Leaderboard github.com

Benehiko/tidalt

Lossless bit-perfect Linux tidal player

View repository ↗
Go
★ 6
commit fd1978e8263f
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

56%

explicit

Confidence: 95%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

75/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

59/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

56% explicit

Explicit AI attribution on 57% of first-party code added; an estimated 57% including velocity signals.

How the score is built

Explicitly attributed share57%
Unattributed share in AI-pace bursts23%
Estimated AI-generated share57%
AI tool configuration files3
Work sessions at AI pace2
Releases at AI pace0
Coding-style index (1.0+ means possible)0.00

Attributed AI tools

Tool	Commits	Lines added	First seen	Last seen
Claude Code	55	9,918	2026-03-26	2026-09-15

Lines added per month all AI-attributed share

2026-037,711 · 1% AI
2026-05638 · 100% AI
2026-067,205 · 100% AI
2026-081,619 · 100% AI
2026-09373 · 100% AI

Findings in AI-attributed lines vs the rest

From git blame: 7,629 lines trace to AI-attributed commits, 4,415 to others. Reported, not scored.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Code quality	0.26	1.13	0.23×
Security	1.57	0.91	1.74×

Evidence by analyzer

Explicit AI attributionok26 items

attributed_commit_share: 39.0%
attributed_commits: 55
attributed_loc: 9,918
attributed_loc_share: 56.5%
commits: 141
effective_loc: 17,546
tools_detected: 1

AI tool configurationok3 items

artifacts: 3
earliest_adoption: 2026-03-13
tools_configured: 3
workflow_agents: 0

Commit velocityok2 items

excluded_import_loc: 0
flagged_loc: 7,379
flagged_loc_share: 42.1%
flagged_units: 2
max_loc_per_hour: 1,313.06
measured_loc: 17,546
median_loc_per_hour: 101.79
pr_timed_units: 11
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 30

Release velocityok

flagged_releases: 0
max_loc_per_day: 18,116.50
releases: 17

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 12,044
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Findings in AI-written linesok

ai_lines: 7,629
blame_failures: 0
files_blamed: 43
other_lines: 4,415
quality:ai_findings: 2
quality:ai_per_kloc: 0.26
quality:other_findings: 5
quality:other_per_kloc: 1.13
quality:ratio: 0.23
security:ai_findings: 12
security:ai_per_kloc: 1.57
security:other_findings: 4
security:other_per_kloc: 0.91
security:ratio: 1.74

Code quality

75 adequate

Code quality is adequate: test-to-source ratio 0.15, CI runs tests; 15% of function code in complex or long functions; 5% duplicated lines. Weakest area: complexity.

How the score is built

Complexity64
Duplication73
Lint and smells86
Tests and CI81
Documentation65
Type safetynot measured
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 11
function_nloc: 7,505
functions: 530
long_functions: 3
many_param_functions: 0
mean_ccn: 3.72
p90_ccn: 8
risky_nloc_share: 15.1%

Duplication (jscpd)ok10 items

compared_lines: 9,015
duplicated_lines: 466
duplicated_share: 5.2%
files: 43

Lintok

category:correctness: 7
findings: 7
scanned_lines: 12,044
weighted_findings: 7

Tests and CIok5 items

CI config: .github/workflows/ci.yml .github/workflows/ci.yml
CI config: .github/workflows/lint.yml .github/workflows/lint.yml
CI config: .github/workflows/release.yml .github/workflows/release.yml
CI runs tests (go test)
CI runs linters (golangci-lint)

check:ci_present: yes
check:ci_runs_lint: yes
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: no
ci_files: 3
cochange_commits: 109
cochange_share: 22.9%
source_lines: 12,044
test_lines: 1,749
test_ratio: 0.15

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 165

Type safetyskipped

Security

59 weak

Security posture is weak: 30 known vulnerabilities in 5 dependencies; 3 high-severity SAST findings; 26 high-severity workflow issues. Weakest area: ci actions.

How the score is built

Secrets94
Static analysis (SAST)79
Vulnerable dependencies61
CI workflows1
Security posture20
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 2
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 17
findings_high: 3
findings_low: 0
findings_medium: 14
parse_errors: 0
scanned_lines: 12,044
weighted_findings: 8.25

Dependencies (osv-scanner)ok

penalty: 30
vulnerabilities: 30
vulnerable_packages: 5
vulns_critical: 7
vulns_high: 3
vulns_low: 1
vulns_medium: 5
vulns_unknown: 14

CI workflows (zizmor)ok

findings: 34
findings_high: 26
findings_low: 1
findings_medium: 7
penalty: 312
workflows: 3

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: yes
signed_commit_share: 83.0%
unpinned_manifests: 0

Release downloadsok5 items

binary_assets: 36
signals: 1
suspicious: 0

Findings

7 critical32 high47 medium3 low1 info

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-5cgq-3rg8-m6cv`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv	Dependencies (osv-scanner)
critical	`osv/GHSA-89gr-r52h-f8rx`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx	Dependencies (osv-scanner)
critical	`osv/GHSA-f5wc-c3c7-36mc`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc	Dependencies (osv-scanner)
critical	`osv/GHSA-jppx-rxg9-jmrx`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx	Dependencies (osv-scanner)
critical	`osv/GHSA-rm3j-f69w-wqmq`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq	Dependencies (osv-scanner)
critical	`osv/GHSA-vgwf-h737-ff37`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37	Dependencies (osv-scanner)
critical	`osv/GHSA-x527-x647-q7gg`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg	Dependencies (osv-scanner)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:17	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:20	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:30	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/ci.yml:33	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/lint.yml:17	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/lint.yml:20	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/lint.yml:24	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/lint.yml:35	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:109	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:121	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/release.yml:138	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:164	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:25	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/cache-poisoning`	.github/workflows/release.yml:27	runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:27	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/template-injection`	.github/workflows/release.yml:43	code injection via template expansion [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:45	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:56	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:59	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:62	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:65	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:84	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:87	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/excessive-permissions`	.github/workflows/release.yml:9	overly broad permissions [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:90	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:93	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	cmd/tidalt/play.go:82	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	cmd/tidalt/setup.go:71	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`osv/GHSA-q4h4-gmj2-qvw2`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2	Dependencies (osv-scanner)
high	`osv/GHSA-q675-qj96-32m9`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5032, GHSA-q675-qj96-32m9	Dependencies (osv-scanner)
high	`osv/GHSA-w879-237q-wc7r`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r	Dependencies (osv-scanner)
high	`opengrep/dockerfile.security.missing-user-entrypoint`	packaging/docker/Dockerfile:59	By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile...	Static analysis (opengrep)
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	cmd/tidalt/daemon.go:79	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	cmd/tidalt/play.go:26	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	cmd/tidalt/setup.go:23	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	internal/logger/logger.go:26	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	internal/store/store.go:111	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	internal/store/store.go:36	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	internal/store/store.go:74	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`zizmor/artipacked`	.github/workflows/ci.yml:17	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/ci.yml:30	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/lint.yml:17	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/lint.yml:35	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/release.yml:25	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/release.yml:56	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/release.yml:84	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`opengrep/go.lang.security.audit.xss.import-text-template`	cmd/tidalt/daemon.go:8	When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not...	Static analysis (opengrep)
medium	`osv/GHSA-44p7-9xx4-hf2g`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-4815, GHSA-44p7-9xx4-hf2g	Dependencies (osv-scanner)
medium	`osv/GHSA-45gg-vh54-h5m9`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9	Dependencies (osv-scanner)
medium	`osv/GHSA-78mq-xcr3-xm33`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33	Dependencies (osv-scanner)
medium	`osv/GHSA-9m57-25v3-79x9`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9	Dependencies (osv-scanner)
medium	`osv/GHSA-qpw4-5x99-6vjp`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp	Dependencies (osv-scanner)
medium	`osv/GO-2026-4961`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-4961	Dependencies (osv-scanner)
medium	`osv/GO-2026-4962`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-4962	Dependencies (osv-scanner)
medium	`osv/GO-2026-5024`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5024	Dependencies (osv-scanner)
medium	`osv/GO-2026-5031`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5031	Dependencies (osv-scanner)
medium	`osv/GO-2026-5061`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5061	Dependencies (osv-scanner)
medium	`osv/GO-2026-5062`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5062	Dependencies (osv-scanner)
medium	`osv/GO-2026-5066`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5066	Dependencies (osv-scanner)
medium	`osv/GO-2026-5932`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5932	Dependencies (osv-scanner)
medium	`osv/GO-2026-5970`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5970	Dependencies (osv-scanner)
medium	`osv/GO-2026-6222`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6222	Dependencies (osv-scanner)
medium	`osv/GO-2026-6303`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6303	Dependencies (osv-scanner)
medium	`osv/GO-2026-6354`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6354	Dependencies (osv-scanner)
medium	`osv/GO-2026-6355`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6355	Dependencies (osv-scanner)
medium	`osv/GO-2026-6629`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6629	Dependencies (osv-scanner)
medium	`opengrep/c.lang.security.insecure-use-memset`	internal/player/avcodec.c:13	When handling sensitive information in a buffer, it's important to ensure that the data is securely erased before the buffer is deleted or reused. While `memset()` is commonly used for this purpose, it can leave sensitive information...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	internal/player/avcodec.go:106	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	internal/player/avcodec.go:128	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	internal/player/avcodec.go:128	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	internal/player/avcodec.go:130	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	internal/player/avcodec.go:144	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	internal/player/avcodec.go:80	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	internal/player/avcodec.go:80	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	internal/player/mpv.go:1012	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	internal/player/mpv.go:478	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.crypto.math-random-used`	internal/ui/components.go:5	Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.crypto.math-random-used`	internal/ui/model.go:9	Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/dockerfile.security.no-sudo-in-dockerfile`	packaging/arch/Dockerfile:21	Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities. [confidence high]	Static analysis (opengrep)
low	`osv/GHSA-fw7p-63qq-7hpr`	go.mod	filippo.io/[email protected] (Go) is affected by GO-2026-4503, GHSA-fw7p-63qq-7hpr	Dependencies (osv-scanner)
low	`gitleaks/generic-api-key`	internal/tidal/client.go:22	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	vendor/filippo.io/age/README.md:19	Possible generic-api-key secret in the current tree	Secrets (gitleaks)
info	`zizmor/superfluous-actions`	.github/workflows/release.yml:164	action functionality is already included by the runner [confidence high]	CI workflows (zizmor)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-4`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-4`	0
Findings in AI-written lines	AI provenance	ok	`git-blame`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	7
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	34
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	30
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	17
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	2

Score history

Scores from different scoring versions aren't directly comparable.

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`fd1978e8263f`	`prov-5+qual-2+sec-2`	56%	75	59
2026-11-14	`fd1978e8263f`	`prov-4+qual-2+sec-2`	56%	75	59

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Benehiko/tidalt/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Benehiko/tidalt/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Benehiko/tidalt/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Benehiko/tidalt/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Benehiko/tidalt/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Benehiko/tidalt/)

Full text report

Repository: https://github.com/Benehiko/tidalt
Commit: fd1978e8263f64b0bc3b7fee3abf5692860eddeb
Generated: 2026-11-14T14:52:00+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	56	explicit	95%	100%
Code quality	75	adequate	90%	100%
Security	59	weak	85%	100%

AI provenance

Explicit AI attribution on 57% of first-party code added; an estimated 57% including velocity signals.

Explicitly attributed share (lower bound): 56.5%
Unattributed share in AI-consistent velocity bursts: 22.7%
Estimated AI-generated share: 56.5%

AI tool	Attributed commits	Lines added
Claude Code	55	9,918

AI tooling configured in repo: claude-code, gemini, generic-agent

Current source lines last changed by AI-attributed commits: 7,629 of 12,044.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	0.262	1.133	0.23x
Security	1.573	0.906	1.74x

Month	Lines added	Attributed to AI
2026-03	7,711	1%
2026-05	638	100%
2026-06	7,205	100%
2026-08	1,619	100%
2026-09	373	100%

Evidence

Claude Code: trailer 'Co-authored-by: Claude' (fd1978e8263f)
Claude Code: trailer 'Co-authored-by: Claude' (b83167db532c)
Claude Code: trailer 'Co-Authored-By: Claude' (a06a0b32cc8c)
Claude Code: trailer 'Co-authored-by: Claude' (e253b757a210)
Claude Code: trailer 'Co-authored-by: Claude' (6cf18c99f807)
Claude Code: trailer 'Co-Authored-By: Claude' (1d3151ffad62)
Claude Code: trailer 'Co-Authored-By: Claude' (4cc038d0b812)
Claude Code: trailer 'Co-Authored-By: Claude' (17dd268bc7ca)
Claude Code: trailer 'Co-Authored-By: Claude' (1eaaf459cb94)
Claude Code: trailer 'Co-Authored-By: Claude' (f93fa3892ed9)
Claude Code: trailer 'Co-authored-by: Claude' (bbb6968819fa)
Claude Code: trailer 'Co-authored-by: Claude' (5e1e89c22ea9)
Claude Code: trailer 'Co-authored-by: Claude' (70b4b889ca6a)
Claude Code: trailer 'Co-Authored-By: Claude' (eda1bccd4f6c)
Claude Code: trailer 'Co-Authored-By: Claude' (3db6c6fa1a73)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.15, CI runs tests; 15% of function code in complex or long functions; 5% duplicated lines. Weakest area: complexity.

Area	Score
Complexity (lizard)	64
Duplication	73
Code smells (Opengrep)	86
Tests and CI	81
Documentation	65
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 530; mean complexity 3.7, 90th percentile 8; 11 complex and 3 long functions
Duplicated lines: 5.2% of 9,015 compared
Tests: 1,749 test lines for 12,044 source lines (ratio 0.15); CI test commands: go test; 23% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 30 known vulnerabilities in 5 dependencies; 3 high-severity SAST findings; 26 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	94
Static analysis (Opengrep)	79
Vulnerable dependencies (OSV)	61
CI workflows (zizmor)	1
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	n/a

Known vulnerabilities: 30 in 5 packages (critical 7, high 3, medium 5, low 1)
Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates

Top findings

Severity	Finding	Location
critical	`osv/GHSA-jppx-rxg9-jmrx`: golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx	go.mod
critical	`osv/GHSA-f5wc-c3c7-36mc`: golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc	go.mod
critical	`osv/GHSA-vgwf-h737-ff37`: golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37	go.mod
critical	`osv/GHSA-89gr-r52h-f8rx`: golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx	go.mod
critical	`osv/GHSA-rm3j-f69w-wqmq`: golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq	go.mod
critical	`osv/GHSA-5cgq-3rg8-m6cv`: golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv	go.mod
critical	`osv/GHSA-x527-x647-q7gg`: golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg	go.mod
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	cmd/tidalt/play.go:82
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	cmd/tidalt/setup.go:71
high	`opengrep/dockerfile.security.missing-user-entrypoint`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	packaging/docker/Dockerfile:59
high	`osv/GHSA-q4h4-gmj2-qvw2`: golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2	go.mod
high	`osv/GHSA-w879-237q-wc7r`: golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r	go.mod
high	`osv/GHSA-q675-qj96-32m9`: golang.org/x/[email protected] (Go) is affected by GO-2026-5032, GHSA-q675-qj96-32m9	go.mod
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:17
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:20
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:30
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:33
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/lint.yml:17
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/lint.yml:20
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/lint.yml:24
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/lint.yml:35
high	`zizmor/excessive-permissions`: overly broad permissions [confidence high]	.github/workflows/release.yml:9
high	`zizmor/template-injection`: code injection via template expansion [confidence high]	.github/workflows/release.yml:43
high	`zizmor/template-injection`: code injection via template expansion [confidence high]	.github/workflows/release.yml:138
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:25

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v4.0.3 ships tidalt-4.0.3-1.fc44.aarch64.rpm (4 downloads)
binary-release-asset: release v4.0.3 ships tidalt-4.0.3-1.fc44.x86_64.rpm (10 downloads)
binary-release-asset: release v4.0.3 ships tidalt_4.0.3-1_amd64.deb (17 downloads)
binary-release-asset: release v4.0.3 ships tidalt_4.0.3-1_arm64.deb (5 downloads)
binary-release-asset: release v4.0.2 ships tidalt-4.0.2-1.fc44.aarch64.rpm (4 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 12,044; test lines: 1,749

Language	Lines
Go	13,210
C	357
Shell	155
HCL	71