Leaderboard github.com

CocoaPods/CocoaPods

The Cocoa Dependency Manager.

View repository ↗
Ruby
★ 14,833
commit b80e113e28a7
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

none-detected

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

74/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

52/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% none-detected

No AI attribution or AI-consistent velocity signals detected.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace0
Releases at AI pace0
Coding-style index (1.0+ means possible)0.05

Lines added per month all AI-attributed share

2011-08492 · 0% AI
2011-094,455 · 0% AI
2011-104,451 · 0% AI
2011-115,040 · 0% AI
2011-1244 · 0% AI
2012-0136 · 0% AI
2012-021,175 · 0% AI
2012-034,066 · 0% AI
2012-044,958 · 0% AI
2012-054,015 · 0% AI
2012-061,122 · 0% AI
2012-071,237 · 0% AI
2012-084,153 · 0% AI
2012-092,519 · 0% AI
2012-102,559 · 0% AI
2012-113,813 · 0% AI
2012-127,216 · 0% AI
2013-01812 · 0% AI
2013-027,408 · 0% AI
2013-03940 · 0% AI
2013-041,394 · 0% AI
2013-052,542 · 0% AI
2013-061,727 · 0% AI
2013-071,887 · 0% AI
2013-08985 · 0% AI
2013-0986 · 0% AI
2013-10941 · 0% AI
2013-11549 · 0% AI
2013-12433 · 0% AI
2014-01132 · 0% AI
2014-02315 · 0% AI
2014-03712 · 0% AI
2014-041,565 · 0% AI
2014-05564 · 0% AI
2014-06714 · 0% AI
2014-07671 · 0% AI
2014-083,919 · 0% AI
2014-091,421 · 0% AI
2014-103,778 · 0% AI
2014-112,177 · 0% AI
2014-121,465 · 0% AI
2015-011,598 · 0% AI
2015-02589 · 0% AI
2015-03702 · 0% AI
2015-041,462 · 0% AI
2015-052,821 · 0% AI
2015-061,115 · 0% AI
2015-07889 · 0% AI
2015-08565 · 0% AI
2015-091,100 · 0% AI
2015-101,026 · 0% AI
2015-111,129 · 0% AI
2015-121,435 · 0% AI
2016-01910 · 0% AI
2016-02880 · 0% AI
2016-036,079 · 0% AI
2016-045,778 · 0% AI
2016-051,990 · 0% AI
2016-063,967 · 0% AI
2016-07552 · 0% AI
2016-08341 · 0% AI
2016-09496 · 0% AI
2016-10454 · 0% AI
2016-11326 · 0% AI
2016-12100 · 0% AI
2017-01178 · 0% AI
2017-02195 · 0% AI
2017-03404 · 0% AI
2017-0419 · 0% AI
2017-051,122 · 0% AI
2017-061,448 · 0% AI
2017-07426 · 0% AI
2017-08556 · 0% AI
2017-091,550 · 0% AI
2017-10782 · 0% AI
2017-11379 · 0% AI
2017-12222 · 0% AI
2018-017,383 · 0% AI
2018-021,586 · 0% AI
2018-032,829 · 0% AI
2018-043,026 · 0% AI
2018-05540 · 0% AI
2018-061,054 · 0% AI
2018-071,144 · 0% AI
2018-081,763 · 0% AI
2018-09389 · 0% AI
2018-102,363 · 0% AI
2018-112,145 · 0% AI
2018-122,288 · 0% AI
2019-01754 · 0% AI
2019-021,353 · 0% AI
2019-03679 · 0% AI
2019-041,980 · 0% AI
2019-05387 · 0% AI
2019-06756 · 0% AI
2019-071,845 · 0% AI
2019-08495 · 0% AI
2019-09939 · 0% AI
2019-10606 · 0% AI
2019-11955 · 0% AI
2019-12886 · 0% AI
2020-01263 · 0% AI
2020-021,160 · 0% AI
2020-031,066 · 0% AI
2020-041,539 · 0% AI
2020-05161 · 0% AI
2020-06331 · 0% AI
2020-07328 · 0% AI
2020-08185 · 0% AI
2020-09845 · 0% AI
2020-101,338 · 0% AI
2020-11288 · 0% AI
2020-1248 · 0% AI
2021-01858 · 0% AI
2021-0225 · 0% AI
2021-0384 · 0% AI
2021-0440 · 0% AI
2021-061 · 0% AI
2021-07481 · 0% AI
2021-08783 · 0% AI
2021-09238 · 0% AI
2021-1012 · 0% AI
2021-1131 · 0% AI
2021-123 · 0% AI
2022-0160 · 0% AI
2022-02242 · 0% AI
2022-03744 · 0% AI
2022-040 · 0% AI
2022-0614 · 0% AI
2022-09133 · 0% AI
2022-1056 · 0% AI
2022-115 · 0% AI
2022-1212 · 0% AI
2023-017 · 0% AI
2023-0242 · 0% AI
2023-032 · 0% AI
2023-0415 · 0% AI
2023-0631 · 0% AI
2023-077 · 0% AI
2023-0927 · 0% AI
2023-107 · 0% AI
2023-1182 · 0% AI
2023-123 · 0% AI
2024-0123 · 0% AI
2024-026 · 0% AI
2024-0415 · 0% AI
2024-0517 · 0% AI
2024-0755 · 0% AI
2024-080 · 0% AI
2024-090 · 0% AI
2024-1026 · 0% AI
2024-1114 · 0% AI
2025-050 · 0% AI
2025-080 · 0% AI
2026-0713 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 8,190
effective_loc: 181,984
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok

excluded_import_loc: 6,308
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 4,879.84
measured_loc: 175,676
median_loc_per_hour: 50.28
pr_timed_units: 11
pre_ai_era_burst_loc: 13,849
pre_ai_era_bursts: 4
pre_ai_era_measured_loc: 172,469
work_units: 3,388

Release velocityok

flagged_releases: 0
max_loc_per_day: 69,765.80
releases: 99

Coding styleok1 item

step-by-step narration comment: # First, wire up all resource bundles.

count:assistant_voice: 0
count:emoji_in_code: 1
count:narrated_steps: 1
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 1
files:narrated_steps: 1
files:placeholder: 0
index: 0.05
lines_scanned: 29,819
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.03
per_kloc:narrated_steps: 0.03
per_kloc:placeholder: 0

Code quality

74 adequate

Code quality is adequate: test-to-source ratio 1.12, no CI test run detected; 2% of function code in complex or long functions; 8% duplicated lines. Weakest area: process.

How the score is built

Complexity94
Duplication63
Lint and smells100
Tests and CI70
Documentation100
Type safetynot measured
Review process0

Evidence by analyzer

Complexity (lizard)ok4 items

complex_functions: 3
function_nloc: 11,960
functions: 1,504
long_functions: 1
many_param_functions: 9
mean_ccn: 2.01
p90_ccn: 4
risky_nloc_share: 2.2%

Duplication (jscpd)ok10 items

compared_lines: 18,953
duplicated_lines: 1,460
duplicated_share: 7.7%
files: 369

Lintok

findings: 0
scanned_lines: 29,002
weighted_findings: 0

Tests and CIok3 items

CI config: .github/workflows/Lint.yml .github/workflows/Lint.yml
CI config: .github/workflows/Specs.yml .github/workflows/Specs.yml
CI config: .github/workflows/issue-opened.yml .github/workflows/issue-opened.yml

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: yes
check:test_ratio: yes
check:tests_cochange: yes
ci_files: 3
cochange_commits: 102
cochange_share: 30.4%
source_lines: 29,819
test_lines: 33,453
test_ratio: 1.12

Documentationok4 items

README.md README.md
LICENSE LICENSE
CONTRIBUTING.md CONTRIBUTING.md
CHANGELOG.md CHANGELOG.md

check:changelog: yes
check:contributing: yes
check:license: yes
check:readme: yes
readme_lines: 67

Type safetyskipped

Security

52 weak

Security posture is weak: 15 known vulnerabilities in 4 dependencies; 3 high-severity SAST findings; 10 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets65
Static analysis (SAST)91
Vulnerable dependencies69
CI workflows12
Security posture0
OpenSSF Scorecard19

Evidence by analyzer

OpenSSF Scorecardok12 items

aggregate: 2
check:Binary-Artifacts: no
check:Branch-Protection: yes
check:CII-Best-Practices: no
check:Code-Review: no
check:Dangerous-Workflow: yes
check:Fuzzing: no
check:License: yes
check:Maintained: no
check:Pinned-Dependencies: no
check:SAST: no
check:Security-Policy: no
check:Token-Permissions: no

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 2
secrets_nonprod: 11

Static analysis (opengrep)ok

findings: 14
findings_high: 3
findings_low: 0
findings_medium: 11
parse_errors: 1
scanned_lines: 29,002
weighted_findings: 8.15

Dependencies (osv-scanner)ok

penalty: 22
vulnerabilities: 15
vulnerable_packages: 4
vulns_critical: 0
vulns_high: 2
vulns_low: 2
vulns_medium: 11
vulns_unknown: 0

CI workflows (zizmor)ok

findings: 15
findings_high: 10
findings_low: 1
findings_medium: 4
penalty: 128.20
workflows: 3

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: no
signed_commit_share: 4.5%
unpinned_manifests: 0

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

15 high26 medium16 low

Severity	Rule	Location	Message	Tool
high	`zizmor/unpinned-uses`	.github/workflows/Lint.yml:20	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/Lint.yml:23	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/Lint.yml:27	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/Lint.yml:43	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/Specs.yml:27	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/Specs.yml:30	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/Specs.yml:58	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/Specs.yml:78	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/Specs.yml:88	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/issue-opened.yml:12	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`osv/GHSA-8474-xrp6-wh69`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-8474-xrp6-wh69	Dependencies (osv-scanner)
high	`osv/GHSA-h8w8-99g7-qmvj`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-h8w8-99g7-qmvj	Dependencies (osv-scanner)
high	`opengrep/ruby.lang.security.model-attributes-attr-accessible`	lib/cocoapods/resolver/lazy_specification.rb:15	Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters....	Static analysis (opengrep)
high	`opengrep/ruby.lang.security.model-attributes-attr-accessible`	lib/cocoapods/resolver/lazy_specification.rb:5	Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters....	Static analysis (opengrep)
high	`opengrep/ruby.lang.security.bad-deserialization-yaml`	lib/cocoapods/sources_manager.rb:87	Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be...	Static analysis (opengrep)
medium	`zizmor/artipacked`	.github/workflows/Lint.yml:19	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/Lint.yml:4	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/Specs.yml:26	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/Specs.yml:4	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`osv/GHSA-2j26-frm8-cmj9`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-2j26-frm8-cmj9	Dependencies (osv-scanner)
medium	`osv/GHSA-3jfp-46x4-xgfj`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-3jfp-46x4-xgfj	Dependencies (osv-scanner)
medium	`osv/GHSA-89vf-4333-qx8v`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-89vf-4333-qx8v	Dependencies (osv-scanner)
medium	`osv/GHSA-8gmh-2hhj-2hv9`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-8gmh-2hhj-2hv9	Dependencies (osv-scanner)
medium	`osv/GHSA-9crm-g4mf-wc5j`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-9crm-g4mf-wc5j	Dependencies (osv-scanner)
medium	`osv/GHSA-9f42-57jx-vpp3`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-9f42-57jx-vpp3	Dependencies (osv-scanner)
medium	`osv/GHSA-cg4j-q9v8-6v38`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-cg4j-q9v8-6v38	Dependencies (osv-scanner)
medium	`osv/GHSA-j82w-28jv-3pmj`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-j82w-28jv-3pmj	Dependencies (osv-scanner)
medium	`osv/GHSA-pxcc-8665-phx8`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-pxcc-8665-phx8	Dependencies (osv-scanner)
medium	`osv/GHSA-qq38-m9mg-xjj5`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-qq38-m9mg-xjj5	Dependencies (osv-scanner)
medium	`osv/GHSA-wv3x-4vxv-whpp`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-wv3x-4vxv-whpp	Dependencies (osv-scanner)
medium	`opengrep/ruby.lang.security.dangerous-subshell`	bin/sandbox-pod:126	Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	Static analysis (opengrep)
medium	`opengrep/ruby.rails.security.audit.xss.manual-template-creation`	bin/sandbox-pod:158	Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead,...	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.dangerous-exec`	lib/cocoapods/config.rb:332	Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	lib/cocoapods/downloader/request.rb:67	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	lib/cocoapods/installer/analyzer/pod_variant_set.rb:28	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	lib/cocoapods/installer/project_cache/target_cache_key.rb:133	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	lib/cocoapods/installer/project_cache/target_cache_key.rb:136	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	lib/cocoapods/installer/project_cache/target_cache_key.rb:139	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	lib/cocoapods/installer/project_cache/target_cache_key.rb:183	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	lib/cocoapods/installer/target_uuid_generator.rb:21	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
medium	`opengrep/ruby.lang.security.weak-hashes-md5`	lib/cocoapods/installer/target_uuid_generator.rb:23	Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead....	Static analysis (opengrep)
low	`zizmor/adhoc-packages`	.github/workflows/Specs.yml:71	ad-hoc installation of packages [confidence high]	CI workflows (zizmor)
low	`gitleaks/generic-api-key`	.travis.yml:29	Possible generic-api-key secret in history (commit a4898472e3); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`osv/GHSA-539f-xcgw-2gjg`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-539f-xcgw-2gjg	Dependencies (osv-scanner)
low	`osv/GHSA-6wx8-w4f5-wwcr`	Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-6wx8-w4f5-wwcr	Dependencies (osv-scanner)
low	`gitleaks/generic-api-key`	examples/AFNetworking Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:2	Possible generic-api-key secret in history (commit 24315ed71a); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/Alamofire Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:2	Possible generic-api-key secret in history (commit 24315ed71a); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/AppCenter Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:2	Possible generic-api-key secret in history (commit 4df00cba6f); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/GeneralExample/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:2	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/HeaderMappingsDir Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:2	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/RKTwitter/Podfile.lock:51	Possible generic-api-key secret in history (commit 8a61d2db02); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/Resource Bundle Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:2	Possible generic-api-key secret in history (commit 24315ed71a); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/TestInclusions/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:2	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/Vendored Framework Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:2	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/watchOS Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:2	Possible generic-api-key secret in the current tree (test/docs/example file)	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	examples/watchOS Example/watchOSsample.xcworkspace/xcshareddata/watchOSsample.xcscmblueprint:2	Possible generic-api-key secret in history (commit 17609a1925); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	lib/cocoapods/command/push.rb:66	Possible generic-api-key secret in history (commit d87aa83526); removed from the current tree but still retrievable	Secrets (gitleaks)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	0
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	15
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	15
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	14
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	13

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`b80e113e28a7`	`prov-5+qual-2+sec-2`	0%	74	52

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/CocoaPods/CocoaPods/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/CocoaPods/CocoaPods/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/CocoaPods/CocoaPods/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/CocoaPods/CocoaPods/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/CocoaPods/CocoaPods/security.svg)](https://repotrust.synapticcyber.com/r/github.com/CocoaPods/CocoaPods/)

Full text report

Repository: https://github.com/CocoaPods/CocoaPods
Commit: b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2
Generated: 2026-11-14T15:18:05+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	65%	100%
Code quality	74	adequate	90%	100%
Security	52	weak	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
Stylometry index: 0.05 per 1,000 lines (narrated steps 1, placeholders 0, assistant phrasing 0, emoji 1). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2023-09	27	0%
2023-10	7	0%
2023-11	82	0%
2023-12	3	0%
2024-01	23	0%
2024-02	6	0%
2024-04	15	0%
2024-05	17	0%
2024-07	55	0%
2024-10	26	0%
2024-11	14	0%
2026-07	13	0%

Evidence

step-by-step narration comment: # First, wire up all resource bundles. (lib/cocoapod)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 1.12, no CI test run detected; 2% of function code in complex or long functions; 8% duplicated lines. Weakest area: process.

Area	Score
Complexity (lizard)	94
Duplication	63
Code smells (Opengrep)	100
Tests and CI	70
Documentation	100
Type safety	n/a
Process (Scorecard review/maintenance)	0

Functions: 1,504; mean complexity 2.0, 90th percentile 4; 3 complex and 1 long functions
Duplicated lines: 7.7% of 18,953 compared
Tests: 33,453 test lines for 29,819 source lines (ratio 1.12); CI test commands: none detected; 30% of recent source commits also change tests
Docs missing or thin: none

Most complex functions:

Security

Security posture is weak: 15 known vulnerabilities in 4 dependencies; 3 high-severity SAST findings; 10 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	65
Static analysis (Opengrep)	91
Vulnerable dependencies (OSV)	69
CI workflows (zizmor)	12
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	19

Known vulnerabilities: 15 in 4 packages (critical 0, high 2, medium 11, low 2)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
OpenSSF Scorecard aggregate: 2.0/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
high	`opengrep/ruby.lang.security.model-attributes-attr-accessible`: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low]	lib/cocoapods/resolver/lazy_specification.rb:5
high	`opengrep/ruby.lang.security.model-attributes-attr-accessible`: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low]	lib/cocoapods/resolver/lazy_specification.rb:15
high	`opengrep/ruby.lang.security.bad-deserialization-yaml`: Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]	lib/cocoapods/sources_manager.rb:87
high	`osv/GHSA-8474-xrp6-wh69`: [email protected] (RubyGems) is affected by GHSA-8474-xrp6-wh69	Gemfile.lock
high	`osv/GHSA-h8w8-99g7-qmvj`: [email protected] (RubyGems) is affected by GHSA-h8w8-99g7-qmvj	Gemfile.lock
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/Lint.yml:20
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/Lint.yml:23
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/Lint.yml:27
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/Lint.yml:43
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/Specs.yml:27
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/Specs.yml:30
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/Specs.yml:58
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/Specs.yml:78
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/Specs.yml:88
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/issue-opened.yml:12
medium	`opengrep/ruby.lang.security.dangerous-subshell`: Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	bin/sandbox-pod:126
medium	`opengrep/ruby.rails.security.audit.xss.manual-template-creation`: Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'. [confidence low]	bin/sandbox-pod:158
medium	`opengrep/ruby.lang.security.dangerous-exec`: Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence medium]	lib/cocoapods/config.rb:332
medium	`opengrep/ruby.lang.security.weak-hashes-md5`: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]	lib/cocoapods/downloader/request.rb:67
medium	`opengrep/ruby.lang.security.weak-hashes-md5`: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]	lib/cocoapods/installer/analyzer/pod_variant_set.rb:28
medium	`opengrep/ruby.lang.security.weak-hashes-md5`: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]	lib/cocoapods/installer/project_cache/target_cache_key.rb:133
medium	`opengrep/ruby.lang.security.weak-hashes-md5`: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]	lib/cocoapods/installer/project_cache/target_cache_key.rb:136
medium	`opengrep/ruby.lang.security.weak-hashes-md5`: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]	lib/cocoapods/installer/project_cache/target_cache_key.rb:139
medium	`opengrep/ruby.lang.security.weak-hashes-md5`: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]	lib/cocoapods/installer/project_cache/target_cache_key.rb:183
medium	`opengrep/ruby.lang.security.weak-hashes-md5`: Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]	lib/cocoapods/installer/target_uuid_generator.rb:21

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 29,819; test lines: 33,453

Language	Lines
Ruby	54,592
C	3,414
Swift	2,445
Objective-C	2,339
Shell	482