Leaderboard github.com

CodeEditApp/CodeEdit

📝 CodeEdit App for macOS – Elevate your code editing experience. Open source, free forever.

View repository ↗
Swift
★ 23,119
commit fa2aebd86373
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

possible

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

64/100

weak

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

56/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% possible

Weak signals consistent with AI-assisted development.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts1%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace1
Releases at AI pace0
Coding-style index (1.0+ means possible)0.15

Lines added per month all AI-attributed share

2022-0323,387 · 0% AI
2022-0417,196 · 0% AI
2022-053,295 · 0% AI
2022-062,614 · 0% AI
2022-07647 · 0% AI
2022-081,229 · 0% AI
2022-091,012 · 0% AI
2022-10163 · 0% AI
2022-11309 · 0% AI
2022-123,501 · 0% AI
2023-014,343 · 0% AI
2023-02610 · 0% AI
2023-033,646 · 0% AI
2023-043,443 · 0% AI
2023-054,287 · 0% AI
2023-063,174 · 0% AI
2023-07620 · 0% AI
2023-08463 · 0% AI
2023-092,029 · 0% AI
2023-102,681 · 0% AI
2023-1182 · 0% AI
2023-125,404 · 0% AI
2024-012,571 · 0% AI
2024-02761 · 0% AI
2024-03937 · 0% AI
2024-041,261 · 0% AI
2024-051,304 · 0% AI
2024-064,344 · 0% AI
2024-073,811 · 0% AI
2024-083,334 · 0% AI
2024-092,173 · 0% AI
2024-101,050 · 0% AI
2024-11547 · 0% AI
2024-121,544 · 0% AI
2025-011,451 · 0% AI
2025-0293 · 0% AI
2025-031,977 · 0% AI
2025-04337 · 0% AI
2025-051,860 · 0% AI
2025-06974 · 0% AI
2025-076,122 · 0% AI
2025-08386 · 0% AI
2025-092,965 · 0% AI
2025-1290 · 0% AI
2026-08929 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 1,759
effective_loc: 124,956
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok1 item

1,312 lines of first-party code in ~1.4h (906 lines/hour, PR #436)

excluded_import_loc: 4,897
flagged_loc: 1,312
flagged_loc_share: 1.1%
flagged_units: 1
max_loc_per_hour: 905.52
measured_loc: 120,059
median_loc_per_hour: 13.43
pr_timed_units: 480
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 0
work_units: 847

Release velocityok

flagged_releases: 0
max_loc_per_day: 4,164.80
releases: 37

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 18
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 7
files:narrated_steps: 0
files:placeholder: 0
index: 0.15
lines_scanned: 61,130
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0.29
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

64 weak

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 7% of function code in complex or long functions; 8% duplicated lines. Weakest area: testing.

How the score is built

Complexity81
Duplication62
Lint and smells100
Tests and CI25
Documentation80
Type safetynot measured
Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items

complex_functions: 19
function_nloc: 36,303
functions: 2,874
long_functions: 12
many_param_functions: 25
mean_ccn: 2.49
p90_ccn: 5
risky_nloc_share: 6.9%

Duplication (jscpd)ok10 items

compared_lines: 40,642
duplicated_lines: 3,201
duplicated_share: 7.9%
files: 686

Lintok

category:correctness: 1
findings: 1
scanned_lines: 61,130
weighted_findings: 0.25

Tests and CIok11 items

CI config: .github/workflows/CI-bump-build-number.yml .github/workflows/CI-bump-build-number.yml
CI config: .github/workflows/CI-pre-release.yml .github/workflows/CI-pre-release.yml
CI config: .github/workflows/CI-pull-request.yml .github/workflows/CI-pull-request.yml
CI config: .github/workflows/CI-release-notes.yml .github/workflows/CI-release-notes.yml
CI config: .github/workflows/add-to-project.yml .github/workflows/add-to-project.yml
CI config: .github/workflows/appcast.yml .github/workflows/appcast.yml
CI config: .github/workflows/issue.yml .github/workflows/issue.yml
CI config: .github/workflows/lint.yml .github/workflows/lint.yml
CI config: .github/workflows/pre-release.yml .github/workflows/pre-release.yml
CI config: .github/workflows/release-drafter.yml .github/workflows/release-drafter.yml
CI runs linters (swiftlint)

check:ci_present: yes
check:ci_runs_lint: yes
check:ci_runs_tests: no
check:has_tests: no
check:test_ratio: no
check:tests_cochange: no
ci_files: 11
cochange_commits: 211
cochange_share: 0.0%
source_lines: 61,130
test_lines: 0
test_ratio: 0

Documentationok3 items

README.md README.md
LICENSE.md LICENSE.md
CONTRIBUTING.md CONTRIBUTING.md

check:changelog: no
check:contributing: yes
check:license: yes
check:readme: yes
readme_lines: 249

Type safetyskipped

Security

56 weak

Security posture is weak: 1 possible secret(s) in the tree, 0 only in history; 18 known vulnerabilities in 4 dependencies; 15 high-severity workflow issues. Weakest area: ci actions.

How the score is built

Secrets66
Static analysis (SAST)99
Vulnerable dependencies59
CI workflows1
Security posture20
OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 1
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 6
findings_high: 0
findings_low: 0
findings_medium: 6
parse_errors: 4
scanned_lines: 61,130
weighted_findings: 1.50

Dependencies (osv-scanner)ok

penalty: 32
vulnerabilities: 18
vulnerable_packages: 4
vulns_critical: 0
vulns_high: 7
vulns_low: 2
vulns_medium: 9
vulns_unknown: 0

CI workflows (zizmor)ok

findings: 52
findings_high: 15
findings_low: 9
findings_medium: 28
penalty: 262.60
workflows: 11

Security postureok

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: no
check:signed_commits: yes
signed_commit_share: 100.0%
unpinned_manifests: 0

Release downloadsok5 items

binary_assets: 10
signals: 1
suspicious: 0

Findings

23 high43 medium12 low

Severity	Rule	Location	Message	Tool
high	`zizmor/unpinned-uses`	.github/workflows/CI-bump-build-number.yml:10	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/CI-bump-build-number.yml:27	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/CI-bump-build-number.yml:33	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/add-to-project.yml:13	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/appcast.yml:11	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/appcast.yml:17	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/appcast.yml:25	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/appcast.yml:45	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/issue.yml:9	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/lint.yml:11	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/pre-release.yml:116	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/pre-release.yml:13	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/pre-release.yml:161	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release-drafter.yml:13	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/tests.yml:11	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`osv/GHSA-2rxp-v6pw-ch6m`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-2rxp-v6pw-ch6m	Dependencies (osv-scanner)
high	`osv/GHSA-5866-49gr-22v4`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-5866-49gr-22v4	Dependencies (osv-scanner)
high	`osv/GHSA-98m9-hrrm-r99r`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-98m9-hrrm-r99r	Dependencies (osv-scanner)
high	`osv/GHSA-h27x-rffw-24p4`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-h27x-rffw-24p4	Dependencies (osv-scanner)
high	`osv/GHSA-h8w8-99g7-qmvj`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-h8w8-99g7-qmvj	Dependencies (osv-scanner)
high	`osv/GHSA-r55c-59qm-vjw6`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-r55c-59qm-vjw6	Dependencies (osv-scanner)
high	`osv/GHSA-vmwr-mc7x-5vc3`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-vmwr-mc7x-5vc3	Dependencies (osv-scanner)
high	`gitleaks/private-key`	CodeEdit/Features/Settings/Pages/AccountsSettings/AccountsSettingsDetailsView.swift:34	Possible private-key secret in the current tree	Secrets (gitleaks)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-bump-build-number.yml:5	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/CI-bump-build-number.yml:9	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-pre-release.yml:1	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/CI-pre-release.yml:12	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-pre-release.yml:14	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/CI-pre-release.yml:18	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-pre-release.yml:20	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-pre-release.yml:5	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/CI-pre-release.yml:7	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-pre-release.yml:9	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-pull-request.yml:1	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/CI-pull-request.yml:10	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-pull-request.yml:12	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/secrets-inherit`	.github/workflows/CI-pull-request.yml:15	secrets unconditionally inherited by called workflow [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-pull-request.yml:8	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/CI-release-notes.yml:9	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/add-to-project.yml:9	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/archived-uses`	.github/workflows/appcast.yml:25	action or reusable workflow from archived repository [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/appcast.yml:7	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/issue.yml:6	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/lint.yml:11	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/lint.yml:8	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/pre-release.yml:12	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/archived-uses`	.github/workflows/pre-release.yml:161	action or reusable workflow from archived repository [confidence high]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/pre-release.yml:8	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/release-drafter.yml:9	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/tests.yml:10	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/tests.yml:6	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`osv/GHSA-33mh-2634-fwr2`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-33mh-2634-fwr2	Dependencies (osv-scanner)
medium	`osv/GHSA-4xqq-m2hx-25v8`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-4xqq-m2hx-25v8	Dependencies (osv-scanner)
medium	`osv/GHSA-8gmh-2hhj-2hv9`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-8gmh-2hhj-2hv9	Dependencies (osv-scanner)
medium	`osv/GHSA-9crm-g4mf-wc5j`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-9crm-g4mf-wc5j	Dependencies (osv-scanner)
medium	`osv/GHSA-9f42-57jx-vpp3`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-9f42-57jx-vpp3	Dependencies (osv-scanner)
medium	`osv/GHSA-j82w-28jv-3pmj`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-j82w-28jv-3pmj	Dependencies (osv-scanner)
medium	`osv/GHSA-qq38-m9mg-xjj5`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-qq38-m9mg-xjj5	Dependencies (osv-scanner)
medium	`osv/GHSA-vg3r-rm7w-2xgh`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-vg3r-rm7w-2xgh	Dependencies (osv-scanner)
medium	`osv/GHSA-wv3x-4vxv-whpp`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-wv3x-4vxv-whpp	Dependencies (osv-scanner)
medium	`opengrep/swift.lang.crypto.insecure-random`	CodeEdit/Features/InspectorArea/InternalDevelopmentInspector/InternalDevelopmentOutputView.swift:48	A random number generator was detected which is not guaranteed to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the...	Static analysis (opengrep)
medium	`opengrep/bash.lang.security.ifs-tampering`	CodeEdit/ShellIntegration/codeedit_shell_integration.bash:243	The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS...	Static analysis (opengrep)
medium	`opengrep/swift.lang.crypto.insecure-random`	CodeEditTests/Features/Welcome/RecentProjectsTests.swift:188	A random number generator was detected which is not guaranteed to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the...	Static analysis (opengrep)
medium	`opengrep/swift.lang.crypto.insecure-random`	CodeEditTests/Utils/CEWorkspaceFileManager/CEWorkspaceFileManagerTests.swift:101	A random number generator was detected which is not guaranteed to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the...	Static analysis (opengrep)
medium	`opengrep/swift.lang.crypto.insecure-random`	CodeEditTests/Utils/CEWorkspaceFileManager/CEWorkspaceFileManagerTests.swift:102	A random number generator was detected which is not guaranteed to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the...	Static analysis (opengrep)
medium	`opengrep/swift.lang.crypto.insecure-random`	CodeEditTests/Utils/CEWorkspaceFileManager/CEWorkspaceFileManagerTests.swift:46	A random number generator was detected which is not guaranteed to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the...	Static analysis (opengrep)
low	`opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command`	CodeEdit/ShellIntegration/codeedit_shell_integration.bash:238	Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may...	Lint
low	`zizmor/self-repository`	.github/workflows/CI-pre-release.yml:12	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/CI-pre-release.yml:18	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/CI-pre-release.yml:23	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/CI-pre-release.yml:7	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/CI-pull-request.yml:10	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/self-repository`	.github/workflows/CI-pull-request.yml:15	use GitHub's dedicated self-repository syntax [confidence high]	CI workflows (zizmor)
low	`zizmor/adhoc-packages`	.github/workflows/appcast.yml:34	ad-hoc installation of packages [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/pre-release.yml:155	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`zizmor/template-injection`	.github/workflows/pre-release.yml:155	code injection via template expansion [confidence high]	CI workflows (zizmor)
low	`osv/GHSA-539f-xcgw-2gjg`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-539f-xcgw-2gjg	Dependencies (osv-scanner)
low	`osv/GHSA-6wx8-w4f5-wwcr`	AppCast/Gemfile.lock	[email protected] (RubyGems) is affected by GHSA-6wx8-w4f5-wwcr	Dependencies (osv-scanner)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	1
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	52
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	18
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	6
OpenSSF Scorecard	Security	skipped	`—`	0	no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	1

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`fa2aebd86373`	`prov-5+qual-2+sec-2`	0%	64	56

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/CodeEditApp/CodeEdit/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/CodeEditApp/CodeEdit/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/CodeEditApp/CodeEdit/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/CodeEditApp/CodeEdit/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/CodeEditApp/CodeEdit/security.svg)](https://repotrust.synapticcyber.com/r/github.com/CodeEditApp/CodeEdit/)

Full text report

Repository: https://github.com/CodeEditApp/CodeEdit
Commit: fa2aebd86373211c78626074b53ab75010767575
Generated: 2026-11-14T15:18:42+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	65%	100%
Code quality	64	weak	90%	100%
Security	56	weak	85%	100%

AI provenance

Weak signals consistent with AI-assisted development.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 1.1%
Estimated AI-generated share: 0.0%
Stylometry index: 0.15 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 18). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2024-12	1,544	0%
2025-01	1,451	0%
2025-02	93	0%
2025-03	1,977	0%
2025-04	337	0%
2025-05	1,860	0%
2025-06	974	0%
2025-07	6,122	0%
2025-08	386	0%
2025-09	2,965	0%
2025-12	90	0%
2026-08	929	0%

Evidence

1,312 lines of first-party code in ~1.4h (906 lines/hour, PR #436) (55c4a15393a2)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 7% of function code in complex or long functions; 8% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	81
Duplication	62
Code smells (Opengrep)	100
Tests and CI	25
Documentation	80
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 2,874; mean complexity 2.5, 90th percentile 5; 19 complex and 12 long functions
Duplicated lines: 7.9% of 40,642 compared
Tests: 0 test lines for 61,130 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: changelog

Most complex functions:

Security

Security posture is weak: 1 possible secret(s) in the tree, 0 only in history; 18 known vulnerabilities in 4 dependencies; 15 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	66
Static analysis (Opengrep)	99
Vulnerable dependencies (OSV)	59
CI workflows (zizmor)	1
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	n/a

Known vulnerabilities: 18 in 4 packages (critical 0, high 7, medium 9, low 2)
Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates

Top findings

Severity	Finding	Location
high	`gitleaks/private-key`: Possible private-key secret in the current tree	CodeEdit/Features/Settings/Pages/AccountsSettings/AccountsSettingsDetailsView.swift:34
high	`osv/GHSA-h27x-rffw-24p4`: [email protected] (RubyGems) is affected by GHSA-h27x-rffw-24p4	AppCast/Gemfile.lock
high	`osv/GHSA-h8w8-99g7-qmvj`: [email protected] (RubyGems) is affected by GHSA-h8w8-99g7-qmvj	AppCast/Gemfile.lock
high	`osv/GHSA-98m9-hrrm-r99r`: [email protected] (RubyGems) is affected by GHSA-98m9-hrrm-r99r	AppCast/Gemfile.lock
high	`osv/GHSA-2rxp-v6pw-ch6m`: [email protected] (RubyGems) is affected by GHSA-2rxp-v6pw-ch6m	AppCast/Gemfile.lock
high	`osv/GHSA-5866-49gr-22v4`: [email protected] (RubyGems) is affected by GHSA-5866-49gr-22v4	AppCast/Gemfile.lock
high	`osv/GHSA-r55c-59qm-vjw6`: [email protected] (RubyGems) is affected by GHSA-r55c-59qm-vjw6	AppCast/Gemfile.lock
high	`osv/GHSA-vmwr-mc7x-5vc3`: [email protected] (RubyGems) is affected by GHSA-vmwr-mc7x-5vc3	AppCast/Gemfile.lock
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/CI-bump-build-number.yml:10
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/CI-bump-build-number.yml:27
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/CI-bump-build-number.yml:33
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/add-to-project.yml:13
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/appcast.yml:11
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/appcast.yml:17
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/appcast.yml:25
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/appcast.yml:45
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/issue.yml:9
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/lint.yml:11
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pre-release.yml:13
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pre-release.yml:116
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pre-release.yml:161
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release-drafter.yml:13
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/tests.yml:11
medium	`opengrep/swift.lang.crypto.insecure-random`: A random number generator was detected which is not guaranteed to be Cryptographically secure. If the source of entropy is used for security purposes (e.g. with other Cryptographic operations), make sure to use the `SecCopyRandomBytes` API explicitly. [confidence low]	CodeEdit/Features/InspectorArea/InternalDevelopmentInspector/InternalDevelopmentOutputView.swift:48
medium	`opengrep/bash.lang.security.ifs-tampering`: The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS="," read -a my_array'. [confidence low]	CodeEdit/ShellIntegration/codeedit_shell_integration.bash:243

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v0.3.6 ships CodeEdit.dmg (47078 downloads)
binary-release-asset: release v0.3.5 ships CodeEdit.dmg (5659 downloads)
binary-release-asset: release v0.3.4 ships CodeEdit.dmg (10716 downloads)
binary-release-asset: release v0.3.3 ships CodeEdit.dmg (10478 downloads)
binary-release-asset: release v0.3.2 ships CodeEdit.dmg (9100 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 61,130; test lines: 0

Language	Lines
Swift	60,490
Shell	616
Ruby	12
C	12