Leaderboard github.com

Blankj/AndroidUtilCode

:fire: Android developers should collect the following utils(updating).

View repository ↗
Java
★ 33,602
commit 7b4caf9e5440
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

none-detected

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

64/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

62/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace0
Releases at AI pace0
Coding-style index (1.0+ means possible)0.00

Lines added per month all AI-attributed share

2016-070 · 0% AI
2016-0813,208 · 0% AI
2016-096,257 · 0% AI
2016-105,168 · 0% AI
2016-111,997 · 0% AI
2016-123,117 · 0% AI
2017-01566 · 0% AI
2017-021,949 · 0% AI
2017-031,985 · 0% AI
2017-042,489 · 0% AI
2017-057,079 · 0% AI
2017-0616,712 · 0% AI
2017-072,666 · 0% AI
2017-082,624 · 0% AI
2017-096,046 · 0% AI
2017-10294 · 0% AI
2017-111,552 · 0% AI
2017-124,227 · 0% AI
2018-014,328 · 0% AI
2018-024,039 · 0% AI
2018-032,343 · 0% AI
2018-043,657 · 0% AI
2018-053,693 · 0% AI
2018-062,970 · 0% AI
2018-071,389 · 0% AI
2018-081,471 · 0% AI
2018-091,511 · 0% AI
2018-1031,275 · 0% AI
2018-117,736 · 0% AI
2018-123,235 · 0% AI
2019-0112,999 · 0% AI
2019-023,515 · 0% AI
2019-033,529 · 0% AI
2019-04363 · 0% AI
2019-051,510 · 0% AI
2019-0623,520 · 0% AI
2019-074,892 · 0% AI
2019-086,420 · 0% AI
2019-096,100 · 0% AI
2019-118,205 · 0% AI
2019-12532 · 0% AI
2020-01198 · 0% AI
2020-033,973 · 0% AI
2020-041,492 · 0% AI
2020-05826 · 0% AI
2020-0819 · 0% AI
2020-09966 · 0% AI
2020-102,443 · 0% AI
2020-11375 · 0% AI
2020-121 · 0% AI
2021-0168 · 0% AI
2021-02976 · 0% AI
2021-045 · 0% AI
2021-05174 · 0% AI
2021-0913 · 0% AI
2021-1123 · 0% AI
2021-12151 · 0% AI
2022-050 · 0% AI
2022-0611 · 0% AI
2022-07452 · 0% AI
2022-1076 · 0% AI
2024-04102 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 1,273
effective_loc: 229,512
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok

excluded_import_loc: 75,887
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 1,039.50
measured_loc: 153,625
median_loc_per_hour: 80.17
pr_timed_units: 0
pre_ai_era_burst_loc: 17,641
pre_ai_era_bursts: 7
pre_ai_era_measured_loc: 152,797
work_units: 732

Release velocityok

flagged_releases: 0
max_loc_per_day: 1,587.80
releases: 99

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 63,440
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

64 weak

Code quality is weak: test-to-source ratio 0.12, no CI test run detected; 6% of function code in complex or long functions; 15% duplicated lines. Weakest area: process.

How the score is built

Complexity84
Duplication42
Lint and smells98
Tests and CI51
Documentation85
Type safetynot measured
Review process20

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 13
function_nloc: 30,941
functions: 4,508
long_functions: 8
many_param_functions: 22
mean_ccn: 1.87
p90_ccn: 4
risky_nloc_share: 5.8%

Duplication (jscpd)ok10 items

compared_lines: 38,733
duplicated_lines: 5,619
duplicated_share: 14.5%
files: 299

Lintok

category:correctness: 13
findings: 13
scanned_lines: 63,440
weighted_findings: 4

Tests and CIok1 item

CI config: .github/workflows/android.yml .github/workflows/android.yml

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: yes
check:test_ratio: no
check:tests_cochange: yes
ci_files: 1
cochange_commits: 209
cochange_share: 31.6%
source_lines: 63,440
test_lines: 7,705
test_ratio: 0.12

Documentationok3 items

README.md README.md
LICENSE LICENSE
CHANGELOG.md CHANGELOG.md

check:changelog: yes
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 47

Type safetyskipped

Security

62 weak

Security posture is weak: 1 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets77
Static analysis (SAST)94
Vulnerable dependenciesnot measured
CI workflows63
Security posture0
OpenSSF Scorecard24

Evidence by analyzer

OpenSSF Scorecardok13 items

aggregate: 2.80
check:Binary-Artifacts: yes
check:Branch-Protection: no
check:CII-Best-Practices: no
check:Code-Review: yes
check:Dangerous-Workflow: yes
check:Fuzzing: no
check:License: yes
check:Maintained: no
check:Pinned-Dependencies: no
check:SAST: no
check:Security-Policy: no
check:Signed-Releases: no
check:Token-Permissions: no

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 2
secrets_nonprod: 6

Static analysis (opengrep)ok

findings: 29
findings_high: 1
findings_low: 0
findings_medium: 28
parse_errors: 1
scanned_lines: 63,440
weighted_findings: 11.40

Dependencies (osv-scanner)skipped

CI workflows (zizmor)ok

findings: 4
findings_high: 2
findings_low: 0
findings_medium: 2
penalty: 27.60
workflows: 1

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 7.0%
unpinned_manifests: 0

Release downloadsok5 items

binary_assets: 10
signals: 1
suspicious: 0

Findings

3 high31 medium20 low

Severity	Rule	Location	Message	Tool
high	`zizmor/unpinned-uses`	.github/workflows/android.yml:11	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/android.yml:13	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/java.lang.security.audit.command-injection-process-builder`	lib/utilcode/src/main/java/com/blankj/utilcode/util/DeviceUtils.java:417	A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or...	Static analysis (opengrep)
medium	`opengrep/java.lang.correctness.no-string-eqeq`	lib/utilcode/src/main/java/com/blankj/utilcode/util/BusUtils.java:331	Strings should not be compared with '=='. This is a reference comparison operator. Use '.equals()' instead.	Lint
medium	`zizmor/artipacked`	.github/workflows/android.yml:11	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/android.yml:6	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`opengrep/java.android.security.exported_activity`	feature/launcher/app/src/main/AndroidManifest.xml:13	The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access...	Static analysis (opengrep)
medium	`opengrep/java.android.security.exported_activity`	feature/main/app/src/main/AndroidManifest.xml:12	The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access...	Static analysis (opengrep)
medium	`opengrep/java.android.security.exported_activity`	feature/subutil/app/src/main/AndroidManifest.xml:12	The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access...	Static analysis (opengrep)
medium	`opengrep/java.android.security.exported_activity`	feature/utilcode/app/src/main/AndroidManifest.xml:12	The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:101	Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:105	Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.weak-ssl-context`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:123	An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance("TLSv1.2") for the best security. [confidence high]	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:42	Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks. [confidence low]	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:68	Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:72	Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:81	Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:85	Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:89	Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:93	Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/BusUtils.java:143	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/BusUtils.java:241	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/BusUtils.java:243	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/BusUtils.java:272	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.object-deserialization`	lib/utilcode/src/main/java/com/blankj/utilcode/util/ConvertUtils.java:326	Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.use-of-md5`	lib/utilcode/src/main/java/com/blankj/utilcode/util/EncryptUtils.java:181	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. [confidence high]	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.crypto.use-of-md5`	lib/utilcode/src/main/java/com/blankj/utilcode/util/FileUtils.java:1263	Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. [confidence high]	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/LogUtils.java:1192	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/LogUtils.java:1224	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/ReflectUtils.java:104	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/ReflectUtils.java:96	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/ServiceUtils.java:146	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/ServiceUtils.java:53	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
medium	`opengrep/java.lang.security.audit.unsafe-reflection`	lib/utilcode/src/main/java/com/blankj/utilcode/util/ServiceUtils.java:94	If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not...	Static analysis (opengrep)
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	script/gitHelp.sh:14	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	script/gitHelp.sh:18	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-command-substitution-in-command`	script/gitHelp.sh:20	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.	Lint
low	`opengrep/bash.lang.correctness.unquoted-command-substitution-in-command`	script/gitHelp.sh:22	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	script/gitHelp.sh:22	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-command-substitution-in-command`	script/gitHelp.sh:24	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.	Lint
low	`opengrep/bash.lang.correctness.unquoted-command-substitution-in-command`	script/gitHelp.sh:26	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	script/gitHelp.sh:26	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`opengrep/bash.lang.correctness.unquoted-command-substitution-in-command`	script/gitHelp.sh:39	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.	Lint
low	`opengrep/bash.lang.correctness.unquoted-command-substitution-in-command`	script/gitHelp.sh:42	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.	Lint
low	`opengrep/bash.lang.correctness.unquoted-command-substitution-in-command`	script/gitHelp.sh:44	The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.	Lint
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	script/gitHelp.sh:44	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`gitleaks/generic-api-key`	README-CN.md:87	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	README.md:87	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	gradle.properties:23	Possible generic-api-key secret in history (commit c0dd366b78); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	lib/utilcode/src/test/java/com/blankj/utilcode/util/EncryptUtilsTest.java:274	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	utilcode-kotlin/src/test/java/com/blankj/utilcode/util/EncryptUtilsTest.java:490	Possible generic-api-key secret in history (commit 1c36d1eddf); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	utilcode/lib/src/test/java/com/blankj/utilcode/util/EncryptUtilsTest.java:377	Possible generic-api-key secret in history (commit 208aee9a37); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	utilcode/local.properties:3	Possible generic-api-key secret in history (commit 58d584e4f2); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	utilcode/src/test/java/com/blankj/utilcode/util/EncryptUtilsTest.java:525	Possible generic-api-key secret in history (commit b45808d3ed); removed from the current tree but still retrievable	Secrets (gitleaks)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	13
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	4
Dependencies (osv-scanner)	Security	skipped	`—`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	29
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	8

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`7b4caf9e5440`	`prov-5+qual-2+sec-2`	0%	64	62

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Blankj/AndroidUtilCode/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Blankj/AndroidUtilCode/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Blankj/AndroidUtilCode/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Blankj/AndroidUtilCode/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Blankj/AndroidUtilCode/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Blankj/AndroidUtilCode/)

Full text report

Repository: https://github.com/Blankj/AndroidUtilCode
Commit: 7b4caf9e5440046b3fefb63b6b6e2ead7ebaf809
Generated: 2026-11-14T15:14:15+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	65%	100%
Code quality	64	weak	90%	100%
Security	62	weak	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%

Month	Lines added	Attributed to AI
2020-12	1	0%
2021-01	68	0%
2021-02	976	0%
2021-04	5	0%
2021-05	174	0%
2021-09	13	0%
2021-11	23	0%
2021-12	151	0%
2022-06	11	0%
2022-07	452	0%
2022-10	76	0%
2024-04	102	0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.12, no CI test run detected; 6% of function code in complex or long functions; 15% duplicated lines. Weakest area: process.

Area	Score
Complexity (lizard)	84
Duplication	42
Code smells (Opengrep)	98
Tests and CI	51
Documentation	85
Type safety	n/a
Process (Scorecard review/maintenance)	20

Functions: 4,508; mean complexity 1.9, 90th percentile 4; 13 complex and 8 long functions
Duplicated lines: 14.5% of 38,733 compared
Tests: 7,705 test lines for 63,440 source lines (ratio 0.12); CI test commands: none detected; 32% of recent source commits also change tests
Docs missing or thin: contributing

Most complex functions:

Security

Security posture is weak: 1 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	77
Static analysis (Opengrep)	94
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	63
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	24

Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
OpenSSF Scorecard aggregate: 2.8/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
high	`opengrep/java.lang.security.audit.command-injection-process-builder`: A formatted or concatenated string was detected as input to a ProcessBuilder call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized. [confidence low]	lib/utilcode/src/main/java/com/blankj/utilcode/util/DeviceUtils.java:417
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/android.yml:11
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/android.yml:13
medium	`opengrep/java.android.security.exported_activity`: The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]	feature/launcher/app/src/main/AndroidManifest.xml:13
medium	`opengrep/java.android.security.exported_activity`: The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]	feature/main/app/src/main/AndroidManifest.xml:12
medium	`opengrep/java.android.security.exported_activity`: The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]	feature/subutil/app/src/main/AndroidManifest.xml:12
medium	`opengrep/java.android.security.exported_activity`: The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]	feature/utilcode/app/src/main/AndroidManifest.xml:12
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-hostname-verifier`: Insecure HostnameVerifier implementation detected. This will accept any SSL certificate with any hostname, which creates the possibility for man-in-the-middle attacks. [confidence low]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:42
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for [confidence low]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:68
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for [confidence low]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:72
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for [confidence low]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:81
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for [confidence low]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:85
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for [confidence low]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:89
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for [confidence low]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:93
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for [confidence low]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:101
medium	`opengrep/java.lang.security.audit.crypto.ssl.insecure-trust-manager`: Detected empty trust manager implementations. This is dangerous because it accepts any certificate, enabling man-in-the-middle attacks. Consider using a KeyStore and TrustManagerFactory instead. See https://stackoverflow.com/questions/2642777/trusting-all-certificates-using-httpclient-over-https for [confidence low]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:105
medium	`opengrep/java.lang.security.audit.weak-ssl-context`: An insecure SSL context was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use SSLContext.getInstance("TLSv1.2") for the best security. [confidence high]	lib/subutil/src/main/java/com/blankj/subutil/util/http/SSLConfig.java:123
medium	`opengrep/java.lang.security.audit.unsafe-reflection`: If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may a [confidence low]	lib/utilcode/src/main/java/com/blankj/utilcode/util/BusUtils.java:143
medium	`opengrep/java.lang.security.audit.unsafe-reflection`: If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may a [confidence low]	lib/utilcode/src/main/java/com/blankj/utilcode/util/BusUtils.java:241
medium	`opengrep/java.lang.security.audit.unsafe-reflection`: If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may a [confidence low]	lib/utilcode/src/main/java/com/blankj/utilcode/util/BusUtils.java:243
medium	`opengrep/java.lang.security.audit.unsafe-reflection`: If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may a [confidence low]	lib/utilcode/src/main/java/com/blankj/utilcode/util/BusUtils.java:272
medium	`opengrep/java.lang.security.audit.object-deserialization`: Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to [confidence low]	lib/utilcode/src/main/java/com/blankj/utilcode/util/ConvertUtils.java:326
medium	`opengrep/java.lang.security.audit.crypto.use-of-md5`: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. [confidence high]	lib/utilcode/src/main/java/com/blankj/utilcode/util/EncryptUtils.java:181
medium	`opengrep/java.lang.security.audit.crypto.use-of-md5`: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. [confidence high]	lib/utilcode/src/main/java/com/blankj/utilcode/util/FileUtils.java:1263
medium	`opengrep/java.lang.security.audit.unsafe-reflection`: If an attacker can supply values that the application then uses to determine which class to instantiate or which method to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may a [confidence low]	lib/utilcode/src/main/java/com/blankj/utilcode/util/LogUtils.java:1192

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release 1.30.0 ships util_1_30_0_release.apk (1011 downloads)
binary-release-asset: release 1.30.0 ships util_1_30_5_release.apk (1391 downloads)
binary-release-asset: release 1.29.0 ships util_1_29_0_release.apk (386 downloads)
binary-release-asset: release 1.28.0 ships util_1_28_0_release.apk (187 downloads)
binary-release-asset: release 1.27.0 ships util_1_27_0_release.apk (112 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 63,440; test lines: 7,705

Language	Lines
Java	64,250
Kotlin	6,832
Shell	63