50 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:80 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:87 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/release.yml:49 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/release.yml:87 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-4 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 0 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 6 | |
| Dependencies (osv-scanner) | Security | skipped | — | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 0 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 0 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 8450f4e545fb | prov-5+qual-2+sec-2 | 85% | 63 | 77 |
| 2026-11-14 | 8450f4e545fb | prov-4+qual-2+sec-2 | 85% | 63 | 77 |
Full text report
- Repository: https://github.com/AdrianVollmer/XTreeViewer
- Commit:
8450f4e545fb6f41c0753ce8dea437efbc6bf35a - Generated: 2026-11-14T14:51:59+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
Unreviewed AI code risk: a large share of this code is explicitly AI-attributed, and its tests or review process are weak while quality or security scores are low.
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 85 | explicit | 87% | 100% |
| Code quality | 63 | weak | 90% | 100% |
| Security | 77 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 85% of first-party code added; an estimated 85% including velocity signals.
- Explicitly attributed share (lower bound): 85.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 85.0%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 39 | 5,809 |
Current source lines last changed by AI-attributed commits: 5,000 of 5,820.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.0 | n/a |
| Security | 0.0 | 0.0 | n/a |
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 6,697 | 85% |
| 2026-01 | 141 | 100% |
Evidence
- Claude Code: author email [email protected] (e7575ce3fe33)
- Claude Code: author email [email protected] (69911a809c89)
- Claude Code: author email [email protected] (6b3679ddcbf7)
- Claude Code: author email [email protected] (000f4d7d451e)
- Claude Code: author email [email protected] (ca430f520db8)
- Claude Code: author email [email protected] (2fce022b4d96)
- Claude Code: author email [email protected] (612e84af9cf6)
- Claude Code: author email [email protected] (292ec05c0785)
- Claude Code: author email [email protected] (fa76f566b6ee)
- Claude Code: author email [email protected] (5d577583da0e)
- Claude Code: author email [email protected] (cf204716ece1)
- Claude Code: author email [email protected] (56d42d2f68a0)
- Claude Code: author email [email protected] (eb49523a54e8)
- Claude Code: author email [email protected] (992307232777)
- Claude Code: author email [email protected] (bb2d40b02363)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.04, no CI test run detected; 20% of function code in complex or long functions; 8% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 55 |
| Duplication | 63 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 42 |
| Documentation | 80 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 217; mean complexity 3.4, 90th percentile 8; 8 complex and 2 long functions
- Duplicated lines: 7.7% of 3,944 compared
- Tests: 214 test lines for 5,820 source lines (ratio 0.04); CI test commands: none detected; 12% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- build_ldif_index in src/parser/ldif.rs: complexity 36, 225 lines
- handle_normal_key in src/ui/app.rs: complexity 33, 110 lines
- run in src/main.rs: complexity 20, 50 lines
- parse_entry in src/parser/ldif.rs: complexity 16, 51 lines
- parse in src/parser/xml.rs: complexity 16, 70 lines
Security
Security posture is adequate: 4 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 100 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 44 |
| Posture (policy, updates, signing, lockfiles) | 20 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:49 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:50 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:80 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:87 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/release.yml:49 |
| info | zizmor/superfluous-actions: action functionality is already included by the runner [confidence high] |
.github/workflows/release.yml:87 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.1.2 ships xtv-aarch64-apple-darwin.tar.xz (2 downloads)
- binary-release-asset: release v0.1.2 ships xtv-aarch64-pc-windows-msvc.zip (1 downloads)
- binary-release-asset: release v0.1.2 ships xtv-aarch64-unknown-linux-musl.tar.xz (1 downloads)
- binary-release-asset: release v0.1.2 ships xtv-armv7-unknown-linux-musleabi.tar.xz (1 downloads)
- binary-release-asset: release v0.1.2 ships xtv-riscv64gc-unknown-linux-gnu.tar.xz (1 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 5,820; test lines: 214
| Language | Lines |
|---|---|
| Rust | 6,034 |