RepoTrust

Leaderboard github.com

DapperLib/Dapper

Dapper - a simple object mapper for .Net

  • View repository ↗
  • C#
  • ★ 18,417
  • commit eb47546a408b
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

possible

Confidence
65%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

70/100

adequate

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

57/100

weak

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

0% possible

Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase.

How the score is built

  • Explicitly attributed share0%
  • Unattributed share in AI-pace bursts0%
  • Estimated AI-generated share0%
  • AI tool configuration files0
  • Work sessions at AI pace0
  • Releases at AI pace0
  • Coding-style index (1.0+ means possible)0.06

Attributed AI tools

ToolCommitsLines addedFirst seenLast seen
Claude Code102026-08-182026-08-18

Lines added per month all AI-attributed share

  1. 2011-0411,129 · 0% AI
  2. 2011-053,574 · 0% AI
  3. 2011-062,438 · 0% AI
  4. 2011-071,402 · 0% AI
  5. 2011-0846 · 0% AI
  6. 2011-091,234 · 0% AI
  7. 2011-10663 · 0% AI
  8. 2011-11171 · 0% AI
  9. 2011-1219 · 0% AI
  10. 2012-01888 · 0% AI
  11. 2012-0285 · 0% AI
  12. 2012-03698 · 0% AI
  13. 2012-04187 · 0% AI
  14. 2012-05109 · 0% AI
  15. 2012-06318 · 0% AI
  16. 2012-0771 · 0% AI
  17. 2012-081,009 · 0% AI
  18. 2012-09198 · 0% AI
  19. 2012-101,500 · 0% AI
  20. 2012-1174 · 0% AI
  21. 2012-1272 · 0% AI
  22. 2013-026 · 0% AI
  23. 2013-0421 · 0% AI
  24. 2013-05736 · 0% AI
  25. 2013-079 · 0% AI
  26. 2013-08230 · 0% AI
  27. 2013-09291 · 0% AI
  28. 2013-1020 · 0% AI
  29. 2013-11115 · 0% AI
  30. 2013-1250 · 0% AI
  31. 2014-0117 · 0% AI
  32. 2014-0221 · 0% AI
  33. 2014-052,529 · 0% AI
  34. 2014-06515 · 0% AI
  35. 2014-071,661 · 0% AI
  36. 2014-082,968 · 0% AI
  37. 2014-091,471 · 0% AI
  38. 2014-10962 · 0% AI
  39. 2014-1163 · 0% AI
  40. 2014-1266 · 0% AI
  41. 2015-017 · 0% AI
  42. 2015-03534 · 0% AI
  43. 2015-04763 · 0% AI
  44. 2015-053,257 · 0% AI
  45. 2015-06356 · 0% AI
  46. 2015-070 · 0% AI
  47. 2015-0810 · 0% AI
  48. 2015-0920 · 0% AI
  49. 2015-10900 · 0% AI
  50. 2015-1110,961 · 0% AI
  51. 2015-12714 · 0% AI
  52. 2016-01375 · 0% AI
  53. 2016-021,259 · 0% AI
  54. 2016-03141 · 0% AI
  55. 2016-041,167 · 0% AI
  56. 2016-05165 · 0% AI
  57. 2016-06282 · 0% AI
  58. 2016-07141 · 0% AI
  59. 2016-080 · 0% AI
  60. 2016-09151 · 0% AI
  61. 2016-108 · 0% AI
  62. 2016-11243 · 0% AI
  63. 2016-1233 · 0% AI
  64. 2017-010 · 0% AI
  65. 2017-0250 · 0% AI
  66. 2017-035,174 · 0% AI
  67. 2017-04104 · 0% AI
  68. 2017-054,142 · 0% AI
  69. 2017-06241 · 0% AI
  70. 2017-083,848 · 0% AI
  71. 2017-0932 · 0% AI
  72. 2017-10128 · 0% AI
  73. 2017-1193 · 0% AI
  74. 2018-02139 · 0% AI
  75. 2018-03208 · 0% AI
  76. 2018-04184 · 0% AI
  77. 2018-052 · 0% AI
  78. 2018-068 · 0% AI
  79. 2018-0765 · 0% AI
  80. 2018-0830 · 0% AI
  81. 2018-09415 · 0% AI
  82. 2018-11114 · 0% AI
  83. 2019-010 · 0% AI
  84. 2019-022 · 0% AI
  85. 2019-03402 · 0% AI
  86. 2019-040 · 0% AI
  87. 2019-054 · 0% AI
  88. 2019-061,133 · 0% AI
  89. 2019-081,239 · 0% AI
  90. 2019-09293 · 0% AI
  91. 2019-1044 · 0% AI
  92. 2019-112 · 0% AI
  93. 2019-1246 · 0% AI
  94. 2020-0165 · 0% AI
  95. 2020-030 · 0% AI
  96. 2020-043 · 0% AI
  97. 2020-05478 · 0% AI
  98. 2020-060 · 0% AI
  99. 2020-071 · 0% AI
  100. 2020-0813 · 0% AI
  101. 2020-101 · 0% AI
  102. 2020-11397 · 0% AI
  103. 2020-1242 · 0% AI
  104. 2021-0121 · 0% AI
  105. 2021-0231 · 0% AI
  106. 2021-0449 · 0% AI
  107. 2021-0578 · 0% AI
  108. 2021-07112 · 0% AI
  109. 2021-1032 · 0% AI
  110. 2021-1175 · 0% AI
  111. 2022-011 · 0% AI
  112. 2022-030 · 0% AI
  113. 2022-086 · 0% AI
  114. 2023-061,085 · 0% AI
  115. 2023-070 · 0% AI
  116. 2023-08788 · 0% AI
  117. 2023-091,487 · 0% AI
  118. 2023-10366 · 0% AI
  119. 2023-11146 · 0% AI
  120. 2023-1237 · 0% AI
  121. 2024-0164 · 0% AI
  122. 2024-0224 · 0% AI
  123. 2024-03119 · 0% AI
  124. 2024-0480 · 0% AI
  125. 2024-07158 · 0% AI
  126. 2024-10289 · 0% AI
  127. 2024-110 · 0% AI
  128. 2025-010 · 0% AI
  129. 2025-0254 · 0% AI
  130. 2025-0431 · 0% AI
  131. 2025-060 · 0% AI
  132. 2026-030 · 0% AI
  133. 2026-0471 · 0% AI
  134. 2026-05165 · 0% AI
  135. 2026-08218 · 0% AI
  136. 2026-0921 · 0% AI

Findings in AI-attributed lines vs the rest

From git blame: 0 lines trace to AI-attributed commits, 15,808 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 linesAI-attributedOtherRatio
Code quality—0.00—
Security—0.70—

Evidence by analyzer

Explicit AI attributionok2 items
attributed_commit_share
0.1%
attributed_commits
1
attributed_loc
0
attributed_loc_share
0.0%
commits
1,315
effective_loc
83,873
tools_detected
1
AI tool configurationok
artifacts
0
tools_configured
0
workflow_agents
0
Commit velocityok
excluded_import_loc
5,172
flagged_loc
0
flagged_loc_share
0.0%
flagged_units
0
max_loc_per_hour
2,038.10
measured_loc
78,701
median_loc_per_hour
50.12
pr_timed_units
133
pre_ai_era_burst_loc
16,571
pre_ai_era_bursts
6
pre_ai_era_measured_loc
73,272
work_units
659
Release velocityok
flagged_releases
0
max_loc_per_day
2,606.60
releases
82
Coding styleok1 item
count:assistant_voice
0
count:emoji_in_code
0
count:narrated_steps
1
count:placeholder
0
files:assistant_voice
0
files:emoji_in_code
0
files:narrated_steps
1
files:placeholder
0
index
0.06
lines_scanned
15,808
per_kloc:assistant_voice
0
per_kloc:emoji_in_code
0
per_kloc:narrated_steps
0.06
per_kloc:placeholder
0
Findings in AI-written linesok
ai_lines
0
blame_failures
0
files_blamed
103
other_lines
15,808
quality:ai_findings
0
quality:other_findings
0
quality:other_per_kloc
0
security:ai_findings
0
security:other_findings
11
security:other_per_kloc
0.70

Code quality

70 adequate

Code quality is adequate: test-to-source ratio 0.70, CI runs tests; 23% of function code in complex or long functions; 17% duplicated lines. Weakest area: duplication.

How the score is built

  • Complexity51
  • Duplication37
  • Lint and smells100
  • Tests and CI90
  • Documentation65
  • Type safetynot measured
  • Review processnot measured

Evidence by analyzer

Complexity (lizard)ok10 items
complex_functions
21
function_nloc
8,873
functions
973
long_functions
7
many_param_functions
18
mean_ccn
2.62
p90_ccn
5
risky_nloc_share
22.6%
Duplication (jscpd)ok10 items
compared_lines
10,231
duplicated_lines
1,715
duplicated_share
16.8%
files
103
Lintok
findings
0
scanned_lines
15,765
weighted_findings
0
Tests and CIok4 items
  • CI config: .github/workflows/cla.yml .github/workflows/cla.yml
  • CI config: .github/workflows/main.yml .github/workflows/main.yml
  • CI config: .github/workflows/release.yml .github/workflows/release.yml
  • CI runs tests (dotnet test)
check:ci_present
yes
check:ci_runs_lint
no
check:ci_runs_tests
yes
check:has_tests
yes
check:test_ratio
yes
check:tests_cochange
yes
ci_files
3
cochange_commits
153
cochange_share
43.8%
source_lines
15,808
test_lines
11,025
test_ratio
0.70
Documentationok2 items
  • Readme.md Readme.md
  • License.txt License.txt
check:changelog
no
check:contributing
no
check:license
yes
check:readme
yes
readme_lines
373
Type safetyskipped

Security

57 weak

Security posture is weak: 11 high-severity SAST findings; 19 high-severity workflow issues. Weakest area: ci actions.

How the score is built

  • Secrets100
  • Static analysis (SAST)64
  • Vulnerable dependenciesnot measured
  • CI workflows2
  • Security posture20
  • OpenSSF Scorecardnot measured

Evidence by analyzer

OpenSSF Scorecardskipped

no published OpenSSF Scorecard result for this repo

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
11
findings_high
11
findings_low
0
findings_medium
0
parse_errors
1
scanned_lines
15,765
weighted_findings
19.80
Dependencies (osv-scanner)skipped
CI workflows (zizmor)ok
findings
27
findings_high
19
findings_low
1
findings_medium
7
penalty
233.20
workflows
3
Security postureok
check:dependency_updates
no
check:lockfiles
yes
check:security_policy
no
check:signed_commits
yes
signed_commit_share
65.0%
unpinned_manifests
0
Release downloadsok
binary_assets
0
signals
0
suspicious
0

Findings

30 high7 medium1 info

SeverityRuleLocationMessageTool
high zizmor/unpinned-uses .github/workflows/cla.yml:21 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/dangerous-triggers .github/workflows/cla.yml:3 use of fundamentally insecure workflow trigger [confidence medium] CI workflows (zizmor)
high zizmor/dangerous-triggers .github/workflows/cla.yml:5 use of fundamentally insecure workflow trigger [confidence medium] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/main.yml:105 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/main.yml:109 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/main.yml:113 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/main.yml:123 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-images .github/workflows/main.yml:21 unpinned image references [confidence high] CI workflows (zizmor)
high zizmor/unpinned-images .github/workflows/main.yml:37 unpinned image references [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/main.yml:45 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/main.yml:49 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/main.yml:57 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/main.yml:61 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/release.yml:100 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/release.yml:46 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/release.yml:51 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/release.yml:57 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/release.yml:62 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/release.yml:93 unpinned action reference [confidence high] CI workflows (zizmor)
high opengrep/csharp.lang.security.sqli.csharp-sqli Dapper/CommandDefinition.cs:128 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli Dapper/SqlMapper.cs:2264 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli Dapper/SqlMapper.cs:2284 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli Dapper/SqlMapper.cs:2357 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli Dapper/SqlMapper.cs:2523 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli benchmarks/Dapper.Tests.Performance/Massive/Massive.cs:189 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli benchmarks/Dapper.Tests.Performance/Massive/Massive.cs:307 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli benchmarks/Dapper.Tests.Performance/Massive/Massive.cs:343 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli benchmarks/Dapper.Tests.Performance/PetaPoco/PetaPoco.cs:333 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli benchmarks/Dapper.Tests.Performance/PetaPoco/PetaPoco.cs:773 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
high opengrep/csharp.lang.security.sqli.csharp-sqli benchmarks/Dapper.Tests.Performance/PetaPoco/PetaPoco.cs:851 Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... Static analysis (opengrep)
medium zizmor/archived-uses .github/workflows/cla.yml:21 action or reusable workflow from archived repository [confidence high] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/main.yml:1 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/main.yml:100 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/artipacked .github/workflows/main.yml:104 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium zizmor/excessive-permissions .github/workflows/main.yml:16 overly broad permissions [confidence medium] CI workflows (zizmor)
medium zizmor/artipacked .github/workflows/main.yml:44 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
medium zizmor/artipacked .github/workflows/release.yml:45 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/release.yml:114 code injection via template expansion [confidence low] CI workflows (zizmor)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceokprov-50
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-50
Findings in AI-written linesAI provenanceokgit-blame0
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b4140
Tests and CICode qualityok—0
Type safetyCode qualityskipped—0
CI workflows (zizmor)Securityokzizmor 1.32.027
Dependencies (osv-scanner)Securityskipped—0
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityskipped—0no registry dependencies declared
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b41411
OpenSSF ScorecardSecurityskipped—0no published OpenSSF Scorecard result for this repo
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-14eb47546a408bprov-5+qual-2+sec-20%7057

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/DapperLib/Dapper/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/DapperLib/Dapper/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/DapperLib/Dapper/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/DapperLib/Dapper/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/DapperLib/Dapper/security.svg)](https://repotrust.synapticcyber.com/r/github.com/DapperLib/Dapper/)
Full text report
  • Repository: https://github.com/DapperLib/Dapper
  • Commit: eb47546a408bbf6c178bda4f04dc205bc51ffbfe
  • Generated: 2026-11-14T15:21:15+00:00
  • Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 possible 65% 100%
Code quality 70 adequate 90% 100%
Security 57 weak 85% 100%

AI provenance

Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase.

  • Explicitly attributed share (lower bound): 0.0%
  • Unattributed share in AI-consistent velocity bursts: 0.0%
  • Estimated AI-generated share: 0.0%
AI tool Attributed commits Lines added
Claude Code 1 0

Current source lines last changed by AI-attributed commits: 0 of 15,808.

Too few lines in one group to compare finding densities.

  • Stylometry index: 0.06 per 1,000 lines (narrated steps 1, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
Month Lines added Attributed to AI
2024-01 64 0%
2024-02 24 0%
2024-03 119 0%
2024-04 80 0%
2024-07 158 0%
2024-10 289 0%
2025-02 54 0%
2025-04 31 0%
2026-04 71 0%
2026-05 165 0%
2026-08 218 0%
2026-09 21 0%

Evidence

  • Claude Code: message 'claude.ai/code' (c0b2097129a2)
  • step-by-step narration comment: // Finally, prep the parameter and attach the callback to it (Dapper/Dynam)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.70, CI runs tests; 23% of function code in complex or long functions; 17% duplicated lines. Weakest area: duplication.

Area Score
Complexity (lizard) 51
Duplication 37
Code smells (Opengrep) 100
Tests and CI 90
Documentation 65
Type safety n/a
Process (Scorecard review/maintenance) n/a
  • Functions: 973; mean complexity 2.6, 90th percentile 5; 21 complex and 7 long functions
  • Duplicated lines: 16.8% of 10,231 compared
  • Tests: 11,025 test lines for 15,808 source lines (ratio 0.70); CI test commands: dotnet test; 44% of recent source commits also change tests
  • Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is weak: 11 high-severity SAST findings; 19 high-severity workflow issues. Weakest area: ci actions.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 64
Vulnerable dependencies (OSV) n/a
CI workflows (zizmor) 2
Posture (policy, updates, signing, lockfiles) 20
OpenSSF Scorecard n/a
  • Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates

Top findings

Severity Finding Location
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] Dapper/CommandDefinition.cs:128
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] Dapper/SqlMapper.cs:2264
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] Dapper/SqlMapper.cs:2284
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] Dapper/SqlMapper.cs:2357
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] Dapper/SqlMapper.cs:2523
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] benchmarks/Dapper.Tests.Performance/Massive/Massive.cs:189
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] benchmarks/Dapper.Tests.Performance/Massive/Massive.cs:307
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] benchmarks/Dapper.Tests.Performance/Massive/Massive.cs:343
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] benchmarks/Dapper.Tests.Performance/PetaPoco/PetaPoco.cs:333
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] benchmarks/Dapper.Tests.Performance/PetaPoco/PetaPoco.cs:773
high opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] benchmarks/Dapper.Tests.Performance/PetaPoco/PetaPoco.cs:851
high zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] .github/workflows/cla.yml:5
high zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] .github/workflows/cla.yml:3
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/cla.yml:21
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/main.yml:45
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/main.yml:49
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/main.yml:57
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/main.yml:61
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/main.yml:105
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/main.yml:109
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/main.yml:113
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/main.yml:123
high zizmor/unpinned-images: unpinned image references [confidence high] .github/workflows/main.yml:21
high zizmor/unpinned-images: unpinned image references [confidence high] .github/workflows/main.yml:37
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:46

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

  • Source lines: 15,808; test lines: 11,025
Language Lines
C# 26,790
PowerShell 43