Leaderboard github.com
AvaloniaUI/Avalonia
Develop Desktop, Embedded, Mobile and WebAssembly apps with C# and XAML. The future of .NET UI
AI provenance
4%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
76/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
60/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
4% explicit
Explicit AI attribution on 4% of first-party code added; an estimated 4% including velocity signals.
How the score is built
- Explicitly attributed share4%
- Unattributed share in AI-pace bursts3%
- Estimated AI-generated share4%
- AI tool configuration files1
- Work sessions at AI pace17
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.06
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 96 | 44,254 | 2025-10-22 | 2026-11-13 |
| GitHub Copilot coding agent | 30 | 15,531 | 2025-12-01 | 2026-11-06 |
| Cursor agent | 2 | 59 | 2026-08-19 | 2026-10-16 |
| OpenAI Codex | 1 | 0 | 2026-07-23 | 2026-07-23 |
Lines added per month all AI-attributed share
- 2013-124,661 · 0% AI
- 2014-025,217 · 0% AI
- 2014-032,294 · 0% AI
- 2014-041,055 · 0% AI
- 2014-067,631 · 0% AI
- 2014-0919,481 · 0% AI
- 2014-10930 · 0% AI
- 2014-111,603 · 0% AI
- 2014-1215,514 · 0% AI
- 2015-012,949 · 0% AI
- 2015-022,324 · 0% AI
- 2015-0377 · 0% AI
- 2015-043,337 · 0% AI
- 2015-057,395 · 0% AI
- 2015-063,792 · 0% AI
- 2015-077,130 · 0% AI
- 2015-0811,168 · 0% AI
- 2015-0934,216 · 0% AI
- 2015-1011,326 · 0% AI
- 2015-1117,426 · 0% AI
- 2015-126,519 · 0% AI
- 2016-016,502 · 0% AI
- 2016-026,963 · 0% AI
- 2016-036,326 · 0% AI
- 2016-048,727 · 0% AI
- 2016-0598,677 · 0% AI
- 2016-065,325 · 0% AI
- 2016-072,138 · 0% AI
- 2016-088,929 · 0% AI
- 2016-091,824 · 0% AI
- 2016-101,630 · 0% AI
- 2016-115,183 · 0% AI
- 2016-123,001 · 0% AI
- 2017-015,902 · 0% AI
- 2017-026,124 · 0% AI
- 2017-038,150 · 0% AI
- 2017-044,522 · 0% AI
- 2017-051,527 · 0% AI
- 2017-064,859 · 0% AI
- 2017-071,596 · 0% AI
- 2017-087,813 · 0% AI
- 2017-092,907 · 0% AI
- 2017-1011,458 · 0% AI
- 2017-11720 · 0% AI
- 2017-122,649 · 0% AI
- 2018-012,129 · 0% AI
- 2018-028,686 · 0% AI
- 2018-0312,945 · 0% AI
- 2018-045,146 · 0% AI
- 2018-057,369 · 0% AI
- 2018-0640,451 · 0% AI
- 2018-074,092 · 0% AI
- 2018-084,492 · 0% AI
- 2018-0910,986 · 0% AI
- 2018-1010,460 · 0% AI
- 2018-115,849 · 0% AI
- 2018-123,764 · 0% AI
- 2019-015,887 · 0% AI
- 2019-023,944 · 0% AI
- 2019-035,049 · 0% AI
- 2019-045,040 · 0% AI
- 2019-0532,424 · 0% AI
- 2019-067,725 · 0% AI
- 2019-0714,328 · 0% AI
- 2019-083,352 · 0% AI
- 2019-094,391 · 0% AI
- 2019-105,744 · 0% AI
- 2019-1112,638 · 0% AI
- 2019-1210,376 · 0% AI
- 2020-0110,208 · 0% AI
- 2020-0216,364 · 0% AI
- 2020-033,712 · 0% AI
- 2020-047,200 · 0% AI
- 2020-0517,349 · 0% AI
- 2020-0623,246 · 0% AI
- 2020-076,675 · 0% AI
- 2020-0815,787 · 0% AI
- 2020-096,289 · 0% AI
- 2020-109,183 · 0% AI
- 2020-1115,872 · 0% AI
- 2020-12774 · 0% AI
- 2021-012,768 · 0% AI
- 2021-023,873 · 0% AI
- 2021-0310,043 · 0% AI
- 2021-043,300 · 0% AI
- 2021-054,098 · 0% AI
- 2021-062,780 · 0% AI
- 2021-073,369 · 0% AI
- 2021-082,480 · 0% AI
- 2021-096,891 · 0% AI
- 2021-103,136 · 0% AI
- 2021-116,594 · 0% AI
- 2021-129,170 · 0% AI
- 2022-0124,702 · 0% AI
- 2022-025,009 · 0% AI
- 2022-0310,437 · 0% AI
- 2022-0413,256 · 0% AI
- 2022-0516,497 · 0% AI
- 2022-0617,031 · 0% AI
- 2022-0720,434 · 0% AI
- 2022-085,117 · 0% AI
- 2022-0912,685 · 0% AI
- 2022-1012,566 · 0% AI
- 2022-1118,504 · 0% AI
- 2022-1225,675 · 0% AI
- 2023-0120,714 · 0% AI
- 2023-0217,727 · 0% AI
- 2023-0314,893 · 0% AI
- 2023-0411,327 · 0% AI
- 2023-0514,378 · 0% AI
- 2023-065,840 · 0% AI
- 2023-072,660 · 0% AI
- 2023-082,217 · 0% AI
- 2023-0910,579 · 0% AI
- 2023-103,920 · 0% AI
- 2023-115,106 · 0% AI
- 2023-121,913 · 0% AI
- 2024-0113,950 · 0% AI
- 2024-028,953 · 0% AI
- 2024-0310,883 · 0% AI
- 2024-0415,200 · 0% AI
- 2024-054,741 · 0% AI
- 2024-066,299 · 0% AI
- 2024-074,767 · 0% AI
- 2024-085,543 · 0% AI
- 2024-092,636 · 0% AI
- 2024-104,861 · 0% AI
- 2024-113,549 · 0% AI
- 2024-126,712 · 0% AI
- 2025-012,866 · 0% AI
- 2025-021,816 · 0% AI
- 2025-033,545 · 0% AI
- 2025-044,102 · 0% AI
- 2025-051,750 · 0% AI
- 2025-061,358 · 0% AI
- 2025-071,186 · 0% AI
- 2025-089,253 · 0% AI
- 2025-091,640 · 0% AI
- 2025-108,197 · 0% AI
- 2025-115,102 · 0% AI
- 2025-127,708 · 16% AI
- 2026-0112,418 · 0% AI
- 2026-0213,665 · 10% AI
- 2026-0354,559 · 4% AI
- 2026-044,332 · 3% AI
- 2026-0517,453 · 14% AI
- 2026-0628,425 · 1% AI
- 2026-0715,788 · 10% AI
- 2026-0827,453 · 50% AI
- 2026-0922,483 · 60% AI
- 2026-1024,647 · 53% AI
- 2026-1117,185 · 59% AI
Findings in AI-attributed lines vs the rest
From git blame: 12,928 lines trace to AI-attributed commits, 194,335 to others (sampled). Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.03 | 0.00× |
| Security | 0.00 | 0.01 | 0.00× |
Evidence by analyzer
Explicit AI attributionok29 items
- Claude Code: 96 attributed commits, 44,254 lines added
- GitHub Copilot coding agent: 30 attributed commits, 15,531 lines added
- Cursor agent: 2 attributed commits, 59 lines added
- OpenAI Codex: 1 attributed commits, 0 lines added
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: PR description attribution
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: PR description attribution
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: PR description attribution
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 0.7%
- attributed_commits
- 129
- attributed_loc
- 59,844
- attributed_loc_share
- 4.1%
- commits
- 18,871
- effective_loc
- 1,466,137
- tools_detected
- 4
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2026-03-31
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok15 items
- 2,097 lines of first-party code in ~0.5h (4,194 lines/hour, 1 commit session)
- 5,579 lines of first-party code in ~4.0h (1,395 lines/hour, 1 commit session)
- 4,254 lines of first-party code in ~4.0h (1,064 lines/hour, 1 commit session)
- 3,320 lines of first-party code in ~4.0h (830 lines/hour, 1 commit session)
- 3,319 lines of first-party code in ~4.1h (811 lines/hour, 8 commit session)
- 3,207 lines of first-party code in ~4.0h (802 lines/hour, 1 commit session)
- 3,030 lines of first-party code in ~4.0h (758 lines/hour, 1 commit session)
- 2,760 lines of first-party code in ~4.0h (690 lines/hour, 1 commit session)
- 2,683 lines of first-party code in ~4.0h (671 lines/hour, 1 commit session)
- 2,670 lines of first-party code in ~4.0h (668 lines/hour, 1 commit session)
- 2,633 lines of first-party code in ~4.1h (649 lines/hour, 7 commit session)
- 2,417 lines of first-party code in ~4.0h (604 lines/hour, 1 commit session)
- 2,398 lines of first-party code in ~4.0h (600 lines/hour, 1 commit session)
- 2,308 lines of first-party code in ~4.0h (577 lines/hour, 1 commit session)
- 2,062 lines of first-party code in ~4.0h (516 lines/hour, 1 commit session)
- excluded_import_loc
- 277,880
- flagged_loc
- 48,803
- flagged_loc_share
- 4.1%
- flagged_units
- 17
- max_loc_per_hour
- 4,194
- measured_loc
- 1,188,257
- median_loc_per_hour
- 49.25
- pr_timed_units
- 1,707
- pre_ai_era_burst_loc
- 97,005
- pre_ai_era_bursts
- 31
- pre_ai_era_measured_loc
- 589,839
- work_units
- 9,981
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 900.30
- releases
- 32
Coding styleok8 items
- step-by-step narration comment: // Then, as we transition from yellow and green, green is now completely present, red is becoming decreasingly present,
- step-by-step narration comment: // Finally, the not-present color must be equal to the minimum value, since it is the one least participating in the ove
- step-by-step narration comment: // First, consume as many Prepend scalars as we can (rule GB9b).
- step-by-step narration comment: // Next, make sure we're not about to violate control character restrictions.
- step-by-step narration comment: // First, drain any Extend scalars that might exist
- step-by-step narration comment: // Step 1: Append this to the end of the "sequential" linked list.
- step-by-step narration comment: // Step 2: Append the item into the priority chain.
- step-by-step narration comment: // Step 1: Remove the item from its priority chain.
- count:assistant_voice
- 0
- count:emoji_in_code
- 8
- count:narrated_steps
- 23
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 3
- files:narrated_steps
- 9
- files:placeholder
- 0
- index
- 0.06
- lines_scanned
- 481,642
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.02
- per_kloc:narrated_steps
- 0.05
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 12,928
- blame_failures
- 0
- files_blamed
- 1,500
- other_lines
- 194,335
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 6
- quality:other_per_kloc
- 0.03
- quality:ratio
- 0
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 2
- security:other_per_kloc
- 0.01
- security:ratio
- 0
Code quality
76 adequate
Code quality is adequate: test-to-source ratio 0.45, no CI test run detected; 15% of function code in complex or long functions; 6% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity63
- Duplication71
- Lint and smells100
- Tests and CI68
- Documentation80
- Type safety60
- Review process100
Evidence by analyzer
Complexity (lizard)ok10 items
- WindowImpl::AppWndProc in src/Windows/Avalonia.Win32/WindowImpl.AppWndProc.cs: complexity 197, 806 lines
- XamlCompilerTaskExecutor::CompileCore in src/Avalonia.Build.Tasks/XamlCompilerTaskExecutor.cs: complexity 99, 498 lines
- ExpressionVariant::GetProperty in src/Avalonia.Base/Rendering/Composition/Expressions/ExpressionVariant.cs: complexity 83, 192 lines
- BidiAlgorithm::ProcessIsolatedRunSequence in src/Avalonia.Base/Media/TextFormatting/Unicode/BiDiAlgorithm.cs: complexity 78, 302 lines
- XamlIlBindingPathHelper::TransformBindingPath in src/Markup/Avalonia.Markup.Xaml.Loader/CompilerExtensions/XamlIlBindingPathHelper.cs: complexity 77, 313 lines
- X11Window::OnEvent in src/Avalonia.X11/X11Window.cs: complexity 67, 180 lines
- AvaloniaXamlIlLanguageParseIntrinsics::TryConvert in src/Markup/Avalonia.Markup.Xaml.Loader/CompilerExtensions/AvaloniaXamlIlLanguageParseIntrinsics.cs: complexity 65, 361 lines
- TextBox::OnKeyDown in src/Avalonia.Controls/TextBox.cs: complexity 64, 307 lines
- Grid::SetFinalSizeMaxDiscrepancy in src/Avalonia.Controls/Grid.cs: complexity 63, 292 lines
- TextPathSegmentEllipsis::Collapse in src/Avalonia.Base/Media/TextPathSegmentEllipsis.cs: complexity 61, 288 lines
- complex_functions
- 349
- function_nloc
- 240,063
- functions
- 21,295
- long_functions
- 125
- many_param_functions
- 99
- mean_ccn
- 2.84
- p90_ccn
- 6
- risky_nloc_share
- 15.2%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: samples/AppWithoutLifetime/Program.cs:23 and samples/IntegrationTestApp/Program.cs:30
- 6+ duplicated lines: samples/AppWithoutLifetime/Program.cs:25 and samples/SafeAreaDemo.Desktop/Program.cs:17
- 6+ duplicated lines: samples/BindingDemo/App.xaml.cs:7 and samples/RenderDemo/App.xaml.cs:7
- 6+ duplicated lines: samples/ControlCatalog.Desktop/NativeControls/Win/WinApi.cs:49 and samples/IntegrationTestApp/Embedding/WinApi.cs:86
- 6+ duplicated lines: samples/ControlCatalog.iOS/Main.cs:5 and samples/SafeAreaDemo.iOS/Main.cs:5
- 6+ duplicated lines: samples/ControlCatalog/Controls/CodeBlock.cs:290 and samples/ControlCatalog/Controls/CodeBlock.cs:391
- 6+ duplicated lines: samples/ControlCatalog/Controls/HomeItemExpander.cs:47 and src/Avalonia.Controls/Button.cs:139
- 6+ duplicated lines: samples/ControlCatalog/Controls/HomeItemExpander.cs:49 and src/Avalonia.Controls/SplitButton/SplitButton.cs:89
- 6+ duplicated lines: samples/ControlCatalog/Controls/HomeItemExpander.cs:75 and src/Avalonia.Controls/ListBoxItem.cs:36
- 6+ duplicated lines: samples/ControlCatalog/Controls/HomeItemExpander.cs:76 and src/Avalonia.Controls/TabItem.cs:75
- compared_lines
- 299,647
- duplicated_lines
- 17,374
- duplicated_share
- 5.8%
- files
- 3,545
Lintok
- category:best-practice
- 2
- category:correctness
- 10
- findings
- 12
- scanned_lines
- 481,563
- weighted_findings
- 3
Tests and CIok7 items
- CI config: .github/workflows/CLA.yml
.github/workflows/CLA.yml - CI config: .github/workflows/api-diff.yml
.github/workflows/api-diff.yml - CI config: .github/workflows/build.yml
.github/workflows/build.yml - CI config: .github/workflows/publish-nuget-pr.yml
.github/workflows/publish-nuget-pr.yml - CI config: .github/workflows/submit-dependency-graph.yml
.github/workflows/submit-dependency-graph.yml - CI config: .github/workflows/team-label.yml
.github/workflows/team-label.yml - CI config: .github/workflows/update-api.yml
.github/workflows/update-api.yml
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 7
- cochange_commits
- 260
- cochange_share
- 63.5%
- source_lines
- 481,642
- test_lines
- 217,649
- test_ratio
- 0.45
Documentationok3 items
- readme.md
readme.md - licence.md
licence.md - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 68
Type safetyok1 item
- TypeScript strict type checking: src/Browser/Avalonia.Browser/webapp/tsconfig.json
src/Browser/Avalonia.Browser/webapp/tsconfig.json
- check:low_escape_density
- no
- check:strict_config
- yes
- escapes
- 81
- escapes_per_kloc
- 23.76
Security
60 weak
Security posture is weak: 28 known vulnerabilities in 12 dependencies; 42 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets88
- Static analysis (SAST)100
- Vulnerable dependencies25
- CI workflows0
- Security posture100
- OpenSSF Scorecard33
Evidence by analyzer
OpenSSF Scorecardok11 items
- Scorecard Maintained: 10/10 (30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10)
- Scorecard Code-Review: 10/10 (all changesets reviewed)
- Scorecard Security-Policy: 10/10 (security policy file detected)
- Scorecard Token-Permissions: 0/10 (detected GitHub workflow tokens with excessive permissions)
- Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)
- Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)
- Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)
- Scorecard License: 10/10 (license file detected)
- Scorecard Pinned-Dependencies: 0/10 (dependency not pinned by hash detected -- score normalized to 0)
- Scorecard Fuzzing: 0/10 (project is not fuzzed)
- Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)
- aggregate
- 6.20
- check:Binary-Artifacts
- yes
- check:CII-Best-Practices
- no
- check:Code-Review
- yes
- check:Dangerous-Workflow
- yes
- check:Fuzzing
- no
- check:License
- yes
- check:Maintained
- yes
- check:Pinned-Dependencies
- no
- check:SAST
- no
- check:Security-Policy
- yes
- check:Token-Permissions
- no
Package registriesok
- checked
- 20
- declared
- 20
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 3
- secrets_nonprod
- 1
Static analysis (opengrep)ok
- findings
- 2
- findings_high
- 0
- findings_low
- 0
- findings_medium
- 2
- parse_errors
- 26
- scanned_lines
- 481,563
- weighted_findings
- 0.85
Dependencies (osv-scanner)ok
- penalty
- 83
- vulnerabilities
- 28
- vulnerable_packages
- 12
- vulns_critical
- 1
- vulns_high
- 17
- vulns_low
- 1
- vulns_medium
- 9
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 55
- findings_high
- 42
- findings_low
- 9
- findings_medium
- 4
- penalty
- 494
- workflows
- 7
Security postureok2 items
- Security policy: SECURITY.md
SECURITY.md - Dependency updates: .github/dependabot.yml
.github/dependabot.yml
- check:dependency_updates
- yes
- check:lockfiles
- yes
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 100.0%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
1 critical59 high15 medium25 low1 info
101 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-w7jw-789q-3m8p |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-w7jw-789q-3m8p | Dependencies (osv-scanner) |
| high | zizmor/unpinned-uses |
.github/actions/publish-nuget/action.yml:26 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/actions/publish-nuget/action.yml:32 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/actions/publish-nuget/action.yml:40 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/CLA.yml:3 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/CLA.yml:5 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/api-diff.yml:155 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/api-diff.yml:167 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/api-diff.yml:28 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/api-diff.yml:4 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/api-diff.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/api-diff.yml:54 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/api-diff.yml:70 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/api-diff.yml:76 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/api-diff.yml:85 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:115 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:121 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:164 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:164 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:37 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:37 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:37 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:43 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:43 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:43 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:78 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:84 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:90 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/publish-nuget-pr.yml:12 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-nuget-pr.yml:41 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-nuget-pr.yml:68 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish-nuget-pr.yml:93 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/submit-dependency-graph.yml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/submit-dependency-graph.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/submit-dependency-graph.yml:53 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api.yml:100 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api.yml:112 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api.yml:28 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/update-api.yml:4 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api.yml:54 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api.yml:72 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/update-api.yml:79 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | osv/GHSA-23c5-xmqv-rm74 |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 | Dependencies (osv-scanner) |
| high | osv/GHSA-25h7-pfq9-p65f |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-395f-4hp3-45gv |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-395f-4hp3-45gv | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp | Dependencies (osv-scanner) |
| high | osv/GHSA-3ppc-4f35-3m26 |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 | Dependencies (osv-scanner) |
| high | osv/GHSA-3xgq-45jj-v275 |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-3xgq-45jj-v275 | Dependencies (osv-scanner) |
| high | osv/GHSA-3xgq-45jj-v275 |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-3xgq-45jj-v275 | Dependencies (osv-scanner) |
| high | osv/GHSA-52cp-r559-cp3m |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-52cp-r559-cp3m | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-7r86-cg39-jmmj |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj | Dependencies (osv-scanner) |
| high | osv/GHSA-c2c7-rcm5-vvqj |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-rf6f-7fwh-wjgh |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:3 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/CLA.yml:9 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/api-diff.yml:69 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/update-api.yml:71 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | osv/GHSA-67mh-4wv8-2f99 |
src/Avalonia.DesignerSupport/Remote/HtmlTransport/webapp/bun.lock | [email protected] (npm) is affected by GHSA-67mh-4wv8-2f99 | Dependencies (osv-scanner) |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration |
src/Avalonia.DesignerSupport/Remote/HtmlTransport/webapp/src/FramePresenter.tsx:93 | The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] | Static analysis (opengrep) |
| medium | osv/GHSA-2g4f-4pwh-qvx6 |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-2g4f-4pwh-qvx6 | Dependencies (osv-scanner) |
| medium | osv/GHSA-3v7f-55p6-f55p |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-3v7f-55p6-f55p | Dependencies (osv-scanner) |
| medium | osv/GHSA-67mh-4wv8-2f99 |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-67mh-4wv8-2f99 | Dependencies (osv-scanner) |
| medium | osv/GHSA-952p-6rrq-rcjv |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-952p-6rrq-rcjv | Dependencies (osv-scanner) |
| medium | osv/GHSA-f886-m6hf-6m8v |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-f886-m6hf-6m8v | Dependencies (osv-scanner) |
| medium | osv/GHSA-h67p-54hq-rp68 |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-h67p-54hq-rp68 | Dependencies (osv-scanner) |
| medium | osv/GHSA-mh29-5h37-fv8m |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-mh29-5h37-fv8m | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | opengrep/csharp.lang.security.memory.memory-marshal-create-span |
src/Windows/Avalonia.Win32.Automation/Marshalling/SafeArrayRef.cs:70 | MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked. [confidence low] | Static analysis (opengrep) |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
build-native.sh:5 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
native/Avalonia.Native/generate-headers.sh:4 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
nukebuild/XamlCompilationVerifier.cs:35 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
nukebuild/XamlCompilationVerifier.cs:54 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
samples/IntegrationTestApp/bundle.sh:11 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
samples/IntegrationTestApp/bundle.sh:12 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
samples/IntegrationTestApp/bundle.sh:3 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/ReplaceNugetCache.sh:3 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/ReplaceNugetCache.sh:4 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/ReplaceNugetCache.sh:5 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/ReplaceNugetCache.sh:6 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/javascript.lang.correctness.useless-assignment |
src/Browser/Avalonia.Browser/webapp/modules/avalonia/input.ts:586 | `inputElement.style.width` is assigned twice; the first assignment is useless | Lint |
| low | zizmor/self-repository |
.github/workflows/CLA.yml:20 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/build.yml:101 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build.yml:170 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/build.yml:190 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/build.yml:35 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/build.yml:64 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/publish-nuget-pr.yml:77 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/submit-dependency-graph.yml:33 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
build.cake:811 | Possible generic-api-key secret in history (commit 57750c8cfe); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
samples/ControlCatalog/Pages/ThemePage.axaml:73 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
src/Avalonia.X11/X11KeyTransform.cs:199 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | osv/GHSA-v6h2-p8h4-qcjw |
src/Browser/Avalonia.Browser/webapp/bun.lock | [email protected] (npm) is affected by GHSA-v6h2-p8h4-qcjw | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
src/Headless/Avalonia.Headless.Vnc/HeadlessVncFramebufferSource.cs:103 | Possible generic-api-key secret in history (commit 5df3a46645); removed from the current tree but still retrievable | Secrets (gitleaks) |
| info | zizmor/template-injection |
.github/workflows/update-api.yml:95 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 12 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 55 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 28 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 2 | |
| OpenSSF Scorecard | Security | ok | scorecard v5.6.0 | 0 | |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 4 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 8035f14fd356 | prov-5+qual-2+sec-2 | 4% | 76 | 60 |
Full text report
- Repository: https://github.com/AvaloniaUI/Avalonia
- Commit:
8035f14fd356beb7d7e7d8243dc8ce98dfc27551 - Generated: 2026-11-14T15:13:19+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 4 | explicit | 95% | 100% |
| Code quality | 76 | adequate | 90% | 100% |
| Security | 60 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 4% of first-party code added; an estimated 4% including velocity signals.
- Explicitly attributed share (lower bound): 4.1%
- Unattributed share in AI-consistent velocity bursts: 3.3%
- Estimated AI-generated share: 4.1%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 96 | 44,254 |
| GitHub Copilot coding agent | 30 | 15,531 |
| Cursor agent | 2 | 59 |
| OpenAI Codex | 1 | 0 |
- AI tooling configured in repo: github-copilot
Current source lines last changed by AI-attributed commits: 12,928 of 207,263 (sampled).
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.031 | 0.0x |
| Security | 0.0 | 0.01 | 0.0x |
- Stylometry index: 0.06 per 1,000 lines (narrated steps 23, placeholders 0, assistant phrasing 0, emoji 8). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 7,708 | 16% |
| 2026-01 | 12,418 | 0% |
| 2026-02 | 13,665 | 10% |
| 2026-03 | 54,559 | 4% |
| 2026-04 | 4,332 | 3% |
| 2026-05 | 17,453 | 14% |
| 2026-06 | 28,425 | 1% |
| 2026-07 | 15,788 | 10% |
| 2026-08 | 27,453 | 50% |
| 2026-09 | 22,483 | 60% |
| 2026-10 | 24,647 | 53% |
| 2026-11 | 17,185 | 59% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (500e78afef78)
- Claude Code: PR description attribution (02d7bc35e34f)
- Claude Code: trailer 'Co-Authored-By: Claude' (e08cd2521268)
- Claude Code: trailer 'Co-authored-by: Claude' (60b171959631)
- Claude Code: trailer 'Co-authored-by: Claude' (e73a976afd39)
- Claude Code: trailer 'Co-authored-by: Claude' (a4f832f5d67f)
- Claude Code: PR description attribution (6350ac83e644)
- Claude Code: trailer 'Co-authored-by: Claude' (61c3aaa8762c)
- Claude Code: trailer 'Co-Authored-By: Claude' (24b6c7b41046)
- Claude Code: trailer 'Co-Authored-By: Claude' (050d3fb9411b)
- Claude Code: trailer 'Co-Authored-By: Claude' (22e9912b7518)
- Claude Code: trailer 'Co-Authored-By: Claude' (5ef345810e89)
- Claude Code: trailer 'Co-Authored-By: Claude' (8dae86830885)
- Claude Code: trailer 'Co-Authored-By: Claude' (80c4f31848f6)
- Claude Code: trailer 'Co-Authored-By: Claude' (2061fb509005)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.45, no CI test run detected; 15% of function code in complex or long functions; 6% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 63 |
| Duplication | 71 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 68 |
| Documentation | 80 |
| Type safety | 60 |
| Process (Scorecard review/maintenance) | 100 |
- Functions: 21,295; mean complexity 2.8, 90th percentile 6; 349 complex and 125 long functions
- Duplicated lines: 5.8% of 299,647 compared
- Tests: 217,649 test lines for 481,642 source lines (ratio 0.45); CI test commands: none detected; 63% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- WindowImpl::AppWndProc in src/Windows/Avalonia.Win32/WindowImpl.AppWndProc.cs: complexity 197, 806 lines
- XamlCompilerTaskExecutor::CompileCore in src/Avalonia.Build.Tasks/XamlCompilerTaskExecutor.cs: complexity 99, 498 lines
- ExpressionVariant::GetProperty in src/Avalonia.Base/Rendering/Composition/Expressions/ExpressionVariant.cs: complexity 83, 192 lines
- BidiAlgorithm::ProcessIsolatedRunSequence in src/Avalonia.Base/Media/TextFormatting/Unicode/BiDiAlgorithm.cs: complexity 78, 302 lines
- XamlIlBindingPathHelper::TransformBindingPath in src/Markup/Avalonia.Markup.Xaml.Loader/CompilerExtensions/XamlIlBindingPathHelper.cs: complexity 77, 313 lines
Security
Security posture is weak: 28 known vulnerabilities in 12 dependencies; 42 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 88 |
| Static analysis (Opengrep) | 100 |
| Vulnerable dependencies (OSV) | 25 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 100 |
| OpenSSF Scorecard | 33 |
-
Known vulnerabilities: 28 in 12 packages (critical 1, high 17, medium 9, low 1)
-
Posture checks passed: security policy, dependency updates, signed commits, lockfiles; missing: none
-
OpenSSF Scorecard aggregate: 6.2/10 (published 2026-10-19)
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-w7jw-789q-3m8p: [email protected] (npm) is affected by GHSA-w7jw-789q-3m8p |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-3jxr-9vmj-r5cp: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-mh99-v99m-4gvg: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-rgw5-rvv9-x895: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-3xgq-45jj-v275: [email protected] (npm) is affected by GHSA-3xgq-45jj-v275 |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-3xgq-45jj-v275: [email protected] (npm) is affected by GHSA-3xgq-45jj-v275 |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-25h7-pfq9-p65f: [email protected] (npm) is affected by GHSA-25h7-pfq9-p65f |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-rf6f-7fwh-wjgh: [email protected] (npm) is affected by GHSA-rf6f-7fwh-wjgh |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-2883-xcg3-v3hh: [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-52cp-r559-cp3m: [email protected] (npm) is affected by GHSA-52cp-r559-cp3m |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-5p4m-2wfm-xmqj: [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-23c5-xmqv-rm74: [email protected] (npm) is affected by GHSA-23c5-xmqv-rm74 |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-3ppc-4f35-3m26: [email protected] (npm) is affected by GHSA-3ppc-4f35-3m26 |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-7r86-cg39-jmmj: [email protected] (npm) is affected by GHSA-7r86-cg39-jmmj |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-c2c7-rcm5-vvqj: [email protected] (npm) is affected by GHSA-c2c7-rcm5-vvqj |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | osv/GHSA-395f-4hp3-45gv: [email protected] (npm) is affected by GHSA-395f-4hp3-45gv |
src/Browser/Avalonia.Browser/webapp/bun.lock |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/actions/publish-nuget/action.yml:26 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/actions/publish-nuget/action.yml:32 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/actions/publish-nuget/action.yml:40 |
| high | zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] |
.github/workflows/CLA.yml:5 |
| high | zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] |
.github/workflows/CLA.yml:3 |
| high | zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] |
.github/workflows/api-diff.yml:4 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/api-diff.yml:28 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 481,642; test lines: 217,649
| Language | Lines |
|---|---|
| C# | 694,044 |
| TypeScript | 3,503 |
| C | 1,476 |
| Shell | 95 |
| JavaScript | 94 |
| PowerShell | 79 |