RepoTrust

Leaderboard github.com

EbookFoundation/free-programming-books

:books: Freely available programming books

  • View repository ↗
  • Python
  • ★ 401,584
  • commit 10e33dd516cc
  • scored 2026-11-14
  • scoring prov-5+qual-2+sec-2

AI provenance

0%

explicit

Confidence
95%
Coverage
100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

53/100

weak

Confidence
90%
Coverage
100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

68/100

weak

Confidence
85%
Coverage
100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON RepoTrust ai badgeRepoTrust quality badgeRepoTrust security badge

AI provenance

0% explicit

Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.

How the score is built

  • Explicitly attributed share0%
  • Unattributed share in AI-pace bursts0%
  • Estimated AI-generated share0%
  • AI tool configuration files0
  • Work sessions at AI pace0
  • Releases at AI pacenot measured
  • Coding-style index (1.0+ means possible)2.00

Attributed AI tools

ToolCommitsLines addedFirst seenLast seen
Claude Code1002026-03-242026-10-02
GitHub Copilot coding agent102026-03-302026-03-30
OpenAI Codex702026-05-052026-10-14

Lines added per month all AI-attributed share

  1. 2013-100 · 0% AI
  2. 2013-110 · 0% AI
  3. 2013-120 · 0% AI
  4. 2014-010 · 0% AI
  5. 2014-020 · 0% AI
  6. 2014-030 · 0% AI
  7. 2014-040 · 0% AI
  8. 2014-050 · 0% AI
  9. 2014-060 · 0% AI
  10. 2014-070 · 0% AI
  11. 2014-080 · 0% AI
  12. 2014-090 · 0% AI
  13. 2014-100 · 0% AI
  14. 2014-110 · 0% AI
  15. 2014-120 · 0% AI
  16. 2015-010 · 0% AI
  17. 2015-020 · 0% AI
  18. 2015-030 · 0% AI
  19. 2015-040 · 0% AI
  20. 2015-050 · 0% AI
  21. 2015-060 · 0% AI
  22. 2015-070 · 0% AI
  23. 2015-080 · 0% AI
  24. 2015-090 · 0% AI
  25. 2015-100 · 0% AI
  26. 2015-110 · 0% AI
  27. 2015-120 · 0% AI
  28. 2016-010 · 0% AI
  29. 2016-020 · 0% AI
  30. 2016-030 · 0% AI
  31. 2016-040 · 0% AI
  32. 2016-050 · 0% AI
  33. 2016-060 · 0% AI
  34. 2016-070 · 0% AI
  35. 2016-080 · 0% AI
  36. 2016-090 · 0% AI
  37. 2016-100 · 0% AI
  38. 2016-110 · 0% AI
  39. 2016-120 · 0% AI
  40. 2017-010 · 0% AI
  41. 2017-020 · 0% AI
  42. 2017-030 · 0% AI
  43. 2017-040 · 0% AI
  44. 2017-050 · 0% AI
  45. 2017-060 · 0% AI
  46. 2017-070 · 0% AI
  47. 2017-080 · 0% AI
  48. 2017-090 · 0% AI
  49. 2017-100 · 0% AI
  50. 2017-110 · 0% AI
  51. 2017-120 · 0% AI
  52. 2018-010 · 0% AI
  53. 2018-020 · 0% AI
  54. 2018-030 · 0% AI
  55. 2018-040 · 0% AI
  56. 2018-050 · 0% AI
  57. 2018-060 · 0% AI
  58. 2018-070 · 0% AI
  59. 2018-080 · 0% AI
  60. 2018-090 · 0% AI
  61. 2018-100 · 0% AI
  62. 2018-110 · 0% AI
  63. 2018-120 · 0% AI
  64. 2019-010 · 0% AI
  65. 2019-020 · 0% AI
  66. 2019-030 · 0% AI
  67. 2019-040 · 0% AI
  68. 2019-050 · 0% AI
  69. 2019-060 · 0% AI
  70. 2019-070 · 0% AI
  71. 2019-080 · 0% AI
  72. 2019-090 · 0% AI
  73. 2019-100 · 0% AI
  74. 2019-110 · 0% AI
  75. 2019-120 · 0% AI
  76. 2020-010 · 0% AI
  77. 2020-020 · 0% AI
  78. 2020-030 · 0% AI
  79. 2020-040 · 0% AI
  80. 2020-050 · 0% AI
  81. 2020-060 · 0% AI
  82. 2020-070 · 0% AI
  83. 2020-080 · 0% AI
  84. 2020-090 · 0% AI
  85. 2020-100 · 0% AI
  86. 2020-110 · 0% AI
  87. 2020-120 · 0% AI
  88. 2021-010 · 0% AI
  89. 2021-020 · 0% AI
  90. 2021-030 · 0% AI
  91. 2021-040 · 0% AI
  92. 2021-050 · 0% AI
  93. 2021-060 · 0% AI
  94. 2021-070 · 0% AI
  95. 2021-080 · 0% AI
  96. 2021-090 · 0% AI
  97. 2021-100 · 0% AI
  98. 2021-110 · 0% AI
  99. 2021-120 · 0% AI
  100. 2022-010 · 0% AI
  101. 2022-020 · 0% AI
  102. 2022-030 · 0% AI
  103. 2022-040 · 0% AI
  104. 2022-050 · 0% AI
  105. 2022-060 · 0% AI
  106. 2022-070 · 0% AI
  107. 2022-080 · 0% AI
  108. 2022-090 · 0% AI
  109. 2022-100 · 0% AI
  110. 2022-110 · 0% AI
  111. 2022-120 · 0% AI
  112. 2023-010 · 0% AI
  113. 2023-020 · 0% AI
  114. 2023-030 · 0% AI
  115. 2023-040 · 0% AI
  116. 2023-050 · 0% AI
  117. 2023-060 · 0% AI
  118. 2023-070 · 0% AI
  119. 2023-080 · 0% AI
  120. 2023-090 · 0% AI
  121. 2023-100 · 0% AI
  122. 2023-110 · 0% AI
  123. 2023-120 · 0% AI
  124. 2024-010 · 0% AI
  125. 2024-020 · 0% AI
  126. 2024-030 · 0% AI
  127. 2024-040 · 0% AI
  128. 2024-050 · 0% AI
  129. 2024-060 · 0% AI
  130. 2024-070 · 0% AI
  131. 2024-080 · 0% AI
  132. 2024-090 · 0% AI
  133. 2024-100 · 0% AI
  134. 2024-110 · 0% AI
  135. 2024-120 · 0% AI
  136. 2025-010 · 0% AI
  137. 2025-020 · 0% AI
  138. 2025-030 · 0% AI
  139. 2025-040 · 0% AI
  140. 2025-05597 · 0% AI
  141. 2025-060 · 0% AI
  142. 2025-070 · 0% AI
  143. 2025-080 · 0% AI
  144. 2025-090 · 0% AI
  145. 2025-1024 · 0% AI
  146. 2025-110 · 0% AI
  147. 2025-120 · 0% AI
  148. 2026-010 · 0% AI
  149. 2026-020 · 0% AI
  150. 2026-030 · 0% AI
  151. 2026-040 · 0% AI
  152. 2026-050 · 0% AI
  153. 2026-060 · 0% AI
  154. 2026-070 · 0% AI
  155. 2026-080 · 0% AI
  156. 2026-090 · 0% AI
  157. 2026-100 · 0% AI
  158. 2026-110 · 0% AI

Findings in AI-attributed lines vs the rest

From git blame: 0 lines trace to AI-attributed commits, 605 to others. Too few lines in one group for a fair comparison. Reported, not scored.

Findings per 1,000 linesAI-attributedOtherRatio
Code quality—0.00—
Security—0.00—

Evidence by analyzer

Explicit AI attributionok21 items
attributed_commit_share
0.2%
attributed_commits
18
attributed_loc
0
attributed_loc_share
0.0%
commits
8,668
effective_loc
621
tools_detected
3
AI tool configurationok
artifacts
0
tools_configured
0
workflow_agents
0
Commit velocityok
excluded_import_loc
0
flagged_loc
0
flagged_loc_share
0.0%
flagged_units
0
max_loc_per_hour
2.06
measured_loc
621
median_loc_per_hour
2.06
pr_timed_units
2
pre_ai_era_burst_loc
0
pre_ai_era_bursts
0
pre_ai_era_measured_loc
0
work_units
2
Release velocityskipped
Coding styleok1 item
count:assistant_voice
1
count:emoji_in_code
0
count:narrated_steps
0
count:placeholder
0
files:assistant_voice
1
files:emoji_in_code
0
files:narrated_steps
0
files:placeholder
0
index
2
lines_scanned
605
per_kloc:assistant_voice
1
per_kloc:emoji_in_code
0
per_kloc:narrated_steps
0
per_kloc:placeholder
0
Findings in AI-written linesok
ai_lines
0
blame_failures
0
files_blamed
1
other_lines
605
quality:ai_findings
0
quality:other_findings
0
quality:other_per_kloc
0
security:ai_findings
0
security:other_findings
0
security:other_per_kloc
0

Code quality

53 weak

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 72% of function code in complex or long functions; 3% duplicated lines. Weakest area: complexity.

How the score is built

  • Complexity12
  • Duplication83
  • Lint and smells100
  • Tests and CI15
  • Documentation80
  • Type safety40
  • Review process100

Evidence by analyzer

Complexity (lizard)ok2 items
complex_functions
2
function_nloc
230
functions
6
long_functions
0
many_param_functions
0
mean_ccn
17.33
p90_ccn
57
risky_nloc_share
72.2%
Duplication (jscpd)ok1 item
compared_lines
440
duplicated_lines
14
duplicated_share
3.2%
files
1
Lintok
findings
0
scanned_lines
605
weighted_findings
0
Tests and CIok7 items
  • CI config: .github/workflows/check-urls.yml .github/workflows/check-urls.yml
  • CI config: .github/workflows/comment-pr.yml .github/workflows/comment-pr.yml
  • CI config: .github/workflows/detect-conflicting-prs.yml .github/workflows/detect-conflicting-prs.yml
  • CI config: .github/workflows/fpb-lint.yml .github/workflows/fpb-lint.yml
  • CI config: .github/workflows/issues-pinner.yml .github/workflows/issues-pinner.yml
  • CI config: .github/workflows/rtl-ltr-linter.yml .github/workflows/rtl-ltr-linter.yml
  • CI config: .github/workflows/stale.yml .github/workflows/stale.yml
check:ci_present
yes
check:ci_runs_lint
no
check:ci_runs_tests
no
check:has_tests
no
check:test_ratio
no
check:tests_cochange
no
ci_files
7
cochange_commits
0
cochange_share
0.0%
source_lines
605
test_lines
0
test_ratio
0
Documentationok3 items
  • README.md README.md
  • LICENSE LICENSE
  • docs/CONTRIBUTING.md docs/CONTRIBUTING.md
check:changelog
no
check:contributing
yes
check:license
yes
check:readme
yes
readme_lines
186
Type safetyok
check:low_escape_density
yes
check:strict_config
no
escapes
0
escapes_per_kloc
0

Security

68 weak

Security posture is weak: 23 high-severity workflow issues. Weakest area: ci actions.

How the score is built

  • Secrets100
  • Static analysis (SAST)100
  • Vulnerable dependenciesnot measured
  • CI workflows1
  • Security posture60
  • OpenSSF Scorecard29

Evidence by analyzer

OpenSSF Scorecardok12 items
aggregate
4.80
check:Binary-Artifacts
yes
check:Branch-Protection
no
check:CII-Best-Practices
no
check:Code-Review
yes
check:Dangerous-Workflow
yes
check:Fuzzing
no
check:License
yes
check:Maintained
yes
check:Pinned-Dependencies
no
check:SAST
no
check:Security-Policy
no
check:Token-Permissions
no
Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok
secrets_current
0
secrets_history
0
secrets_low_confidence
0
secrets_nonprod
0
Static analysis (opengrep)ok
findings
0
findings_high
0
findings_low
0
findings_medium
0
parse_errors
1
scanned_lines
605
weighted_findings
0
Dependencies (osv-scanner)skipped
CI workflows (zizmor)ok
findings
46
findings_high
23
findings_low
19
findings_medium
4
penalty
283.10
workflows
7
Security postureok1 item
  • Dependency updates: .github/dependabot.yml .github/dependabot.yml
check:dependency_updates
yes
check:lockfiles
yes
check:security_policy
no
check:signed_commits
yes
signed_commit_share
100.0%
unpinned_manifests
0
Release downloadsok1 item
  • links to file hosts or shorteners: t.me/ README.md
binary_assets
0
signals
1
suspicious
0

Findings

23 high4 medium9 low10 info

SeverityRuleLocationMessageTool
high zizmor/unpinned-uses .github/workflows/check-urls.yml:110 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/check-urls.yml:122 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/check-urls.yml:125 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/check-urls.yml:40 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/check-urls.yml:45 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/check-urls.yml:78 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/check-urls.yml:83 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unsound-condition .github/workflows/comment-pr.yml:14 unsound conditional expression [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/comment-pr.yml:18 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/dangerous-triggers .github/workflows/comment-pr.yml:4 use of fundamentally insecure workflow trigger [confidence medium] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/detect-conflicting-prs.yml:32 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/dangerous-triggers .github/workflows/detect-conflicting-prs.yml:8 use of fundamentally insecure workflow trigger [confidence medium] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/fpb-lint.yml:14 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/fpb-lint.yml:16 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/template-injection .github/workflows/fpb-lint.yml:27 code injection via template expansion [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/fpb-lint.yml:31 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/issues-pinner.yml:38 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/issues-pinner.yml:48 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/rtl-ltr-linter.yml:15 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/rtl-ltr-linter.yml:23 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/rtl-ltr-linter.yml:43 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/rtl-ltr-linter.yml:97 unpinned action reference [confidence high] CI workflows (zizmor)
high zizmor/unpinned-uses .github/workflows/stale.yml:22 unpinned action reference [confidence high] CI workflows (zizmor)
medium zizmor/dependabot-cooldown .github/dependabot.yml:8 insufficient cooldown in Dependabot updates [confidence high] CI workflows (zizmor)
medium zizmor/template-injection .github/workflows/check-urls.yml:109 code injection via template expansion [confidence medium] CI workflows (zizmor)
medium zizmor/template-injection .github/workflows/check-urls.yml:96 code injection via template expansion [confidence medium] CI workflows (zizmor)
medium zizmor/template-injection .github/workflows/check-urls.yml:98 code injection via template expansion [confidence medium] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/check-urls.yml:121 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/self-repository .github/workflows/check-urls.yml:127 use GitHub's dedicated self-repository syntax [confidence high] CI workflows (zizmor)
low zizmor/obfuscation .github/workflows/check-urls.yml:132 obfuscated usage of GitHub Actions features [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/check-urls.yml:39 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/check-urls.yml:76 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/adhoc-packages .github/workflows/check-urls.yml:89 ad-hoc installation of packages [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/fpb-lint.yml:14 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
low zizmor/adhoc-packages .github/workflows/fpb-lint.yml:17 ad-hoc installation of packages [confidence high] CI workflows (zizmor)
low zizmor/artipacked .github/workflows/rtl-ltr-linter.yml:14 credential persistence through GitHub Actions artifacts [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/check-urls.yml:51 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/check-urls.yml:55 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/check-urls.yml:61 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/detect-conflicting-prs.yml:47 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/superfluous-actions .github/workflows/issues-pinner.yml:38 action functionality is already included by the runner [confidence high] CI workflows (zizmor)
info zizmor/superfluous-actions .github/workflows/issues-pinner.yml:48 action functionality is already included by the runner [confidence high] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/rtl-ltr-linter.yml:61 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/rtl-ltr-linter.yml:79 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/rtl-ltr-linter.yml:82 code injection via template expansion [confidence low] CI workflows (zizmor)
info zizmor/template-injection .github/workflows/rtl-ltr-linter.yml:84 code injection via template expansion [confidence low] CI workflows (zizmor)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

AnalyzerPillarStatusVersionFindingsNote
AI tool configurationAI provenanceoksignatures-v10
Explicit AI attributionAI provenanceoksignatures-v10
Release velocityAI provenanceskipped—0
Coding styleAI provenanceok—0
Commit velocityAI provenanceokprov-50
Findings in AI-written linesAI provenanceokgit-blame0
Complexity (lizard)Code qualityoklizard 1.25.10
DocumentationCode qualityok—0
Duplication (jscpd)Code qualityokrepotrust-dup-w60
LintCode qualityokopengrep 1.33.1; rules f1d2b562b4140
Tests and CICode qualityok—0
Type safetyCode qualityok—0
CI workflows (zizmor)Securityokzizmor 1.32.046
Dependencies (osv-scanner)Securityskipped—0
Release downloadsSecurityok—0
Security postureSecurityok—0
Package registriesSecurityskipped—0no registry dependencies declared
Static analysis (opengrep)Securityokopengrep 1.33.1; rules f1d2b562b4140
OpenSSF ScorecardSecurityokscorecard v5.6.00
Secrets (gitleaks)Securityokgitleaks 8.30.10

Score history

ScoredCommitScoringAI provenanceQualitySecurity
2026-11-1410e33dd516ccprov-5+qual-2+sec-20%5368

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/EbookFoundation/free-programming-books/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/EbookFoundation/free-programming-books/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/EbookFoundation/free-programming-books/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/EbookFoundation/free-programming-books/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/EbookFoundation/free-programming-books/security.svg)](https://repotrust.synapticcyber.com/r/github.com/EbookFoundation/free-programming-books/)
Full text report

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 0 explicit 95% 100%
Code quality 53 weak 90% 100%
Security 68 weak 85% 100%

AI provenance

Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.

  • Explicitly attributed share (lower bound): 0.0%
  • Unattributed share in AI-consistent velocity bursts: 0.0%
  • Estimated AI-generated share: 0.0%
AI tool Attributed commits Lines added
Claude Code 10 0
OpenAI Codex 7 0
GitHub Copilot coding agent 1 0

Current source lines last changed by AI-attributed commits: 0 of 605.

Too few lines in one group to compare finding densities.

  • Stylometry index: 2.00 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 1, emoji 0). Reported as a signal, not scored.
Month Lines added Attributed to AI
2025-05 597 0%
2025-10 24 0%

Evidence

  • OpenAI Codex: PR branch 'codex/kn-contributing-navigation' (4c301cce10db)
  • Claude Code: trailer 'Co-authored-by: Claude' (4bb5c19488bd)
  • Claude Code: trailer 'Co-authored-by: Claude' (11540c8bf294)
  • Claude Code: trailer 'Co-authored-by: Claude' (9314c0f437ef)
  • OpenAI Codex: PR branch 'codex/add-thequery-books' (b5eb4857d486)
  • OpenAI Codex: PR branch 'codex/issue-13336-remove-dead-armath-link' (ef1ed02b423e)
  • Claude Code: trailer 'Co-Authored-By: Claude' (354379e0d20e)
  • Claude Code: trailer 'Co-authored-by: Claude' (a7a83950327c)
  • Claude Code: trailer 'Co-authored-by: Claude' (30f7d7cf89f3)
  • Claude Code: trailer 'Co-Authored-By: Claude' (f170148aa089)
  • Claude Code: trailer 'Co-Authored-By: Claude' (36abf22fa40d)
  • OpenAI Codex: PR branch 'codex/fix-emmet-pdf-link' (20588ac61a35)
  • OpenAI Codex: PR branch 'codex/update-course-links-https' (810660c14cff)
  • OpenAI Codex: PR branch 'codex/add-korean-linux-command-line' (978e38330144)
  • Claude Code: trailer 'Co-authored-by: Claude' (208e1cad8066)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 72% of function code in complex or long functions; 3% duplicated lines. Weakest area: complexity.

Area Score
Complexity (lizard) 12
Duplication 83
Code smells (Opengrep) 100
Tests and CI 15
Documentation 80
Type safety 40
Process (Scorecard review/maintenance) 100
  • Functions: 6; mean complexity 17.3, 90th percentile 57; 2 complex and 0 long functions
  • Duplicated lines: 3.2% of 440 compared
  • Tests: 0 test lines for 605 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
  • Docs missing or thin: changelog

Most complex functions:

Security

Security posture is weak: 23 high-severity workflow issues. Weakest area: ci actions.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 100
Vulnerable dependencies (OSV) n/a
CI workflows (zizmor) 1
Posture (policy, updates, signing, lockfiles) 60
OpenSSF Scorecard 29
  • Posture checks passed: dependency updates, signed commits, lockfiles; missing: security policy
  • OpenSSF Scorecard aggregate: 4.8/10 (published 2026-11-09)

Top findings

Severity Finding Location
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/check-urls.yml:40
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/check-urls.yml:45
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/check-urls.yml:78
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/check-urls.yml:83
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/check-urls.yml:110
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/check-urls.yml:122
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/check-urls.yml:125
high zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] .github/workflows/comment-pr.yml:4
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/comment-pr.yml:18
high zizmor/unsound-condition: unsound conditional expression [confidence high] .github/workflows/comment-pr.yml:14
high zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] .github/workflows/detect-conflicting-prs.yml:8
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/detect-conflicting-prs.yml:32
high zizmor/template-injection: code injection via template expansion [confidence high] .github/workflows/fpb-lint.yml:27
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/fpb-lint.yml:14
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/fpb-lint.yml:16
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/fpb-lint.yml:31
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/issues-pinner.yml:38
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/issues-pinner.yml:48
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/rtl-ltr-linter.yml:15
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/rtl-ltr-linter.yml:23
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/rtl-ltr-linter.yml:43
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/rtl-ltr-linter.yml:97
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/stale.yml:22
medium zizmor/dependabot-cooldown: insufficient cooldown in Dependabot updates [confidence high] .github/dependabot.yml:8
medium zizmor/template-injection: code injection via template expansion [confidence medium] .github/workflows/check-urls.yml:96

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

  • readme-download-lure: links to file hosts or shorteners: t.me/

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

  • Source lines: 605; test lines: 0
Language Lines
Python 605