Leaderboard github.com
Flow-Launcher/Flow.Launcher
:mag: Quick file search & app launcher for Windows with community-made plugins
AI provenance
0%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
72/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
60/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% explicit
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts1%
- Estimated AI-generated share0%
- AI tool configuration files0
- Work sessions at AI pace2
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.20
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| GitHub Copilot coding agent | 71 | 1,668 | 2025-03-29 | 2026-09-20 |
| OpenAI Codex | 16 | 1,052 | 2026-06-23 | 2026-10-26 |
| Claude Code | 8 | 103 | 2026-09-23 | 2026-11-02 |
Lines added per month all AI-attributed share
- 2013-1283,787 · 0% AI
- 2014-0123,253 · 0% AI
- 2014-022,340 · 0% AI
- 2014-038,130 · 0% AI
- 2014-04842 · 0% AI
- 2014-053,269 · 0% AI
- 2014-06472 · 0% AI
- 2014-07287,671 · 0% AI
- 2014-08453 · 0% AI
- 2014-09122 · 0% AI
- 2014-102,912 · 0% AI
- 2014-11275 · 0% AI
- 2014-121,930 · 0% AI
- 2015-0115,050 · 0% AI
- 2015-023,244 · 0% AI
- 2015-0312 · 0% AI
- 2015-0486 · 0% AI
- 2015-0571 · 0% AI
- 2015-0699 · 0% AI
- 2015-0749 · 0% AI
- 2015-0849 · 0% AI
- 2015-0936 · 0% AI
- 2015-10316 · 0% AI
- 2015-113,408 · 0% AI
- 2015-12246 · 0% AI
- 2016-01830 · 0% AI
- 2016-023,397 · 0% AI
- 2016-031,132 · 0% AI
- 2016-041,570 · 0% AI
- 2016-053,967 · 0% AI
- 2016-061,081 · 0% AI
- 2016-07414 · 0% AI
- 2016-081,627 · 0% AI
- 2016-09257 · 0% AI
- 2016-104 · 0% AI
- 2016-11638 · 0% AI
- 2017-01525 · 0% AI
- 2017-02646 · 0% AI
- 2017-03448 · 0% AI
- 2017-04322 · 0% AI
- 2017-1067 · 0% AI
- 2017-1233 · 0% AI
- 2018-010 · 0% AI
- 2018-023 · 0% AI
- 2018-03213 · 0% AI
- 2018-040 · 0% AI
- 2018-0733 · 0% AI
- 2018-085 · 0% AI
- 2018-12248 · 0% AI
- 2019-0230 · 0% AI
- 2019-036 · 0% AI
- 2019-062 · 0% AI
- 2019-074 · 0% AI
- 2019-08623 · 0% AI
- 2019-09832 · 0% AI
- 2019-101,079 · 0% AI
- 2019-11381 · 0% AI
- 2019-121,485 · 0% AI
- 2020-011,054 · 0% AI
- 2020-021,074 · 0% AI
- 2020-031,060 · 0% AI
- 2020-041,464 · 0% AI
- 2020-052,454 · 0% AI
- 2020-061,470 · 0% AI
- 2020-071,065 · 0% AI
- 2020-08231 · 0% AI
- 2020-09102 · 0% AI
- 2020-10513 · 0% AI
- 2020-11947 · 0% AI
- 2020-122,672 · 0% AI
- 2021-012,629 · 0% AI
- 2021-021,375 · 0% AI
- 2021-03342 · 0% AI
- 2021-04283 · 0% AI
- 2021-05720 · 0% AI
- 2021-065,867 · 0% AI
- 2021-071,306 · 0% AI
- 2021-08277 · 0% AI
- 2021-09656 · 0% AI
- 2021-101,578 · 0% AI
- 2021-112,595 · 0% AI
- 2021-121,285 · 0% AI
- 2022-01685 · 0% AI
- 2022-02166 · 0% AI
- 2022-031,113 · 0% AI
- 2022-0478 · 0% AI
- 2022-05166 · 0% AI
- 2022-063,679 · 0% AI
- 2022-071,156 · 0% AI
- 2022-081,039 · 0% AI
- 2022-093,886 · 0% AI
- 2022-103,377 · 0% AI
- 2022-113,455 · 0% AI
- 2022-122,368 · 0% AI
- 2023-011,021 · 0% AI
- 2023-02291 · 0% AI
- 2023-031,063 · 0% AI
- 2023-04741 · 0% AI
- 2023-05254 · 0% AI
- 2023-06905 · 0% AI
- 2023-07416 · 0% AI
- 2023-0842 · 0% AI
- 2023-09155 · 0% AI
- 2023-107 · 0% AI
- 2023-111,842 · 0% AI
- 2023-12109 · 0% AI
- 2024-01485 · 0% AI
- 2024-02562 · 0% AI
- 2024-03107 · 0% AI
- 2024-045,342 · 0% AI
- 2024-054,012 · 0% AI
- 2024-061,528 · 0% AI
- 2024-0787 · 0% AI
- 2024-0838 · 0% AI
- 2024-0985 · 0% AI
- 2024-1014 · 0% AI
- 2024-11660 · 0% AI
- 2024-121,021 · 0% AI
- 2025-011,428 · 0% AI
- 2025-022,866 · 0% AI
- 2025-039,800 · 0% AI
- 2025-045,270 · 0% AI
- 2025-054,109 · 0% AI
- 2025-064,349 · 0% AI
- 2025-076,724 · 0% AI
- 2025-08355 · 0% AI
- 2025-093,245 · 0% AI
- 2025-103,178 · 1% AI
- 2025-11556 · 0% AI
- 2025-12685 · 18% AI
- 2026-01834 · 7% AI
- 2026-023,300 · 0% AI
- 2026-03820 · 24% AI
- 2026-04785 · 6% AI
- 2026-051,920 · 0% AI
- 2026-062,501 · 14% AI
- 2026-07738 · 0% AI
- 2026-083,698 · 36% AI
- 2026-091,778 · 5% AI
- 2026-10871 · 60% AI
- 2026-11797 · 2% AI
Findings in AI-attributed lines vs the rest
From git blame: 2,440 lines trace to AI-attributed commits, 64,150 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.17 | 0.00× |
| Security | 0.00 | 0.05 | 0.00× |
Evidence by analyzer
Explicit AI attributionok28 items
- GitHub Copilot coding agent: 71 attributed commits, 1,668 lines added
- OpenAI Codex: 16 attributed commits, 1,052 lines added
- Claude Code: 8 attributed commits, 103 lines added
- Claude Code: trailer 'Co-authored-by: Claude'
- OpenAI Codex: on merged branch (b140acd785)
- OpenAI Codex: on merged branch (a28397b762)
- OpenAI Codex: on merged branch (a28397b762)
- OpenAI Codex: on merged branch (a28397b762)
- OpenAI Codex: on merged branch (a28397b762)
- OpenAI Codex: on merged branch (a28397b762)
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- GitHub Copilot coding agent: PR branch 'copilot/update-readme-sponsor'
- OpenAI Codex: on merged branch (1700eddb4c)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- OpenAI Codex: on merged branch (1700eddb4c)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- OpenAI Codex: on merged branch (1700eddb4c)
- OpenAI Codex: on merged branch (1700eddb4c)
- OpenAI Codex: on merged branch (1700eddb4c)
- OpenAI Codex: on merged branch (1700eddb4c)
- OpenAI Codex: on merged branch (1700eddb4c)
- OpenAI Codex: PR branch 'codex/flow-shell-cmd-quotes'
- attributed_commit_share
- 1.1%
- attributed_commits
- 95
- attributed_loc
- 2,823
- attributed_loc_share
- 0.5%
- commits
- 8,978
- effective_loc
- 595,605
- tools_detected
- 3
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok2 items
- 3,391 lines of first-party code in ~4.4h (771 lines/hour, 3 commit session)
- 1,032 lines of first-party code in ~1.5h (679 lines/hour, 6 commit session)
- excluded_import_loc
- 381,211
- flagged_loc
- 4,423
- flagged_loc_share
- 2.1%
- flagged_units
- 2
- max_loc_per_hour
- 2,127.55
- measured_loc
- 214,394
- median_loc_per_hour
- 49.70
- pr_timed_units
- 87
- pre_ai_era_burst_loc
- 13,919
- pre_ai_era_bursts
- 4
- pre_ai_era_measured_loc
- 104,132
- work_units
- 3,608
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 237.50
- releases
- 61
Coding styleok7 items
- step-by-step narration comment: # First, get all PRs to find the release PR and determine the milestone
- step-by-step narration comment: // First, find the setters to remove and store them in a list
- step-by-step narration comment: // First, try to find by full name, and if not found, fallback to prefix
- step-by-step narration comment: // First, try to delete all files in the directory tree
- step-by-step narration comment: // Then, try to delete all empty directories (from deepest to shallowest)
- step-by-step narration comment: // Finally, try to delete the root directory itself
- step-by-step narration comment: // Then, delete plugin directory
- count:assistant_voice
- 0
- count:emoji_in_code
- 12
- count:narrated_steps
- 7
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 3
- files:narrated_steps
- 5
- files:placeholder
- 0
- index
- 0.20
- lines_scanned
- 66,590
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.18
- per_kloc:narrated_steps
- 0.10
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 2,440
- blame_failures
- 0
- files_blamed
- 399
- other_lines
- 64,150
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 11
- quality:other_per_kloc
- 0.17
- quality:ratio
- 0
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 3
- security:other_per_kloc
- 0.05
- security:ratio
- 0
Code quality
72 adequate
Code quality is adequate: test-to-source ratio 0.00, CI runs tests; 11% of function code in complex or long functions; 5% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity72
- Duplication74
- Lint and smells96
- Tests and CI56
- Documentation65
- Type safety40
- Review process100
Evidence by analyzer
Complexity (lizard)ok10 items
- MainWindow::OnLoaded in Flow.Launcher/MainWindow.xaml.cs: complexity 44, 184 lines
- StringMatcher::FuzzyMatch in Flow.Launcher.Infrastructure/StringMatcher.cs: complexity 39, 133 lines
- JsonRPCPluginSettings::CreateSettingPanel in Flow.Launcher.Core/Plugin/JsonRPCPluginSettings.cs: complexity 34, 279 lines
- Flow.Launcher.ViewModel::MainViewModel::QueryResultsAsync in Flow.Launcher/ViewModel/MainViewModel.cs: complexity 32, 177 lines
- ContextMenu::LoadContextMenus in Plugins/Flow.Launcher.Plugin.Explorer/ContextMenu.cs: complexity 32, 254 lines
- EverythingApiV3::TryConvertSortOption in Plugins/Flow.Launcher.Plugin.Explorer/Search/Everything/EverythingApiV3.cs: complexity 27, 114 lines
- PluginsManager::RequestUpdateAsync in Plugins/Flow.Launcher.Plugin.PluginsManager/PluginsManager.cs: complexity 25, 255 lines
- struct::IsPrintableCharacter in Flow.Launcher.Infrastructure/Hotkey/HotkeyModel.cs: complexity 24, 24 lines
- DialogJump::SetupDialogJump in Flow.Launcher.Infrastructure/DialogJump/DialogJump.cs: complexity 23, 146 lines
- ResultsQuerySelection::switch in Flow.Launcher/ViewModel/MainViewModel.cs: complexity 23, 69 lines
- complex_functions
- 29
- function_nloc
- 34,299
- functions
- 2,384
- long_functions
- 16
- many_param_functions
- 1
- mean_ccn
- 2.77
- p90_ccn
- 6
- risky_nloc_share
- 11.0%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: Flow.Launcher.Core/ExternalPlugins/Environments/AbstractPluginEnvironment.cs:161 and Flow.Launcher/SettingPages/ViewModels/SettingsPaneGeneralViewModel.cs:358
- 6+ duplicated lines: Flow.Launcher.Core/ExternalPlugins/Environments/AbstractPluginEnvironment.cs:166 and Flow.Launcher/SettingPages/ViewModels/SettingsPanePluginStoreViewModel.cs:158
- 6+ duplicated lines: Flow.Launcher.Core/ExternalPlugins/Environments/TypeScriptEnvironment.cs:18 and Flow.Launcher.Core/ExternalPlugins/Environments/TypeScriptV2Environment.cs:18
- 6+ duplicated lines: Flow.Launcher.Core/Plugin/ExecutablePlugin.cs:15 and Flow.Launcher.Core/Plugin/NodePlugin.cs:19
- 6+ duplicated lines: Flow.Launcher.Core/Plugin/JsonRPCPlugin.cs:1 and Flow.Launcher.Core/Plugin/JsonRPCPluginBase.cs:1
- 6+ duplicated lines: Flow.Launcher.Core/Plugin/PluginConfig.cs:149 and Flow.Launcher.Core/Plugin/PluginInstaller.cs:511
- 6+ duplicated lines: Flow.Launcher.Core/Plugin/PluginInstaller.cs:58 and Flow.Launcher.Core/Plugin/PluginInstaller.cs:223
- 6+ duplicated lines: Flow.Launcher.Core/Plugin/PluginInstaller.cs:437 and Plugins/Flow.Launcher.Plugin.PluginsManager/PluginsManager.cs:218
- 6+ duplicated lines: Flow.Launcher.Core/Plugin/PluginManager.cs:420 and Flow.Launcher.Core/Plugin/PluginManager.cs:486
- 6+ duplicated lines: Flow.Launcher.Core/Plugin/PluginManager.cs:863 and Plugins/Flow.Launcher.Plugin.PluginsManager/Utilities.cs:46
- compared_lines
- 38,893
- duplicated_lines
- 1,907
- duplicated_share
- 4.9%
- files
- 399
Lintok
- category:best-practice
- 5
- category:correctness
- 6
- findings
- 11
- scanned_lines
- 66,453
- weighted_findings
- 10.25
Tests and CIok11 items
- CI config: .github/workflows/default_plugins.yml
.github/workflows/default_plugins.yml - CI config: .github/workflows/dotnet.yml
.github/workflows/dotnet.yml - CI config: .github/workflows/pr_assignee.yml
.github/workflows/pr_assignee.yml - CI config: .github/workflows/pr_milestone.yml
.github/workflows/pr_milestone.yml - CI config: .github/workflows/release_deploy.yml
.github/workflows/release_deploy.yml - CI config: .github/workflows/release_pr.yml
.github/workflows/release_pr.yml - CI config: .github/workflows/stale.yml
.github/workflows/stale.yml - CI config: .github/workflows/top-ranking-issues.yml
.github/workflows/top-ranking-issues.yml - CI config: .github/workflows/winget.yml
.github/workflows/winget.yml - CI config: azure-pipelines.yml
azure-pipelines.yml - CI runs tests (dotnet test)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 10
- cochange_commits
- 240
- cochange_share
- 1.2%
- source_lines
- 66,590
- test_lines
- 244
- test_ratio
- 0.00
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 310
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 0
- escapes_per_kloc
- 0
Security
60 weak
Security posture is weak: 18 known vulnerabilities in 5 dependencies; 2 high-severity SAST findings; 43 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets85
- Static analysis (SAST)99
- Vulnerable dependencies61
- CI workflows0
- Security posture40
- OpenSSF Scorecard26
Evidence by analyzer
OpenSSF Scorecardok12 items
- Scorecard Maintained: 10/10 (30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10)
- Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)
- Scorecard Code-Review: 10/10 (all changesets reviewed)
- Scorecard Token-Permissions: 0/10 (detected GitHub workflow tokens with excessive permissions)
- Scorecard Binary-Artifacts: 8/10 (binaries present in source code)
- Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)
- Scorecard Pinned-Dependencies: 0/10 (dependency not pinned by hash detected -- score normalized to 0)
- Scorecard Fuzzing: 0/10 (project is not fuzzed)
- Scorecard License: 10/10 (license file detected)
- Scorecard Signed-Releases: 0/10 (Project has not signed or included provenance with any releases.)
- Scorecard Security-Policy: 0/10 (security policy file not detected)
- Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)
- aggregate
- 4.60
- check:Binary-Artifacts
- yes
- check:CII-Best-Practices
- no
- check:Code-Review
- yes
- check:Dangerous-Workflow
- yes
- check:Fuzzing
- no
- check:License
- yes
- check:Maintained
- yes
- check:Pinned-Dependencies
- no
- check:SAST
- no
- check:Security-Policy
- no
- check:Signed-Releases
- no
- check:Token-Permissions
- no
Package registriesskipped
no registry dependencies declared
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 5
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 2
- findings_high
- 2
- findings_low
- 0
- findings_medium
- 0
- parse_errors
- 1
- scanned_lines
- 66,453
- weighted_findings
- 2.55
Dependencies (osv-scanner)ok
- penalty
- 30
- vulnerabilities
- 18
- vulnerable_packages
- 5
- vulns_critical
- 0
- vulns_high
- 6
- vulns_low
- 0
- vulns_medium
- 12
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 69
- findings_high
- 43
- findings_low
- 15
- findings_medium
- 11
- penalty
- 536.90
- workflows
- 9
Security postureok1 item
- Dependency updates: .github/dependabot.yml
.github/dependabot.yml
- check:dependency_updates
- yes
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 29.5%
- unpinned_manifests
- 0
Release downloadsok6 items
- release v2.1.4 ships Flow-Launcher-Portable.zip (11634 downloads)
- release v2.1.4 ships Flow-Launcher-Setup.exe (55276 downloads)
- release v2.1.3 ships Flow-Launcher-Portable.zip (18422 downloads)
- release v2.1.3 ships Flow-Launcher-Setup.exe (118733 downloads)
- release v2.1.2 ships Flow-Launcher-Portable.zip (6481 downloads)
- links directly to a downloadable archive or installer
README.md
- binary_assets
- 20
- signals
- 2
- suspicious
- 0
Findings
51 high33 medium9 low12 info
105 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:107 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:119 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:13 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:130 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:142 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:15 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:153 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:165 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:176 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:188 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:199 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:211 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:222 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:234 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:245 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:257 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:268 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:280 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:291 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:303 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:38 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:50 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:61 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:73 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:84 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/default_plugins.yml:96 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dotnet.yml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dotnet.yml:26 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dotnet.yml:32 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dotnet.yml:57 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dotnet.yml:64 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dotnet.yml:71 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dotnet.yml:78 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/dotnet.yml:86 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pr_assignee.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/pr_assignee.yml:4 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pr_milestone.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/pr_milestone.yml:6 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_pr.yml:14 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release_pr.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/stale.yml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/top-ranking-issues.yml:13 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/winget.yml:10 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | osv/GHSA-2x83-8g95-xh59 |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-2x83-8g95-xh59; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-7jgj-8wvc-jh57 |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-7jgj-8wvc-jh57; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-cmhx-cq75-c4mj |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-cmhx-cq75-c4mj; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-hv8m-jj95-wg3x |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-hv8m-jj95-wg3x; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-v72x-2h86-7f8m |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-v72x-2h86-7f8m; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| high | osv/GHSA-vh6j-jc39-fggf |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-vh6j-jc39-fggf; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| high | opengrep/csharp.lang.security.injections.os-command-injection |
Flow.Launcher.Plugin/SharedCommands/ShellCommand.cs:34 | The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it... | Static analysis (opengrep) |
| high | opengrep/csharp.lang.security.sqli.csharp-sqli |
Plugins/Flow.Launcher.Plugin.Explorer/Search/WindowsIndex/WindowsIndex.cs:27 | Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and... | Static analysis (opengrep) |
| medium | opengrep/python.requests.best-practice.use-timeout |
.github/update_release_pr.py:170 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.lang.correctness.use-sys-exit |
.github/update_release_pr.py:180 | Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations. | Lint |
| medium | opengrep/python.lang.correctness.use-sys-exit |
.github/update_release_pr.py:188 | Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations. | Lint |
| medium | opengrep/python.lang.correctness.use-sys-exit |
.github/update_release_pr.py:201 | Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations. | Lint |
| medium | opengrep/python.lang.correctness.use-sys-exit |
.github/update_release_pr.py:209 | Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations. | Lint |
| medium | opengrep/python.lang.correctness.use-sys-exit |
.github/update_release_pr.py:217 | Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations. | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
.github/update_release_pr.py:40 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.lang.correctness.use-sys-exit |
.github/update_release_pr.py:53 | Detected use of `exit`. Use `sys.exit` over the python shell `exit` built-in. `exit` is a helper for the interactive shell and may not be available on all Python implementations. | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
Flow.Launcher/Themes/ThemeBuilder/ThemeConvertor.py:10 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
Flow.Launcher/Themes/ThemeBuilder/ThemeConvertor.py:5 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:19 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:8 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/default_plugins.yml:9 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/dotnet.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_deploy.yml:11 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_deploy.yml:24 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_deploy.yml:3 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_deploy.yml:37 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/release_pr.yml:11 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/top-ranking-issues.yml:8 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/winget.yml:7 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | osv/GHSA-2f33-pr97-265q |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-2f33-pr97-265q; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-6c8g-7p36-r338 |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-6c8g-7p36-r338; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-cj9g-3mj2-g8vv |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-cj9g-3mj2-g8vv; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-cxmj-83gh-fp49 |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-cxmj-83gh-fp49; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-fxh6-w476-hgr4 |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-fxh6-w476-hgr4; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-jp7f-grcv-6mjf |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-jp7f-grcv-6mjf; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2h6-ghwm-5qm8 |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-q2h6-ghwm-5qm8; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-qhmf-xw27-6rqr |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-qhmf-xw27-6rqr; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-qhrr-8q5h-9q3h |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-qhrr-8q5h-9q3h; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-w567-gjr2-hm5j |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-w567-gjr2-hm5j; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-wfr3-xj75-pfwh |
Flow.Launcher.Core/packages.lock.json | [email protected] (NuGet) is affected by GHSA-wfr3-xj75-pfwh; also in Flow.Launcher/packages.lock.json | Dependencies (osv-scanner) |
| medium | osv/GHSA-23fw-v26w-5fgq |
Flow.Launcher.Plugin/packages.lock.json | [email protected] (NuGet) is affected by GHSA-23fw-v26w-5fgq | Dependencies (osv-scanner) |
| low | opengrep/csharp.lang.best-practice.structured-logging |
Plugins/Flow.Launcher.Plugin.Program/Logger/ProgramLogger.cs:96 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | zizmor/artipacked |
.github/workflows/default_plugins.yml:13 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/dotnet.yml:23 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release_pr.yml:14 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
.vs/config/applicationhost.config:127 | Possible generic-api-key secret in history (commit ad84b222a5); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
Flow.Launcher.Test/PythonDependencies/DependencyInstallMarkerTest.cs:161 | Possible generic-api-key secret in history (commit b7f0fc9912); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
Flow.Launcher/ViewModel/MainViewModel.cs:501 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
Plugins/WinAlfred.Plugin.Fanyi/Main.cs:30 | Possible generic-api-key secret in history (commit b2081dcbc9); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
PythonHome/Lib/distutils/msvccompiler.py:42 | Possible generic-api-key secret in history (commit f1ce98eb07); removed from the current tree but still retrievable | Secrets (gitleaks) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:119 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:142 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:165 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:188 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:211 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:234 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:257 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:280 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:303 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:50 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:73 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
| info | zizmor/superfluous-actions |
.github/workflows/default_plugins.yml:96 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 11 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 69 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 18 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | skipped | — | 0 | no registry dependencies declared |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 2 | |
| OpenSSF Scorecard | Security | ok | scorecard v5.6.0 | 0 | |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 5 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 236c847977ab | prov-5+qual-2+sec-2 | 0% | 72 | 60 |
Full text report
- Repository: https://github.com/Flow-Launcher/Flow.Launcher
- Commit:
236c847977abfe72d73de8cd8d2d0e4896c53647 - Generated: 2026-11-14T15:39:10+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | explicit | 95% | 100% |
| Code quality | 72 | adequate | 90% | 100% |
| Security | 60 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
- Explicitly attributed share (lower bound): 0.5%
- Unattributed share in AI-consistent velocity bursts: 0.7%
- Estimated AI-generated share: 0.5%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| GitHub Copilot coding agent | 71 | 1,668 |
| OpenAI Codex | 16 | 1,052 |
| Claude Code | 8 | 103 |
Current source lines last changed by AI-attributed commits: 2,440 of 66,590.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.171 | 0.0x |
| Security | 0.0 | 0.047 | 0.0x |
- Stylometry index: 0.20 per 1,000 lines (narrated steps 7, placeholders 0, assistant phrasing 0, emoji 12). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 685 | 18% |
| 2026-01 | 834 | 7% |
| 2026-02 | 3,300 | 0% |
| 2026-03 | 820 | 24% |
| 2026-04 | 785 | 6% |
| 2026-05 | 1,920 | 0% |
| 2026-06 | 2,501 | 14% |
| 2026-07 | 738 | 0% |
| 2026-08 | 3,698 | 36% |
| 2026-09 | 1,778 | 5% |
| 2026-10 | 871 | 60% |
| 2026-11 | 797 | 2% |
Evidence
- Claude Code: trailer 'Co-authored-by: Claude' (947ba49f4f05)
- OpenAI Codex: on merged branch (b140acd785) (1df3d59508ef)
- OpenAI Codex: on merged branch (a28397b762) (e56b8b84ce07)
- OpenAI Codex: on merged branch (a28397b762) (ecfc33585aa5)
- OpenAI Codex: on merged branch (a28397b762) (f1449af072c4)
- OpenAI Codex: on merged branch (a28397b762) (774cb30d081d)
- OpenAI Codex: on merged branch (a28397b762) (a1672b8dcd9c)
- Claude Code: trailer 'Co-Authored-By: Claude' (77addf268d59)
- Claude Code: trailer 'Co-Authored-By: Claude' (2ed6e165cde5)
- Claude Code: trailer 'Co-Authored-By: Claude' (3aa61ccb1be2)
- Claude Code: trailer 'Co-Authored-By: Claude' (8a3eb137f180)
- Claude Code: trailer 'Co-Authored-By: Claude' (233f797f3517)
- Claude Code: trailer 'Co-Authored-By: Claude' (518ace52c2d0)
- Claude Code: trailer 'Co-Authored-By: Claude' (4e7adb8ab755)
- GitHub Copilot coding agent: PR branch 'copilot/update-readme-sponsor' (a637c8244faa)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.00, CI runs tests; 11% of function code in complex or long functions; 5% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 72 |
| Duplication | 74 |
| Code smells (Opengrep) | 96 |
| Tests and CI | 56 |
| Documentation | 65 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | 100 |
- Functions: 2,384; mean complexity 2.8, 90th percentile 6; 29 complex and 16 long functions
- Duplicated lines: 4.9% of 38,893 compared
- Tests: 244 test lines for 66,590 source lines (ratio 0.00); CI test commands: dotnet test; 1% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- MainWindow::OnLoaded in Flow.Launcher/MainWindow.xaml.cs: complexity 44, 184 lines
- StringMatcher::FuzzyMatch in Flow.Launcher.Infrastructure/StringMatcher.cs: complexity 39, 133 lines
- JsonRPCPluginSettings::CreateSettingPanel in Flow.Launcher.Core/Plugin/JsonRPCPluginSettings.cs: complexity 34, 279 lines
- Flow.Launcher.ViewModel::MainViewModel::QueryResultsAsync in Flow.Launcher/ViewModel/MainViewModel.cs: complexity 32, 177 lines
- ContextMenu::LoadContextMenus in Plugins/Flow.Launcher.Plugin.Explorer/ContextMenu.cs: complexity 32, 254 lines
Security
Security posture is weak: 18 known vulnerabilities in 5 dependencies; 2 high-severity SAST findings; 43 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 85 |
| Static analysis (Opengrep) | 99 |
| Vulnerable dependencies (OSV) | 61 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | 26 |
-
Known vulnerabilities: 18 in 5 packages (critical 0, high 6, medium 12, low 0)
-
Posture checks passed: dependency updates, lockfiles; missing: security policy, signed commits
-
OpenSSF Scorecard aggregate: 4.6/10 (published 2026-11-09)
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/csharp.lang.security.injections.os-command-injection: The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. [confidence low] |
Flow.Launcher.Plugin/SharedCommands/ShellCommand.cs:34 |
| high | opengrep/csharp.lang.security.sqli.csharp-sqli: Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'. [confidence medium] |
Plugins/Flow.Launcher.Plugin.Explorer/Search/WindowsIndex/WindowsIndex.cs:27 |
| high | osv/GHSA-2x83-8g95-xh59: [email protected] (NuGet) is affected by GHSA-2x83-8g95-xh59; also in Flow.Launcher/packages.lock.json |
Flow.Launcher.Core/packages.lock.json |
| high | osv/GHSA-hv8m-jj95-wg3x: [email protected] (NuGet) is affected by GHSA-hv8m-jj95-wg3x; also in Flow.Launcher/packages.lock.json |
Flow.Launcher.Core/packages.lock.json |
| high | osv/GHSA-v72x-2h86-7f8m: [email protected] (NuGet) is affected by GHSA-v72x-2h86-7f8m; also in Flow.Launcher/packages.lock.json |
Flow.Launcher.Core/packages.lock.json |
| high | osv/GHSA-vh6j-jc39-fggf: [email protected] (NuGet) is affected by GHSA-vh6j-jc39-fggf; also in Flow.Launcher/packages.lock.json |
Flow.Launcher.Core/packages.lock.json |
| high | osv/GHSA-7jgj-8wvc-jh57: [email protected] (NuGet) is affected by GHSA-7jgj-8wvc-jh57; also in Flow.Launcher/packages.lock.json |
Flow.Launcher.Core/packages.lock.json |
| high | osv/GHSA-cmhx-cq75-c4mj: [email protected] (NuGet) is affected by GHSA-cmhx-cq75-c4mj; also in Flow.Launcher/packages.lock.json |
Flow.Launcher.Core/packages.lock.json |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:13 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:15 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:38 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:50 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:61 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:73 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:84 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:96 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:107 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:119 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:130 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:142 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:153 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:165 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:176 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:188 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/default_plugins.yml:199 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v2.1.4 ships Flow-Launcher-Portable.zip (11634 downloads)
- binary-release-asset: release v2.1.4 ships Flow-Launcher-Setup.exe (55276 downloads)
- binary-release-asset: release v2.1.3 ships Flow-Launcher-Portable.zip (18422 downloads)
- binary-release-asset: release v2.1.3 ships Flow-Launcher-Setup.exe (118733 downloads)
- binary-release-asset: release v2.1.2 ships Flow-Launcher-Portable.zip (6481 downloads)
- readme-download-lure: links directly to a downloadable archive or installer
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 66,590; test lines: 244
| Language | Lines |
|---|---|
| C# | 66,431 |
| Python | 266 |
| PowerShell | 137 |