Leaderboard github.com

FiloSottile/mkcert

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

View repository ↗
Go
★ 59,855
commit 1c1dc4ed27ed
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

possible

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

50/100

poor

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

49/100

poor

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% possible

Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence).

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files0
Work sessions at AI pace0
Releases at AI pace0
Coding-style index (1.0+ means possible)9.05

Lines added per month all AI-attributed share

2018-06683 · 0% AI
2018-07401 · 0% AI
2018-08244 · 0% AI
2018-10123 · 0% AI
2018-114 · 0% AI
2018-121 · 0% AI
2019-0157 · 0% AI
2019-02215 · 0% AI
2019-030 · 0% AI
2019-0416 · 0% AI
2019-050 · 0% AI
2019-0698 · 0% AI
2019-0719 · 0% AI
2019-0866 · 0% AI
2019-0917 · 0% AI
2019-11115 · 0% AI
2019-120 · 0% AI
2020-0314 · 0% AI
2020-1062 · 0% AI
2020-1123 · 0% AI
2021-020 · 0% AI
2022-0422 · 0% AI
2024-040 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 165
effective_loc: 2,180
tools_detected: 0

AI tool configurationok

artifacts: 0
tools_configured: 0
workflow_agents: 0

Commit velocityok

excluded_import_loc: 0
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 80
measured_loc: 2,180
median_loc_per_hour: 30.75
pr_timed_units: 29
pre_ai_era_burst_loc: 0
pre_ai_era_bursts: 0
pre_ai_era_measured_loc: 2,158
work_units: 68

Release velocityok

flagged_releases: 0
max_loc_per_day: 23
releases: 13

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 25
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 4
files:narrated_steps: 0
files:placeholder: 0
index: 9.05
lines_scanned: 1,381
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 18.10
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

50 poor

Code quality is poor: test-to-source ratio 0.00, CI runs tests; 22% of function code in complex or long functions; 1% duplicated lines. Weakest area: process.

How the score is built

Complexity51
Duplication93
Lint and smells40
Tests and CI36
Documentation65
Type safetynot measured
Review process15

Evidence by analyzer

Complexity (lizard)ok3 items

complex_functions: 3
function_nloc: 905
functions: 51
long_functions: 0
many_param_functions: 0
mean_ccn: 4.80
p90_ccn: 10
risky_nloc_share: 22.2%

Duplication (jscpd)ok1 item

6+ duplicated lines: truststore_java.go:14 and truststore_nss.go:10

compared_lines: 979
duplicated_lines: 12
duplicated_share: 1.2%
files: 7

Lintok

category:correctness: 5
findings: 5
scanned_lines: 1,381
weighted_findings: 5

Tests and CIok3 items

CI config: .github/workflows/release.yml .github/workflows/release.yml
CI config: .github/workflows/test.yml .github/workflows/test.yml
CI runs tests (go test)

check:ci_present: yes
check:ci_runs_lint: no
check:ci_runs_tests: yes
check:has_tests: no
check:test_ratio: no
check:tests_cochange: no
ci_files: 2
cochange_commits: 102
cochange_share: 2.0%
source_lines: 1,381
test_lines: 0
test_ratio: 0

Documentationok2 items

README.md README.md
LICENSE LICENSE

check:changelog: no
check:contributing: no
check:license: yes
check:readme: yes
readme_lines: 133

Type safetyskipped

Security

49 poor

Security posture is poor: 54 known vulnerabilities in 3 dependencies; 9 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: sast.

How the score is built

Secrets97
Static analysis (SAST)9
Vulnerable dependencies60
CI workflows31
Security posture40
OpenSSF Scorecard25

Evidence by analyzer

OpenSSF Scorecardok13 items

aggregate: 3.30
check:Binary-Artifacts: yes
check:Branch-Protection: no
check:CII-Best-Practices: no
check:Code-Review: yes
check:Dangerous-Workflow: yes
check:Fuzzing: no
check:License: yes
check:Maintained: no
check:Pinned-Dependencies: no
check:SAST: no
check:Security-Policy: yes
check:Signed-Releases: no
check:Token-Permissions: no

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 1
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 17
findings_high: 9
findings_low: 0
findings_medium: 8
parse_errors: 0
scanned_lines: 1,381
weighted_findings: 9.45

Dependencies (osv-scanner)ok

penalty: 31
vulnerabilities: 54
vulnerable_packages: 3
vulns_critical: 8
vulns_high: 7
vulns_low: 0
vulns_medium: 14
vulns_unknown: 25

CI workflows (zizmor)ok

findings: 10
findings_high: 6
findings_low: 0
findings_medium: 4
penalty: 70.80
workflows: 2

Security postureok1 item

Security policy: https://github.com/FiloSottile/mkcert/security/policy https://github.com/FiloSottile/mkcert/security/policy

check:dependency_updates: no
check:lockfiles: yes
check:security_policy: yes
check:signed_commits: no
signed_commit_share: 18.8%
unpinned_manifests: 0

Release downloadsok5 items

binary_assets: 11
signals: 1
suspicious: 0

Findings

8 critical22 high56 medium1 low

Severity	Rule	Location	Message	Tool
critical	`osv/GHSA-5cgq-3rg8-m6cv`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv	Dependencies (osv-scanner)
critical	`osv/GHSA-89gr-r52h-f8rx`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx	Dependencies (osv-scanner)
critical	`osv/GHSA-f5wc-c3c7-36mc`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc	Dependencies (osv-scanner)
critical	`osv/GHSA-jppx-rxg9-jmrx`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx	Dependencies (osv-scanner)
critical	`osv/GHSA-rm3j-f69w-wqmq`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq	Dependencies (osv-scanner)
critical	`osv/GHSA-v778-237x-gjrc`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2024-3321, GHSA-v778-237x-gjrc	Dependencies (osv-scanner)
critical	`osv/GHSA-vgwf-h737-ff37`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37	Dependencies (osv-scanner)
critical	`osv/GHSA-x527-x647-q7gg`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg	Dependencies (osv-scanner)
high	`zizmor/cache-poisoning`	.github/workflows/release.yml:11	runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:11	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:15	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/release.yml:26	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:13	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/test.yml:17	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`osv/GHSA-4374-p667-p6c8`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2023-2102, GHSA-4374-p667-p6c8	Dependencies (osv-scanner)
high	`osv/GHSA-69cg-p879-7622`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2022-0969, GHSA-69cg-p879-7622	Dependencies (osv-scanner)
high	`osv/GHSA-69ch-w2m2-3vjp`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2022-1059, GHSA-69ch-w2m2-3vjp	Dependencies (osv-scanner)
high	`osv/GHSA-hcg3-q754-cr77`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2025-3487, GHSA-hcg3-q754-cr77	Dependencies (osv-scanner)
high	`osv/GHSA-q4h4-gmj2-qvw2`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2	Dependencies (osv-scanner)
high	`osv/GHSA-vvpx-j8f3-3w6h`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2023-1571, GHSA-vvpx-j8f3-3w6h	Dependencies (osv-scanner)
high	`osv/GHSA-w879-237q-wc7r`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r	Dependencies (osv-scanner)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	main.go:384	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	main.go:390	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	truststore_java.go:101	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	truststore_java.go:70	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	truststore_java.go:90	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	truststore_nss.go:108	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	truststore_nss.go:112	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	truststore_nss.go:79	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
high	`opengrep/go.lang.security.audit.dangerous-exec-command`	truststore_nss.go:91	Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute...	Static analysis (opengrep)
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	cert.go:119	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	cert.go:128	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	cert.go:271	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	cert.go:360	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`opengrep/go.lang.correctness.permissions.incorrect-default-permission`	main.go:176	Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set...	Lint
medium	`zizmor/artipacked`	.github/workflows/release.yml:14	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/release.yml:6	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`zizmor/artipacked`	.github/workflows/test.yml:16	credential persistence through GitHub Actions artifacts [confidence low]	CI workflows (zizmor)
medium	`zizmor/excessive-permissions`	.github/workflows/test.yml:4	overly broad permissions [confidence medium]	CI workflows (zizmor)
medium	`opengrep/go.lang.security.audit.crypto.use-of-sha1`	cert.go:325	Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`osv/GHSA-2wrh-6pvc-2jm9`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2023-1988, GHSA-2wrh-6pvc-2jm9	Dependencies (osv-scanner)
medium	`osv/GHSA-45gg-vh54-h5m9`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9	Dependencies (osv-scanner)
medium	`osv/GHSA-45x7-px36-x8w8`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2023-2402, GHSA-45x7-px36-x8w8	Dependencies (osv-scanner)
medium	`osv/GHSA-4v7x-pqxf-cx7m`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2024-2687, GHSA-4v7x-pqxf-cx7m	Dependencies (osv-scanner)
medium	`osv/GHSA-5cv4-jp36-h3mw`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5028, GHSA-5cv4-jp36-h3mw	Dependencies (osv-scanner)
medium	`osv/GHSA-78mq-xcr3-xm33`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33	Dependencies (osv-scanner)
medium	`osv/GHSA-9m57-25v3-79x9`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9	Dependencies (osv-scanner)
medium	`osv/GHSA-f6x5-jh6r-wrfv`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2025-4135, GHSA-f6x5-jh6r-wrfv	Dependencies (osv-scanner)
medium	`osv/GHSA-j5w8-q4qc-rx2x`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2025-4134, GHSA-j5w8-q4qc-rx2x	Dependencies (osv-scanner)
medium	`osv/GHSA-qppj-fm5r-hxr3`	go.mod	golang.org/x/[email protected] (Go) is affected by GHSA-qppj-fm5r-hxr3	Dependencies (osv-scanner)
medium	`osv/GHSA-qpw4-5x99-6vjp`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp	Dependencies (osv-scanner)
medium	`osv/GHSA-qxp5-gwg8-xv66`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2025-3503, GHSA-qxp5-gwg8-xv66	Dependencies (osv-scanner)
medium	`osv/GHSA-vvgc-356p-c3xw`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2025-3595, GHSA-vvgc-356p-c3xw	Dependencies (osv-scanner)
medium	`osv/GHSA-xrjj-mj9h-534m`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2022-1144, GHSA-xrjj-mj9h-534m	Dependencies (osv-scanner)
medium	`osv/GO-2024-2961`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2024-2961	Dependencies (osv-scanner)
medium	`osv/GO-2024-3333`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2024-3333	Dependencies (osv-scanner)
medium	`osv/GO-2025-4116`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2025-4116	Dependencies (osv-scanner)
medium	`osv/GO-2026-4440`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-4440	Dependencies (osv-scanner)
medium	`osv/GO-2026-4441`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-4441	Dependencies (osv-scanner)
medium	`osv/GO-2026-4918`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-4918	Dependencies (osv-scanner)
medium	`osv/GO-2026-5025`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5025	Dependencies (osv-scanner)
medium	`osv/GO-2026-5026`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5026	Dependencies (osv-scanner)
medium	`osv/GO-2026-5027`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5027	Dependencies (osv-scanner)
medium	`osv/GO-2026-5029`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5029	Dependencies (osv-scanner)
medium	`osv/GO-2026-5030`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5030	Dependencies (osv-scanner)
medium	`osv/GO-2026-5932`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5932	Dependencies (osv-scanner)
medium	`osv/GO-2026-5942`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5942	Dependencies (osv-scanner)
medium	`osv/GO-2026-5970`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-5970	Dependencies (osv-scanner)
medium	`osv/GO-2026-6303`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6303	Dependencies (osv-scanner)
medium	`osv/GO-2026-6354`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6354	Dependencies (osv-scanner)
medium	`osv/GO-2026-6355`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6355	Dependencies (osv-scanner)
medium	`osv/GO-2026-6603`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6603	Dependencies (osv-scanner)
medium	`osv/GO-2026-6610`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6610	Dependencies (osv-scanner)
medium	`osv/GO-2026-6611`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6611	Dependencies (osv-scanner)
medium	`osv/GO-2026-6612`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6612	Dependencies (osv-scanner)
medium	`osv/GO-2026-6617`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6617	Dependencies (osv-scanner)
medium	`osv/GO-2026-6629`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6629	Dependencies (osv-scanner)
medium	`osv/GO-2026-6860`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6860	Dependencies (osv-scanner)
medium	`osv/GO-2026-6866`	go.mod	golang.org/x/[email protected] (Go) is affected by GO-2026-6866	Dependencies (osv-scanner)
medium	`opengrep/go.lang.security.audit.crypto.use-of-sha1`	truststore_java.go:77	Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	truststore_windows.go:113	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	truststore_windows.go:114	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	truststore_windows.go:121	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	truststore_windows.go:126	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	truststore_windows.go:76	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
medium	`opengrep/go.lang.security.audit.use-of-unsafe-block`	truststore_windows.go:96	Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an...	Static analysis (opengrep)
low	`gitleaks/generic-api-key`	vendor/software.sslmate.com/src/go-pkcs12/pkcs12.go:395	Possible generic-api-key secret in history (commit 060fcce2db); removed from the current tree but still retrievable	Secrets (gitleaks)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	5
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	10
Dependencies (osv-scanner)	Security	ok	`osv-scanner version: 2.7.1`	54
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	17
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	1

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`1c1dc4ed27ed`	`prov-5+qual-2+sec-2`	0%	50	49

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/FiloSottile/mkcert/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/FiloSottile/mkcert/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/FiloSottile/mkcert/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/FiloSottile/mkcert/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/FiloSottile/mkcert/security.svg)](https://repotrust.synapticcyber.com/r/github.com/FiloSottile/mkcert/)

Full text report

Repository: https://github.com/FiloSottile/mkcert
Commit: 1c1dc4ed27ed5936046b6398d39cab4d657a2d8e
Generated: 2026-11-14T15:33:07+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	65%	100%
Code quality	50	poor	90%	100%
Security	49	poor	85%	100%

AI provenance

Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence).

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
Stylometry index: 9.05 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 25). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2019-01	57	0%
2019-02	215	0%
2019-04	16	0%
2019-06	98	0%
2019-07	19	0%
2019-08	66	0%
2019-09	17	0%
2019-11	115	0%
2020-03	14	0%
2020-10	62	0%
2020-11	23	0%
2022-04	22	0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, CI runs tests; 22% of function code in complex or long functions; 1% duplicated lines. Weakest area: process.

Area	Score
Complexity (lizard)	51
Duplication	93
Code smells (Opengrep)	40
Tests and CI	36
Documentation	65
Type safety	n/a
Process (Scorecard review/maintenance)	15

Functions: 51; mean complexity 4.8, 90th percentile 10; 3 complex and 0 long functions
Duplicated lines: 1.2% of 979 compared
Tests: 0 test lines for 1,381 source lines (ratio 0.00); CI test commands: go test; 2% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is poor: 54 known vulnerabilities in 3 dependencies; 9 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: sast.

Area	Score
Secrets (gitleaks, tree + history)	97
Static analysis (Opengrep)	9
Vulnerable dependencies (OSV)	60
CI workflows (zizmor)	31
Posture (policy, updates, signing, lockfiles)	40
OpenSSF Scorecard	25

Known vulnerabilities: 54 in 3 packages (critical 8, high 7, medium 14, low 0)
Posture checks passed: security policy, lockfiles; missing: dependency updates, signed commits
OpenSSF Scorecard aggregate: 3.3/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
critical	`osv/GHSA-v778-237x-gjrc`: golang.org/x/[email protected] (Go) is affected by GO-2024-3321, GHSA-v778-237x-gjrc	go.mod
critical	`osv/GHSA-jppx-rxg9-jmrx`: golang.org/x/[email protected] (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx	go.mod
critical	`osv/GHSA-f5wc-c3c7-36mc`: golang.org/x/[email protected] (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc	go.mod
critical	`osv/GHSA-vgwf-h737-ff37`: golang.org/x/[email protected] (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37	go.mod
critical	`osv/GHSA-89gr-r52h-f8rx`: golang.org/x/[email protected] (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx	go.mod
critical	`osv/GHSA-rm3j-f69w-wqmq`: golang.org/x/[email protected] (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq	go.mod
critical	`osv/GHSA-5cgq-3rg8-m6cv`: golang.org/x/[email protected] (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv	go.mod
critical	`osv/GHSA-x527-x647-q7gg`: golang.org/x/[email protected] (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg	go.mod
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	main.go:384
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	main.go:390
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	truststore_java.go:70
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	truststore_java.go:90
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	truststore_java.go:101
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	truststore_nss.go:79
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	truststore_nss.go:91
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	truststore_nss.go:108
high	`opengrep/go.lang.security.audit.dangerous-exec-command`: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]	truststore_nss.go:112
high	`osv/GHSA-hcg3-q754-cr77`: golang.org/x/[email protected] (Go) is affected by GO-2025-3487, GHSA-hcg3-q754-cr77	go.mod
high	`osv/GHSA-q4h4-gmj2-qvw2`: golang.org/x/[email protected] (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2	go.mod
high	`osv/GHSA-w879-237q-wc7r`: golang.org/x/[email protected] (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r	go.mod
high	`osv/GHSA-69cg-p879-7622`: golang.org/x/[email protected] (Go) is affected by GO-2022-0969, GHSA-69cg-p879-7622	go.mod
high	`osv/GHSA-vvpx-j8f3-3w6h`: golang.org/x/[email protected] (Go) is affected by GO-2023-1571, GHSA-vvpx-j8f3-3w6h	go.mod
high	`osv/GHSA-4374-p667-p6c8`: golang.org/x/[email protected] (Go) is affected by GO-2023-2102, GHSA-4374-p667-p6c8	go.mod
high	`osv/GHSA-69ch-w2m2-3vjp`: golang.org/x/[email protected] (Go) is affected by GO-2022-1059, GHSA-69ch-w2m2-3vjp	go.mod
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:11

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v1.4.4 ships mkcert-v1.4.4-windows-amd64.exe (953386 downloads)
binary-release-asset: release v1.4.4 ships mkcert-v1.4.4-windows-arm64.exe (94343 downloads)
binary-release-asset: release v1.4.3 ships mkcert-v1.4.3-windows-amd64.exe (96773 downloads)
binary-release-asset: release v1.4.2 ships mkcert-v1.4.2-windows-amd64.exe (2990 downloads)
binary-release-asset: release v1.4.1 ships mkcert-v1.4.1-windows-amd64.exe (93182 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 1,381; test lines: 0

Language	Lines
Go	1,381