Leaderboard github.com
FuelLabs/sway
🌴 Empowering everyone to build reliable and efficient smart contracts.
AI provenance
<1%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
66/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
43/100
poor
- Confidence
- 70%
- Coverage
- 86%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% explicit
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts6%
- Estimated AI-generated share0%
- AI tool configuration files0
- Work sessions at AI pace13
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.12
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Cursor agent | 1 | 457 | 2026-10-08 | 2026-10-08 |
| GitHub Copilot coding agent | 1 | 68 | 2025-08-14 | 2025-08-14 |
| Claude Code | 1 | 51 | 2026-08-21 | 2026-08-21 |
Lines added per month all AI-attributed share
- 2021-013 · 0% AI
- 2021-0519,525 · 0% AI
- 2021-063,225 · 0% AI
- 2021-074,173 · 0% AI
- 2021-083,102 · 0% AI
- 2021-095,804 · 0% AI
- 2021-106,514 · 0% AI
- 2021-117,370 · 0% AI
- 2021-125,658 · 0% AI
- 2022-0113,713 · 0% AI
- 2022-026,125 · 0% AI
- 2022-0319,580 · 0% AI
- 2022-0413,800 · 0% AI
- 2022-0518,347 · 0% AI
- 2022-0617,255 · 0% AI
- 2022-0717,070 · 0% AI
- 2022-0817,598 · 0% AI
- 2022-099,722 · 0% AI
- 2022-1028,073 · 0% AI
- 2022-1114,477 · 0% AI
- 2022-1212,649 · 0% AI
- 2023-0119,839 · 0% AI
- 2023-0222,412 · 0% AI
- 2023-0317,638 · 0% AI
- 2023-0416,629 · 0% AI
- 2023-055,743 · 0% AI
- 2023-064,931 · 0% AI
- 2023-0710,751 · 0% AI
- 2023-0811,087 · 0% AI
- 2023-097,289 · 0% AI
- 2023-1011,847 · 0% AI
- 2023-115,348 · 0% AI
- 2023-125,223 · 0% AI
- 2024-0110,216 · 0% AI
- 2024-028,969 · 0% AI
- 2024-037,829 · 0% AI
- 2024-046,824 · 0% AI
- 2024-059,033 · 0% AI
- 2024-066,162 · 0% AI
- 2024-075,200 · 0% AI
- 2024-0814,132 · 0% AI
- 2024-094,533 · 0% AI
- 2024-105,976 · 0% AI
- 2024-115,888 · 0% AI
- 2024-122,843 · 0% AI
- 2025-018,552 · 0% AI
- 2025-0211,746 · 0% AI
- 2025-0310,541 · 0% AI
- 2025-049,855 · 0% AI
- 2025-058,461 · 0% AI
- 2025-067,611 · 0% AI
- 2025-079,538 · 0% AI
- 2025-083,266 · 2% AI
- 2025-093,966 · 0% AI
- 2025-106,588 · 0% AI
- 2025-113,864 · 0% AI
- 2025-12952 · 0% AI
- 2026-011,737 · 0% AI
- 2026-021,003 · 0% AI
- 2026-031,900 · 0% AI
- 2026-043,990 · 0% AI
- 2026-052,659 · 0% AI
- 2026-063,240 · 0% AI
- 2026-072,585 · 0% AI
- 2026-083,543 · 1% AI
- 2026-09666 · 0% AI
- 2026-10950 · 48% AI
Findings in AI-attributed lines vs the rest
From git blame: 383 lines trace to AI-attributed commits, 217,216 to others. Too few lines in one group for a fair comparison. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.14 | — |
| Security | 0.00 | 0.07 | — |
Evidence by analyzer
Explicit AI attributionok6 items
- GitHub Copilot coding agent: 1 attributed commits, 68 lines added
- Claude Code: 1 attributed commits, 51 lines added
- Cursor agent: 1 attributed commits, 457 lines added
- Cursor agent: trailer 'Co-authored-by: Cursor'
- Claude Code: trailer 'Co-authored-by: Claude'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- attributed_commit_share
- 0.1%
- attributed_commits
- 3
- attributed_loc
- 576
- attributed_loc_share
- 0.1%
- commits
- 3,667
- effective_loc
- 577,338
- tools_detected
- 3
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok13 items
- 4,175 lines of first-party code in ~4.0h (1,044 lines/hour, 1 commit session)
- 4,134 lines of first-party code in ~4.0h (1,034 lines/hour, 1 commit session)
- 2,175 lines of first-party code in ~2.7h (817 lines/hour, PR #6437)
- 3,215 lines of first-party code in ~4.0h (804 lines/hour, 1 commit session)
- 3,051 lines of first-party code in ~4.0h (763 lines/hour, 1 commit session)
- 2,140 lines of first-party code in ~2.9h (747 lines/hour, 2 commit session)
- 2,976 lines of first-party code in ~4.0h (744 lines/hour, 1 commit session)
- 2,907 lines of first-party code in ~4.0h (727 lines/hour, 1 commit session)
- 1,597 lines of first-party code in ~2.3h (697 lines/hour, PR #3757)
- 2,594 lines of first-party code in ~4.0h (648 lines/hour, 1 commit session)
- 2,582 lines of first-party code in ~4.0h (646 lines/hour, 1 commit session)
- 2,352 lines of first-party code in ~4.0h (588 lines/hour, 1 commit session)
- 2,233 lines of first-party code in ~4.0h (558 lines/hour, 1 commit session)
- excluded_import_loc
- 34,892
- flagged_loc
- 36,131
- flagged_loc_share
- 6.7%
- flagged_units
- 13
- max_loc_per_hour
- 1,748
- measured_loc
- 541,958
- median_loc_per_hour
- 18.23
- pr_timed_units
- 1,393
- pre_ai_era_burst_loc
- 2,450
- pre_ai_era_bursts
- 1
- pre_ai_era_measured_loc
- 9,373
- work_units
- 2,488
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 14,067.90
- releases
- 99
Coding styleok8 items
- step-by-step narration comment: // First, attempt to load the lock.
- step-by-step narration comment: // Next, construct the package graph from the lock.
- step-by-step narration comment: // First, compile to an AST. We'll update the namespace and check for JSON ABI output.
- step-by-step narration comment: // Finally, format the root manifest using taplo formatter
- step-by-step narration comment: // First, let's check the arguments.
- step-by-step narration comment: // Then, the function name.
- step-by-step narration comment: // Step 1: Liveness Analysis.
- step-by-step narration comment: // Step 2: Construct the interference graph.
- count:assistant_voice
- 0
- count:emoji_in_code
- 1
- count:narrated_steps
- 26
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 1
- files:narrated_steps
- 11
- files:placeholder
- 0
- index
- 0.12
- lines_scanned
- 217,599
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.01
- per_kloc:narrated_steps
- 0.12
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 383
- blame_failures
- 0
- files_blamed
- 706
- other_lines
- 217,216
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 31
- quality:other_per_kloc
- 0.14
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 15
- security:other_per_kloc
- 0.07
Code quality
66 adequate
Code quality is adequate: test-to-source ratio 0.12, CI runs tests; 37% of function code in complex or long functions; 10% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity33
- Duplication55
- Lint and smells99
- Tests and CI81
- Documentation65
- Type safetynot measured
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- span in sway-error/src/error.rs: complexity 222, 236 lines
- format in swayfmt/src/utils/language/expr/mod.rs: complexity 219, 565 lines
- to_diagnostic in sway-error/src/error.rs: complexity 211, 1894 lines
- parse_opcode in sway-core/src/asm_lang/mod.rs: complexity 198, 421 lines
- visit_expr in forc-plugins/forc-migrate/src/visiting/mod.rs: complexity 159, 704 lines
- expr_to_expression in sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs: complexity 147, 491 lines
- compile_intrinsic_function in sway-core/src/ir_generation/function.rs: complexity 129, 973 lines
- print_instruction in sway-core/src/asm_generation/finalized_asm.rs: complexity 127, 131 lines
- set_operand in sway-ir/src/instruction.rs: complexity 126, 461 lines
- connect_expression in sway-core/src/control_flow_analysis/dead_code_analysis.rs: complexity 122, 859 lines
- complex_functions
- 314
- function_nloc
- 150,857
- functions
- 6,714
- long_functions
- 238
- many_param_functions
- 79
- mean_ccn
- 4.36
- p90_ccn
- 9
- risky_nloc_share
- 37.3%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: forc-pkg/src/lock.rs:346 and forc-pkg/src/lock.rs:364
- 6+ duplicated lines: forc-pkg/src/manifest/build_profile.rs:53 and forc-pkg/src/manifest/build_profile.rs:76
- 6+ duplicated lines: forc-pkg/src/manifest/dep_modifier.rs:367 and forc-pkg/src/manifest/dep_modifier.rs:379
- 6+ duplicated lines: forc-pkg/src/manifest/mod.rs:97 and forc-pkg/src/manifest/mod.rs:120
- 6+ duplicated lines: forc-pkg/src/pkg.rs:297 and forc-test/src/lib.rs:147
- 6+ duplicated lines: forc-pkg/src/pkg.rs:468 and forc-pkg/src/pkg.rs:480
- 6+ duplicated lines: forc-pkg/src/source/git/mod.rs:619 and forc-pkg/src/source/git/mod.rs:639
- 6+ duplicated lines: forc-pkg/src/source/ipfs.rs:63 and forc-pkg/src/source/reg/mod.rs:376
- 6+ duplicated lines: forc-pkg/src/source/member.rs:31 and forc-pkg/src/source/path.rs:78
- 6+ duplicated lines: forc-pkg/src/source/reg/mod.rs:707 and forc-pkg/src/source/reg/mod.rs:729
- compared_lines
- 158,123
- duplicated_lines
- 15,891
- duplicated_share
- 10.1%
- files
- 706
Lintok
- category:best-practice
- 1
- category:correctness
- 30
- findings
- 31
- scanned_lines
- 217,599
- weighted_findings
- 8.50
Tests and CIok8 items
- CI config: .github/workflows/benchmark.yml
.github/workflows/benchmark.yml - CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/docs.yml
.github/workflows/docs.yml - CI config: .github/workflows/gh-pages.yml
.github/workflows/gh-pages.yml - CI config: .github/workflows/nightly-cargo-audit.yml
.github/workflows/nightly-cargo-audit.yml - CI config: .github/workflows/spellcheck.yml
.github/workflows/spellcheck.yml - CI runs tests (go test, cargo test)
- CI runs linters (clippy, rustfmt, cargo fmt)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 6
- cochange_commits
- 208
- cochange_share
- 39.9%
- source_lines
- 217,599
- test_lines
- 25,618
- test_ratio
- 0.12
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 64
Type safetyskipped
Security
43 poor
Security posture is poor: 56 known vulnerabilities in 37 dependencies; 1 high-severity SAST findings; 137 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secretsnot measured
- Static analysis (SAST)99
- Vulnerable dependencies12
- CI workflows0
- Security posture60
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 150
- declared
- 150
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)failed
gitleaks exited -9:
Static analysis (opengrep)ok
- findings
- 16
- findings_high
- 1
- findings_low
- 15
- findings_medium
- 0
- parse_errors
- 7
- scanned_lines
- 217,599
- weighted_findings
- 5.55
Dependencies (osv-scanner)ok
- penalty
- 129
- vulnerabilities
- 56
- vulnerable_packages
- 37
- vulns_critical
- 0
- vulns_high
- 6
- vulns_low
- 8
- vulns_medium
- 4
- vulns_unknown
- 38
CI workflows (zizmor)ok
- findings
- 195
- findings_high
- 137
- findings_low
- 49
- findings_medium
- 9
- penalty
- 1,493.30
- workflows
- 6
Security postureok21 items
- Security policy: SECURITY.md
SECURITY.md - forc-pkg/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-pkg/Cargo.toml - forc-plugins/forc-debug/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-plugins/forc-debug/Cargo.toml - forc-plugins/forc-doc/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-plugins/forc-doc/Cargo.toml - forc-plugins/forc-fmt/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-plugins/forc-fmt/Cargo.toml - forc-plugins/forc-lsp/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-plugins/forc-lsp/Cargo.toml - forc-plugins/forc-migrate/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-plugins/forc-migrate/Cargo.toml - forc-plugins/forc-publish/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-plugins/forc-publish/Cargo.toml - forc-plugins/forc-tx/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-plugins/forc-tx/Cargo.toml - forc-test/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-test/Cargo.toml - forc-util/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc-util/Cargo.toml - forc/Cargo.toml has no lockfile alongside it (unpinned dependencies)
forc/Cargo.toml - scripts/mdbook-forc-documenter/Cargo.toml has no lockfile alongside it (unpinned dependencies)
scripts/mdbook-forc-documenter/Cargo.toml - sway-ast/Cargo.toml has no lockfile alongside it (unpinned dependencies)
sway-ast/Cargo.toml - sway-core/Cargo.toml has no lockfile alongside it (unpinned dependencies)
sway-core/Cargo.toml - sway-error/Cargo.toml has no lockfile alongside it (unpinned dependencies)
sway-error/Cargo.toml - sway-features/Cargo.toml has no lockfile alongside it (unpinned dependencies)
sway-features/Cargo.toml - sway-ir/Cargo.toml has no lockfile alongside it (unpinned dependencies)
sway-ir/Cargo.toml - sway-ir/sway-ir-macros/Cargo.toml has no lockfile alongside it (unpinned dependencies)
sway-ir/sway-ir-macros/Cargo.toml - sway-lsp/Cargo.toml has no lockfile alongside it (unpinned dependencies)
sway-lsp/Cargo.toml - sway-parse/Cargo.toml has no lockfile alongside it (unpinned dependencies)
sway-parse/Cargo.toml
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 100.0%
- unpinned_manifests
- 27
Release downloadsok5 items
- release v0.72.1 ships forc-binaries-darwin_amd64.tar.gz (200 downloads)
- release v0.72.1 ships forc-binaries-darwin_arm64.tar.gz (285 downloads)
- release v0.72.1 ships forc-binaries-linux_amd64.tar.gz (13614 downloads)
- release v0.72.1 ships forc-binaries-linux_arm64.tar.gz (888 downloads)
- release v0.72.0 ships forc-binaries-darwin_amd64.tar.gz (14 downloads)
- binary_assets
- 36
- signals
- 1
- suspicious
- 0
Findings
144 high52 medium86 low16 info
298 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | zizmor/unpinned-uses |
.github/workflows/benchmark.yml:29 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmark.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmark.yml:31 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmark.yml:35 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmark.yml:45 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:100 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:103 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:117 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:119 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:122 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:122 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:133 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:135 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:138 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:138 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:147 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:149 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:152 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:152 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:161 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:163 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:166 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:166 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:175 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:177 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:180 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:180 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:189 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:191 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:194 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:194 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:206 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:209 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:226 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:228 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:231 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:231 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:249 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:278 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:280 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:283 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:283 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:297 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:299 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:302 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:302 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:313 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:315 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:319 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:319 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:328 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:330 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:341 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:343 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:354 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:356 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:360 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:360 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:379 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:381 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:385 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:385 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:404 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:406 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:410 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:410 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:452 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:454 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:457 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:457 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:466 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/github-app |
.github/workflows/ci.yml:472 | dangerous use of GitHub App tokens [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:472 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/github-app |
.github/workflows/ci.yml:477 | dangerous use of GitHub App tokens [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:480 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:488 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:497 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:499 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:502 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:502 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:529 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:531 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:534 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:534 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:573 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:575 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:58 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:580 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:580 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:584 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:601 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:603 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:607 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:607 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:61 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:631 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:650 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:653 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:66 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:66 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/ci.yml:660 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:663 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:695 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:698 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:703 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:709 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:727 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:730 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:742 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:78 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:788 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:798 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:798 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:81 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:818 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/ci.yml:86 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:86 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:865 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs.yml:10 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:102 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:116 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:124 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:132 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:151 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:160 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:168 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:176 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:195 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:215 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:26 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/gh-pages.yml:52 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:52 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gh-pages.yml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/nightly-cargo-audit.yml:11 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/nightly-cargo-audit.yml:12 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/spellcheck.yml:11 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/spellcheck.yml:14 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | osv/GHSA-4w2j-m93h-cj5j |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0185, GHSA-4w2j-m93h-cj5j | Dependencies (osv-scanner) |
| high | osv/GHSA-82j2-j2ch-gfr8 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0104, GHSA-82j2-j2ch-gfr8 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0194 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0194 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0195 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0195 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0340 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0340 | Dependencies (osv-scanner) |
| high | osv/RUSTSEC-2026-0344 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0344 | Dependencies (osv-scanner) |
| high | opengrep/dockerfile.security.missing-user |
deployment/Dockerfile:38 | By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile... | Static analysis (opengrep) |
| medium | opengrep/bash.lang.best-practice.useless-cat |
benchmark.sh:106 | Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. | Lint |
| medium | zizmor/archived-uses |
.github/workflows/ci.yml:209 | action or reusable workflow from archived repository [confidence high] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:572 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:726 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:787 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/archived-uses |
.github/workflows/ci.yml:865 | action or reusable workflow from archived repository [confidence high] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/docs.yml:9 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/archived-uses |
.github/workflows/nightly-cargo-audit.yml:12 | action or reusable workflow from archived repository [confidence high] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/nightly-cargo-audit.yml:8 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/spellcheck.yml:7 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | osv/GHSA-2mjx-qc3c-rqvc |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc | Dependencies (osv-scanner) |
| medium | osv/GHSA-7gcf-g7xr-8hxj |
Cargo.lock | [email protected] (crates.io) is affected by GHSA-7gcf-g7xr-8hxj | Dependencies (osv-scanner) |
| medium | osv/GHSA-c8m5-c952-6cm4 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-c8m5-c952-6cm4 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2023-0089 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2023-0089 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2023-0126 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2023-0126 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0320 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0320 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0370 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0370 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0388 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0388 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2024-0436 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2024-0436 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2025-0134 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0134 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2025-0141 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0141 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0173 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0173 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0183 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0183 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0184 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0184 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0190 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0190 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0204 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0204 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0205 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0205 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0220 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0220 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0235 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0235 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0247 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0247 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0248 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0248 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0249 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0249 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0251 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0251 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0255 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0255 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0258 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0258 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0258 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0258 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0338 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0338 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0339 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0339 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0342 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0342 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0381 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0381 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0382 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0382 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0382 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0382 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0383 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0383 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0386 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0386 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0387 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0387 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0418 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0418 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0441 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0441 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0486 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0486 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0523 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0523 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0524 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0524 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0538 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0538 | Dependencies (osv-scanner) |
| low | opengrep/bash.lang.correctness.unquoted-command-substitution-in-command |
.github/workflows/scripts/verify_tag.sh:17 | The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result. | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
.github/workflows/scripts/verify_tag.sh:17 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
.github/workflows/scripts/verify_tag.sh:69 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
benchmark.sh:37 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
benchmark.sh:51 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
benchmark.sh:85 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
benchmark.sh:86 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
benchmark.sh:93 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/bisect-forc/bisect-forc.sh:84 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/bisect-forc/bisect-forc.sh:87 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/bisect-forc/bisect-forc.sh:88 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/formatter/forc-fmt-check-panic.sh:13 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/formatter/forc-fmt-check-panic.sh:15 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/formatter/forc-fmt-check-panic.sh:19 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/highlightjs/build.sh:10 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/highlightjs/build.sh:22 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/highlightjs/build.sh:5 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/highlightjs/build.sh:9 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/prism/build.sh:10 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/prism/build.sh:11 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/prism/build.sh:12 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/prism/build.sh:21 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/prism/build.sh:6 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
sway-lib-std/generate.sh:141 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
sway-lib-std/generate.sh:17 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
sway-lib-std/generate.sh:19 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
sway-lib-std/generate.sh:206 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
sway-lib-std/generate.sh:21 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
sway-lib-std/generate.sh:6 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
sway-lib-std/generate.sh:68 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | zizmor/artipacked |
.github/workflows/benchmark.yml:29 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:117 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:133 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:147 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:161 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:175 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:189 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:205 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:226 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:278 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:297 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:313 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:328 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:341 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:354 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:379 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:404 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:452 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:464 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:478 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:497 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:529 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:57 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:601 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:649 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:694 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:77 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/ci.yml:856 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/template-injection |
.github/workflows/ci.yml:856 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:99 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/gh-pages.yml:26 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/nightly-cargo-audit.yml:11 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | opengrep/rust.lang.security.args |
.github/workflows/scripts/check-dep-versions/src/main.rs:27 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| low | zizmor/artipacked |
.github/workflows/spellcheck.yml:10 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | osv/GHSA-965h-392x-2mh5 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0098, GHSA-965h-392x-2mh5 | Dependencies (osv-scanner) |
| low | osv/GHSA-h2v8-394m-p7vv |
Cargo.lock | [email protected] (crates.io) is affected by GHSA-h2v8-394m-p7vv | Dependencies (osv-scanner) |
| low | osv/GHSA-h2v8-394m-p7vv |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv | Dependencies (osv-scanner) |
| low | osv/GHSA-j39j-6gw9-jw6h |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0008, GHSA-j39j-6gw9-jw6h | Dependencies (osv-scanner) |
| low | osv/GHSA-w44r-93j7-qv28 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28 | Dependencies (osv-scanner) |
| low | osv/GHSA-w44r-93j7-qv28 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28 | Dependencies (osv-scanner) |
| low | osv/GHSA-xgp8-3hg3-c2mh |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0099, GHSA-xgp8-3hg3-c2mh | Dependencies (osv-scanner) |
| low | osv/GHSA-xwfj-jgwm-7wp5 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0055, GHSA-xwfj-jgwm-7wp5 | Dependencies (osv-scanner) |
| low | opengrep/rust.lang.security.unsafe-usage |
forc-pkg/src/source/ipfs.rs:447 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
forc-pkg/src/source/ipfs.rs:450 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
forc-pkg/src/source/ipfs.rs:452 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.args |
forc-plugins/forc-tx/src/lib.rs:556 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
forc-test/src/ecal.rs:25 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
forc-test/src/ecal.rs:32 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.current-exe |
forc/src/cli/plugin.rs:27 | current_exe should not be used for security operations. From the docs: "The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5412 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5413 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5421 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5422 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
sway-core/src/transform/to_parsed_lang/convert_parse_tree.rs:5430 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.args |
sway-ir/src/bin/opt.rs:22 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.args |
sway-ir/src/optimize.rs:120 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:365 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:365 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:367 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:368 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:390 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:390 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:392 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:393 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:589 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:589 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:591 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:592 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/gh-pages.yml:189 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/gh-pages.yml:190 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/gh-pages.yml:210 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/gh-pages.yml:211 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 31 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 195 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 56 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 16 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | failed | — | 0 | gitleaks exited -9: |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 7dafb1c7ae52 | prov-5+qual-2+sec-2 | 0% | 66 | 43 |
Full text report
- Repository: https://github.com/FuelLabs/sway
- Commit:
7dafb1c7ae52ae8247e41e8e7b36a6f444b40b71 - Generated: 2026-11-14T15:53:35+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | explicit | 95% | 100% |
| Code quality | 66 | adequate | 90% | 100% |
| Security | 43 | poor | 70% | 86% |
AI provenance
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
- Explicitly attributed share (lower bound): 0.1%
- Unattributed share in AI-consistent velocity bursts: 6.3%
- Estimated AI-generated share: 0.1%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| GitHub Copilot coding agent | 1 | 68 |
| Claude Code | 1 | 51 |
| Cursor agent | 1 | 457 |
Current source lines last changed by AI-attributed commits: 383 of 217,599.
Too few lines in one group to compare finding densities.
- Stylometry index: 0.12 per 1,000 lines (narrated steps 26, placeholders 0, assistant phrasing 0, emoji 1). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-11 | 3,864 | 0% |
| 2025-12 | 952 | 0% |
| 2026-01 | 1,737 | 0% |
| 2026-02 | 1,003 | 0% |
| 2026-03 | 1,900 | 0% |
| 2026-04 | 3,990 | 0% |
| 2026-05 | 2,659 | 0% |
| 2026-06 | 3,240 | 0% |
| 2026-07 | 2,585 | 0% |
| 2026-08 | 3,543 | 1% |
| 2026-09 | 666 | 0% |
| 2026-10 | 950 | 48% |
Evidence
- Cursor agent: trailer 'Co-authored-by: Cursor' (102ab6cb0378)
- Claude Code: trailer 'Co-authored-by: Claude' (08dad8c58d6d)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (6bdfa0c10f58)
- 4,175 lines of first-party code in ~4.0h (1,044 lines/hour, 1 commit session) (830b6111d7b5)
- 4,134 lines of first-party code in ~4.0h (1,034 lines/hour, 1 commit session) (c1ef577b555a)
- 2,175 lines of first-party code in ~2.7h (817 lines/hour, PR #6437) (2f53e22f571b)
- 3,215 lines of first-party code in ~4.0h (804 lines/hour, 1 commit session) (7b1f8590b3d9)
- 3,051 lines of first-party code in ~4.0h (763 lines/hour, 1 commit session) (3a063c649b91)
- 2,140 lines of first-party code in ~2.9h (747 lines/hour, 2 commit session) (34e8e31d74ac)
- 2,976 lines of first-party code in ~4.0h (744 lines/hour, 1 commit session) (dff4d64e7a4f)
- 2,907 lines of first-party code in ~4.0h (727 lines/hour, 1 commit session) (1ea6e8b8c11c)
- 1,597 lines of first-party code in ~2.3h (697 lines/hour, PR #3757) (b44d8ba1a1fd)
- 2,594 lines of first-party code in ~4.0h (648 lines/hour, 1 commit session) (11e363ae2782)
- 2,582 lines of first-party code in ~4.0h (646 lines/hour, 1 commit session) (0a4ac5da5ef9)
- 2,352 lines of first-party code in ~4.0h (588 lines/hour, 1 commit session) (ff6f914e2848)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.12, CI runs tests; 37% of function code in complex or long functions; 10% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 33 |
| Duplication | 55 |
| Code smells (Opengrep) | 99 |
| Tests and CI | 81 |
| Documentation | 65 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 6,714; mean complexity 4.4, 90th percentile 9; 314 complex and 238 long functions
- Duplicated lines: 10.1% of 158,123 compared
- Tests: 25,618 test lines for 217,599 source lines (ratio 0.12); CI test commands: go test, cargo test; 40% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- span in sway-error/src/error.rs: complexity 222, 236 lines
- format in swayfmt/src/utils/language/expr/mod.rs: complexity 219, 565 lines
- to_diagnostic in sway-error/src/error.rs: complexity 211, 1894 lines
- parse_opcode in sway-core/src/asm_lang/mod.rs: complexity 198, 421 lines
- visit_expr in forc-plugins/forc-migrate/src/visiting/mod.rs: complexity 159, 704 lines
Security
Security posture is poor: 56 known vulnerabilities in 37 dependencies; 1 high-severity SAST findings; 137 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | n/a |
| Static analysis (Opengrep) | 99 |
| Vulnerable dependencies (OSV) | 12 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 56 in 37 packages (critical 0, high 6, medium 4, low 8)
-
Posture checks passed: security policy, signed commits; missing: dependency updates, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
deployment/Dockerfile:38 |
| high | osv/RUSTSEC-2026-0194: [email protected] (crates.io) is affected by RUSTSEC-2026-0194 |
Cargo.lock |
| high | osv/RUSTSEC-2026-0195: [email protected] (crates.io) is affected by RUSTSEC-2026-0195 |
Cargo.lock |
| high | osv/GHSA-4w2j-m93h-cj5j: [email protected] (crates.io) is affected by RUSTSEC-2026-0185, GHSA-4w2j-m93h-cj5j |
Cargo.lock |
| high | osv/RUSTSEC-2026-0340: [email protected] (crates.io) is affected by RUSTSEC-2026-0340 |
Cargo.lock |
| high | osv/GHSA-82j2-j2ch-gfr8: [email protected] (crates.io) is affected by RUSTSEC-2026-0104, GHSA-82j2-j2ch-gfr8 |
Cargo.lock |
| high | osv/RUSTSEC-2026-0344: [email protected] (crates.io) is affected by RUSTSEC-2026-0344 |
Cargo.lock |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:29 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:30 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:31 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:35 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:45 |
| high | zizmor/template-injection: code injection via template expansion [confidence high] |
.github/workflows/ci.yml:660 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:58 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:61 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:66 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:78 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:81 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:86 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:100 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:103 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:117 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:119 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:122 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:133 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.72.1 ships forc-binaries-darwin_amd64.tar.gz (200 downloads)
- binary-release-asset: release v0.72.1 ships forc-binaries-darwin_arm64.tar.gz (285 downloads)
- binary-release-asset: release v0.72.1 ships forc-binaries-linux_amd64.tar.gz (13614 downloads)
- binary-release-asset: release v0.72.1 ships forc-binaries-linux_arm64.tar.gz (888 downloads)
- binary-release-asset: release v0.72.0 ships forc-binaries-darwin_amd64.tar.gz (14 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 217,599; test lines: 25,618
| Language | Lines |
|---|---|
| Rust | 239,323 |
| Shell | 3,583 |
| JavaScript | 311 |
Coverage gaps
sec-secrets: gitleaks exited -9: