Leaderboard github.com
Homebrew/brew
🍺 The Package Manager for Everywhere
AI provenance
1%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
87/100
strong
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
82/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
1% explicit
Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals.
How the score is built
- Explicitly attributed share1%
- Unattributed share in AI-pace bursts5%
- Estimated AI-generated share1%
- AI tool configuration files5
- Work sessions at AI pace17
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.08
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 90 | 4,617 | 2025-08-05 | 2026-10-17 |
| GitHub Copilot coding agent | 140 | 4,030 | 2025-04-22 | 2026-11-11 |
| OpenAI Codex | 4 | 305 | 2026-01-25 | 2026-10-22 |
| Cursor agent | 1 | 54 | 2026-09-28 | 2026-09-28 |
Lines added per month all AI-attributed share
- 2012-1211 · 0% AI
- 2013-0123 · 0% AI
- 2013-03442 · 0% AI
- 2013-0515 · 0% AI
- 2013-06188 · 0% AI
- 2013-07591 · 0% AI
- 2013-081,526 · 0% AI
- 2013-091,689 · 0% AI
- 2013-102,171 · 0% AI
- 2013-11629 · 0% AI
- 2013-121,217 · 0% AI
- 2014-01331 · 0% AI
- 2014-02844 · 0% AI
- 2014-032,160 · 0% AI
- 2014-041,177 · 0% AI
- 2014-05818 · 0% AI
- 2014-062,113 · 0% AI
- 2014-071,574 · 0% AI
- 2014-081,002 · 0% AI
- 2014-092,286 · 0% AI
- 2014-101,035 · 0% AI
- 2014-11581 · 0% AI
- 2014-121,549 · 0% AI
- 2015-01670 · 0% AI
- 2015-02943 · 0% AI
- 2015-03606 · 0% AI
- 2015-041,250 · 0% AI
- 2015-051,202 · 0% AI
- 2015-061,393 · 0% AI
- 2015-071,049 · 0% AI
- 2015-085,570 · 0% AI
- 2015-091,591 · 0% AI
- 2015-10731 · 0% AI
- 2015-11699 · 0% AI
- 2015-122,164 · 0% AI
- 2016-014,889 · 0% AI
- 2016-02985 · 0% AI
- 2016-03996 · 0% AI
- 2016-044,255 · 0% AI
- 2016-051,811 · 0% AI
- 2016-061,752 · 0% AI
- 2016-073,684 · 0% AI
- 2016-0818,060 · 0% AI
- 2016-0913,785 · 0% AI
- 2016-103,710 · 0% AI
- 2016-111,491 · 0% AI
- 2016-121,839 · 0% AI
- 2017-011,790 · 0% AI
- 2017-0217,008 · 0% AI
- 2017-033,586 · 0% AI
- 2017-043,040 · 0% AI
- 2017-053,838 · 0% AI
- 2017-062,077 · 0% AI
- 2017-072,834 · 0% AI
- 2017-084,713 · 0% AI
- 2017-09907 · 0% AI
- 2017-104,197 · 0% AI
- 2017-111,343 · 0% AI
- 2017-121,210 · 0% AI
- 2018-011,253 · 0% AI
- 2018-021,540 · 0% AI
- 2018-032,465 · 0% AI
- 2018-042,784 · 0% AI
- 2018-051,852 · 0% AI
- 2018-062,820 · 0% AI
- 2018-076,009 · 0% AI
- 2018-085,135 · 0% AI
- 2018-094,727 · 0% AI
- 2018-104,519 · 0% AI
- 2018-112,102 · 0% AI
- 2018-12328 · 0% AI
- 2019-012,206 · 0% AI
- 2019-021,677 · 0% AI
- 2019-031,679 · 0% AI
- 2019-043,197 · 0% AI
- 2019-05795 · 0% AI
- 2019-06204 · 0% AI
- 2019-07613 · 0% AI
- 2019-08940 · 0% AI
- 2019-09791 · 0% AI
- 2019-101,485 · 0% AI
- 2019-111,005 · 0% AI
- 2019-12519 · 0% AI
- 2020-01587 · 0% AI
- 2020-02716 · 0% AI
- 2020-031,759 · 0% AI
- 2020-043,918 · 0% AI
- 2020-051,532 · 0% AI
- 2020-065,282 · 0% AI
- 2020-077,648 · 0% AI
- 2020-0811,382 · 0% AI
- 2020-094,790 · 0% AI
- 2020-104,809 · 0% AI
- 2020-117,466 · 0% AI
- 2020-127,400 · 0% AI
- 2021-0114,935 · 0% AI
- 2021-024,822 · 0% AI
- 2021-034,556 · 0% AI
- 2021-044,206 · 0% AI
- 2021-052,335 · 0% AI
- 2021-061,695 · 0% AI
- 2021-072,905 · 0% AI
- 2021-082,373 · 0% AI
- 2021-092,771 · 0% AI
- 2021-101,725 · 0% AI
- 2021-111,679 · 0% AI
- 2021-12871 · 0% AI
- 2022-01971 · 0% AI
- 2022-02575 · 0% AI
- 2022-03736 · 0% AI
- 2022-04481 · 0% AI
- 2022-051,690 · 0% AI
- 2022-063,065 · 0% AI
- 2022-073,902 · 0% AI
- 2022-084,855 · 0% AI
- 2022-092,235 · 0% AI
- 2022-10985 · 0% AI
- 2022-111,286 · 0% AI
- 2022-121,352 · 0% AI
- 2023-011,789 · 0% AI
- 2023-026,357 · 0% AI
- 2023-037,471 · 0% AI
- 2023-049,301 · 0% AI
- 2023-054,261 · 0% AI
- 2023-061,716 · 0% AI
- 2023-072,156 · 0% AI
- 2023-081,270 · 0% AI
- 2023-091,589 · 0% AI
- 2023-10774 · 0% AI
- 2023-111,499 · 0% AI
- 2023-122,479 · 0% AI
- 2024-013,990 · 0% AI
- 2024-025,194 · 0% AI
- 2024-0315,568 · 0% AI
- 2024-047,920 · 0% AI
- 2024-052,136 · 0% AI
- 2024-062,699 · 0% AI
- 2024-075,127 · 0% AI
- 2024-082,735 · 0% AI
- 2024-094,820 · 0% AI
- 2024-101,726 · 0% AI
- 2024-111,811 · 0% AI
- 2024-121,407 · 0% AI
- 2025-011,709 · 0% AI
- 2025-027,830 · 0% AI
- 2025-0311,597 · 0% AI
- 2025-043,162 · 0% AI
- 2025-051,150 · 0% AI
- 2025-066,285 · 0% AI
- 2025-073,526 · 1% AI
- 2025-087,310 · 11% AI
- 2025-097,375 · 5% AI
- 2025-102,929 · 33% AI
- 2025-116,488 · 2% AI
- 2025-125,321 · 0% AI
- 2026-014,821 · 3% AI
- 2026-0211,469 · 6% AI
- 2026-0320,182 · 4% AI
- 2026-0414,048 · 9% AI
- 2026-0539,967 · 0% AI
- 2026-0623,102 · 4% AI
- 2026-0740,556 · 3% AI
- 2026-0826,972 · 0% AI
- 2026-0942,245 · 0% AI
- 2026-1022,592 · 3% AI
- 2026-1119,355 · 5% AI
Findings in AI-attributed lines vs the rest
From git blame: 2,793 lines trace to AI-attributed commits, 171,003 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.04 | 0.00× |
| Security | 0.00 | 0.36 | 0.00× |
Evidence by analyzer
Explicit AI attributionok29 items
- GitHub Copilot coding agent: 140 attributed commits, 4,030 lines added
- Claude Code: 90 attributed commits, 4,617 lines added
- OpenAI Codex: 4 attributed commits, 305 lines added
- Cursor agent: 1 attributed commits, 54 lines added
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- OpenAI Codex: on merged branch (6071b1f1bb)
- Claude Code: on merged branch (3264f71d24)
- Claude Code: on merged branch (3264f71d24)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- Cursor agent: trailer 'Co-authored-by: Cursor'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- Claude Code: trailer 'Co-Authored-By: Claude'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- Claude Code: message 'claude.ai/code'
- Claude Code: on merged branch (64a9bfcf4d)
- Claude Code: on merged branch (64a9bfcf4d)
- Claude Code: on merged branch (64a9bfcf4d)
- Claude Code: message 'claude.ai/code'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'
- Claude Code: message 'claude.ai/code'
- Claude Code: message 'claude.ai/code'
- attributed_commit_share
- 0.7%
- attributed_commits
- 235
- attributed_loc
- 9,006
- attributed_loc_share
- 1.2%
- commits
- 33,915
- effective_loc
- 746,366
- tools_detected
- 4
AI tool configurationok5 items
- .claude/settings.json (claude-code configuration)
- CLAUDE.md (claude-code configuration)
- AGENTS.md (generic-agent configuration)
- docs/AGENTS.md (generic-agent configuration)
- .cursor/hooks.json (cursor configuration)
- artifacts
- 5
- earliest_adoption
- 2025-09-24
- tools_configured
- 3
- workflow_agents
- 0
Commit velocityok15 items
- 2,032 lines of first-party code in ~1.7h (1,181 lines/hour, 4 commit session)
- 1,133 lines of first-party code in ~1.0h (1,110 lines/hour, 1 commit session)
- 1,732 lines of first-party code in ~1.6h (1,075 lines/hour, 3 commit session)
- 3,846 lines of first-party code in ~4.0h (962 lines/hour, 1 commit session)
- 1,626 lines of first-party code in ~1.7h (955 lines/hour, 1 commit session)
- 2,353 lines of first-party code in ~2.5h (949 lines/hour, 16 commit session)
- 3,786 lines of first-party code in ~4.0h (946 lines/hour, 2 commit session)
- 2,422 lines of first-party code in ~2.9h (829 lines/hour, 1 commit session)
- 2,966 lines of first-party code in ~4.0h (736 lines/hour, 2 commit session)
- 2,633 lines of first-party code in ~4.0h (658 lines/hour, 1 commit session)
- 2,603 lines of first-party code in ~4.0h (651 lines/hour, 1 commit session)
- 1,125 lines of first-party code in ~1.8h (621 lines/hour, 3 commit session)
- 2,164 lines of first-party code in ~3.5h (612 lines/hour, 3 commit session)
- 1,070 lines of first-party code in ~1.9h (553 lines/hour, 6 commit session)
- 1,387 lines of first-party code in ~2.7h (521 lines/hour, 1 commit session)
- excluded_import_loc
- 35,550
- flagged_loc
- 35,157
- flagged_loc_share
- 4.9%
- flagged_units
- 17
- max_loc_per_hour
- 2,359.42
- measured_loc
- 710,816
- median_loc_per_hour
- 55.50
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 9,073
- pre_ai_era_bursts
- 4
- pre_ai_era_measured_loc
- 264,565
- work_units
- 16,165
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 2,721.70
- releases
- 99
Coding styleok8 items
- step-by-step narration comment: # Step 1: Sort by formula full name while putting tap formulae behind core formulae.
- step-by-step narration comment: # Step 2: Sort by formula dependency topology.
- assistant-style phrasing left in code: ohai "Ignoring workflow #{workflow} as requested by `--ignore-missing-artifacts`"
- step-by-step narration comment: # First, check that we won't encounter an error in the middle of uploading bottles.
- step-by-step narration comment: # Next, upload the bottles after checking them all.
- assistant-style phrasing left in code: # Even if we don't install this formula, mark it as requested when appropriate.
- step-by-step narration comment: # First, attempt to resolve the keg to a formula
- assistant-style phrasing left in code: # Commands to install missing dependencies without marking them as requested.
- count:assistant_voice
- 4
- count:emoji_in_code
- 3
- count:narrated_steps
- 5
- count:placeholder
- 0
- files:assistant_voice
- 4
- files:emoji_in_code
- 3
- files:narrated_steps
- 3
- files:placeholder
- 0
- index
- 0.08
- lines_scanned
- 173,796
- per_kloc:assistant_voice
- 0.02
- per_kloc:emoji_in_code
- 0.02
- per_kloc:narrated_steps
- 0.03
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 2,793
- blame_failures
- 0
- files_blamed
- 1,093
- other_lines
- 171,003
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 7
- quality:other_per_kloc
- 0.04
- quality:ratio
- 0
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 62
- security:other_per_kloc
- 0.36
- security:ratio
- 0
Code quality
87 strong
Code quality is strong: test-to-source ratio 1.04, CI runs tests; 14% of function code in complex or long functions; 4% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity65
- Duplication78
- Lint and smells100
- Tests and CI100
- Documentation100
- Type safety40
- Review process100
Evidence by analyzer
Complexity (lizard)ok10 items
- run_install_step in Library/Homebrew/install_steps.rb: complexity 82, 208 lines
- audit_deps in Library/Homebrew/formula_auditor.rb: complexity 73, 192 lines
- self.resource_version in Library/Homebrew/livecheck/livecheck.rb: complexity 71, 169 lines
- self.installed_dependent_names in Library/Homebrew/cmd/info.rb: complexity 65, 244 lines
- self.fetch_json_api_file in Library/Homebrew/api.rb: complexity 55, 133 lines
- audit_specs in Library/Homebrew/formula_auditor.rb: complexity 52, 119 lines
- run in Library/Homebrew/cmd/install.rb: complexity 49, 297 lines
- self.load_other_tap_strategies in Library/Homebrew/livecheck/livecheck.rb: complexity 49, 158 lines
- audit_signing in Library/Homebrew/cask/audit.rb: complexity 45, 84 lines
- query in Library/Homebrew/utils/analytics/influx.rb: complexity 43, 128 lines
- complex_functions
- 148
- function_nloc
- 87,057
- functions
- 7,889
- long_functions
- 36
- many_param_functions
- 74
- mean_ccn
- 3.18
- p90_ccn
- 7
- risky_nloc_share
- 14.5%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: Library/Homebrew/analytics/subcommand/off.rb:1 and Library/Homebrew/analytics/subcommand/on.rb:1
- 6+ duplicated lines: Library/Homebrew/api/cask.rb:21 and Library/Homebrew/api/formula.rb:119
- 6+ duplicated lines: Library/Homebrew/api/cask_struct.rb:47 and Library/Homebrew/api/formula_struct.rb:77
- 6+ duplicated lines: Library/Homebrew/bottle.rb:133 and Library/Homebrew/retryable_download.rb:52
- 6+ duplicated lines: Library/Homebrew/build.rb:101 and Library/Homebrew/build.rb:114
- 6+ duplicated lines: Library/Homebrew/bundle/brew.rb:69 and Library/Homebrew/bundle/cask.rb:38
- 6+ duplicated lines: Library/Homebrew/bundle/brew.rb:524 and Library/Homebrew/bundle/package_type.rb:151
- 6+ duplicated lines: Library/Homebrew/bundle/checker.rb:57 and Library/Homebrew/bundle/checker.rb:68
- 6+ duplicated lines: Library/Homebrew/bundle/extensions/cargo.rb:128 and Library/Homebrew/bundle/extensions/uv.rb:331
- 6+ duplicated lines: Library/Homebrew/bundle/extensions/cargo.rb:274 and Library/Homebrew/bundle/extensions/flatpak.rb:219
- compared_lines
- 122,944
- duplicated_lines
- 5,090
- duplicated_share
- 4.1%
- files
- 1,093
Lintok
- category:correctness
- 7
- findings
- 7
- scanned_lines
- 173,796
- weighted_findings
- 1.75
Tests and CIok12 items
- CI config: .github/workflows/actionlint.yml
.github/workflows/actionlint.yml - CI config: .github/workflows/approve-stale-lead-maintainer-prs.yml
.github/workflows/approve-stale-lead-maintainer-prs.yml - CI config: .github/workflows/autogenerated-files.yml
.github/workflows/autogenerated-files.yml - CI config: .github/workflows/check-issues.yml
.github/workflows/check-issues.yml - CI config: .github/workflows/check-prs.yml
.github/workflows/check-prs.yml - CI config: .github/workflows/codeql-analysis.yml
.github/workflows/codeql-analysis.yml - CI config: .github/workflows/commit-style.yml
.github/workflows/commit-style.yml - CI config: .github/workflows/copilot-setup-steps.yml
.github/workflows/copilot-setup-steps.yml - CI config: .github/workflows/docker.yml
.github/workflows/docker.yml - CI config: .github/workflows/docs.yml
.github/workflows/docs.yml - CI runs tests (rspec, rake test)
- CI runs linters (shellcheck)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 24
- cochange_commits
- 232
- cochange_share
- 85.3%
- source_lines
- 173,796
- test_lines
- 179,980
- test_ratio
- 1.04
Documentationok4 items
- README.md
README.md - LICENSE.txt
LICENSE.txt - CONTRIBUTING.md
CONTRIBUTING.md - CHANGELOG.md
CHANGELOG.md
- check:changelog
- yes
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 74
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 0
- escapes_per_kloc
- 0
Security
82 adequate
Security posture is adequate: 35 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: scorecard.
How the score is built
- Secrets82
- Static analysis (SAST)92
- Vulnerable dependencies100
- CI workflows60
- Security posture100
- OpenSSF Scorecard41
Evidence by analyzer
OpenSSF Scorecardok14 items
- Scorecard Code-Review: 10/10 (all changesets reviewed)
- Scorecard Maintained: 10/10 (30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10)
- Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)
- Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)
- Scorecard Token-Permissions: 0/10 (detected GitHub workflow tokens with excessive permissions)
- Scorecard Binary-Artifacts: 0/10 (binaries present in source code)
- Scorecard Fuzzing: 0/10 (project is not fuzzed)
- Scorecard License: 10/10 (license file detected)
- Scorecard Pinned-Dependencies: 9/10 (dependency not pinned by hash detected -- score normalized to 9)
- Scorecard Signed-Releases: 0/10 (Project has not signed or included provenance with any releases.)
- Scorecard Security-Policy: 10/10 (security policy file detected)
- Scorecard Branch-Protection: 4/10 (branch protection is not maximal on development and all release branches)
- Scorecard SAST: 10/10 (SAST tool is run on all commits)
- Scorecard Packaging: 10/10 (packaging workflow detected)
- aggregate
- 5.90
- check:Binary-Artifacts
- no
- check:Branch-Protection
- yes
- check:CII-Best-Practices
- no
- check:Code-Review
- yes
- check:Dangerous-Workflow
- yes
- check:Fuzzing
- no
- check:License
- yes
- check:Maintained
- yes
- check:Packaging
- yes
- check:Pinned-Dependencies
- yes
- check:SAST
- yes
- check:Security-Policy
- yes
- check:Signed-Releases
- no
- check:Token-Permissions
- no
Package registriesok
- checked
- 1
- declared
- 1
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 5
- secrets_nonprod
- 1
Static analysis (opengrep)ok
- findings
- 64
- findings_high
- 35
- findings_low
- 0
- findings_medium
- 29
- parse_errors
- 10
- scanned_lines
- 173,796
- weighted_findings
- 40.15
Dependencies (osv-scanner)ok
- penalty
- 0
- vulnerabilities
- 0
- vulnerable_packages
- 0
- vulns_critical
- 0
- vulns_high
- 0
- vulns_low
- 0
- vulns_medium
- 0
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 3
- findings_high
- 3
- findings_low
- 0
- findings_medium
- 0
- penalty
- 31.20
- workflows
- 24
Security postureok2 items
- Security policy: https://github.com/Homebrew/brew/security/policy
https://github.com/Homebrew/brew/security/policy - Dependency updates: .github/dependabot.yml
.github/dependabot.yml
- check:dependency_updates
- yes
- check:lockfiles
- yes
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 50.5%
- unpinned_manifests
- 0
Release downloadsok5 items
- release 7.0.13 ships Homebrew.pkg (28259 downloads)
- release 7.0.12 ships Homebrew.pkg (33809 downloads)
- release 7.0.11 ships Homebrew.pkg (33844 downloads)
- release 7.0.10 ships Homebrew.pkg (33414 downloads)
- release 7.0.9 ships Homebrew.pkg (50571 downloads)
- binary_assets
- 10
- signals
- 1
- suspicious
- 0
Findings
38 high29 medium13 low
80 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
.github/scripts/approve_stale_lead_maintainer_prs.rb:42 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | zizmor/dangerous-triggers |
.github/workflows/stale-issues-and-prs.yml:13 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-images |
.github/workflows/tests.yml:449 | unpinned image references [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-images |
.github/workflows/tests.yml:449 | unpinned image references [confidence high] | CI workflows (zizmor) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/bundle/extensions/winget.rb:14 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/cask_dependent.rb:9 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/cli/parser.rb:32 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/cmd/info.rb:27 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/cmd/upgrade.rb:20 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/cmd/upgrade.rb:28 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/cmd/uses.rb:18 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/compilers/compiler_selector.rb:8 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/debrew.rb:35 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/dev-cmd/advisory-match.rb:1305 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/dev-cmd/advisory-match.rb:1325 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/dev-cmd/advisory-match.rb:681 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/dev-cmd/benchmark.rb:30 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/dev-cmd/benchmark.rb:36 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/dev-cmd/bump.rb:37 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/dev-cmd/bump.rb:45 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/os/linux/elf.rb:211 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/rubocops/extend/formula_cop.rb:22 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/rubocops/shared/install_steps_helper.rb:149 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/utils/analytics/formula_feeds.rb:10 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/utils/analytics/formula_history.rb:13 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/utils/analytics/formula_history.rb:20 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/utils/analytics/formula_history.rb:28 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/utils/analytics/formula_history.rb:38 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/utils/analytics/formula_history.rb:45 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/utils/analytics/influx.rb:15 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/version.rb:103 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/vulns/advisory_overrides.rb:16 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/vulns/advisory_overrides.rb:21 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/vulns/history.rb:20 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/vulns/match.rb:131 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/vulns/match.rb:48 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/vulns/match.rb:97 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible |
Library/Homebrew/vulns/vulnerability.rb:16 | Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
.github/scripts/approve_stale_lead_maintainer_prs.rb:561 | Detected non-static command inside Open3.capture3. Audit the input to 'Open3.capture3'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/bundle.rb:33 | Detected non-static command inside IO.popen. Audit the input to 'IO.popen'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/bundle/extensions/winget.rb:522 | Detected non-static command inside IO.popen. Audit the input to 'IO.popen'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/cmd/log.rb:84 | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.manual-template-creation |
Library/Homebrew/completions.rb:326 | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.manual-template-creation |
Library/Homebrew/completions.rb:508 | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.manual-template-creation |
Library/Homebrew/completions.rb:667 | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead,... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.manual-template-creation |
Library/Homebrew/dev-cmd/bottle.rb:162 | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead,... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/dev-cmd/bump-cask-pr.rb:561 | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/dev-cmd/bump-cask-pr.rb:582 | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/dev-cmd/bump-cask-pr.rb:611 | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/dev-cmd/bump-formula-pr.rb:1006 | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/dev-cmd/bump-formula-pr.rb:1009 | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/dev-cmd/bump.rb:630 | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.manual-template-creation |
Library/Homebrew/extend/os/mac/sandbox.rb:183 | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead,... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/formula_assertions.rb:55 | Detected non-static command inside IO.popen. Audit the input to 'IO.popen'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.manual-template-creation |
Library/Homebrew/formula_creator.rb:158 | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead,... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.weak-hashes-md5 |
Library/Homebrew/formulary.rb:885 | Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead.... | Static analysis (opengrep) |
| medium | opengrep/ruby.rails.security.audit.xss.manual-template-creation |
Library/Homebrew/manpages.rb:66 | Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead,... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/mcp_server.rb:409 | Detected non-static command inside Open3.popen2e. Audit the input to 'Open3.popen2e'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| medium | opengrep/bash.lang.security.ifs-tampering |
Library/Homebrew/shims/linux/super/bin/make:7 | The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS... | Static analysis (opengrep) |
| medium | opengrep/bash.lang.security.ifs-tampering |
Library/Homebrew/shims/mac/super/bin/xcrun:57 | The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS... | Static analysis (opengrep) |
| medium | opengrep/bash.lang.security.ifs-tampering |
Library/Homebrew/shims/mac/super/bin/xcrun:71 | The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/system_command.rb:550 | Detected non-static command inside Process.spawn. Audit the input to 'Process.spawn'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/system_command.rb:558 | Detected non-static command inside exec. Audit the input to 'exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/test_bot/test_cleanup.rb:21 | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/test_bot/test_formulae.rb:246 | Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/utils/analytics.rb:83 | Detected non-static command inside spawn. Audit the input to 'spawn'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.... | Static analysis (opengrep) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
Library/Homebrew/utils/shell.rb:69 | Detected non-static command inside Process.spawn. Audit the input to 'Process.spawn'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
Library/Homebrew/cask/utils/rmdir.sh:30 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
Library/Homebrew/cask/utils/rmdir.sh:36 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
Library/Homebrew/cask/utils/rmdir.sh:40 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
Library/Homebrew/cmd/update.sh:609 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
Library/Homebrew/cmd/update.sh:625 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
Library/Homebrew/cmd/update.sh:670 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
Library/Homebrew/utils/as_user.sh:83 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | gitleaks/generic-api-key |
.github/workflows/tests.yml:163 | Possible generic-api-key secret in history (commit 623840a304); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
Library/Homebrew/data/spdx.json:578 | Possible generic-api-key secret in history (commit bc28ee0f6d); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
Library/Homebrew/data/spdx/spdx_licenses.json:785 | Possible generic-api-key secret in history (commit 02a55fd792); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
Library/Homebrew/dev-cmd/spdx.json:229 | Possible generic-api-key secret in history (commit 803f9dd4a3); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
Library/Homebrew/utils/analytics.rb:14 | Possible generic-api-key secret in history (commit 372365e0f9); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
docs/_layouts/base.html:3 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 7 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 3 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 64 | |
| OpenSSF Scorecard | Security | ok | scorecard v5.6.0 | 0 | |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 6 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 097e0b595755 | prov-5+qual-2+sec-2 | 1% | 87 | 82 |
Full text report
- Repository: https://github.com/Homebrew/brew
- Commit:
097e0b5957555b85dc4194eef06218a2aeab851f - Generated: 2026-11-14T15:50:51+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 1 | explicit | 95% | 100% |
| Code quality | 87 | strong | 90% | 100% |
| Security | 82 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 1% of first-party code added; an estimated 1% including velocity signals.
- Explicitly attributed share (lower bound): 1.2%
- Unattributed share in AI-consistent velocity bursts: 4.7%
- Estimated AI-generated share: 1.2%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| GitHub Copilot coding agent | 140 | 4,030 |
| Claude Code | 90 | 4,617 |
| OpenAI Codex | 4 | 305 |
| Cursor agent | 1 | 54 |
- AI tooling configured in repo: claude-code, cursor, generic-agent
Current source lines last changed by AI-attributed commits: 2,793 of 173,796.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.041 | 0.0x |
| Security | 0.0 | 0.363 | 0.0x |
- Stylometry index: 0.08 per 1,000 lines (narrated steps 5, placeholders 0, assistant phrasing 4, emoji 3). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 5,321 | 0% |
| 2026-01 | 4,821 | 3% |
| 2026-02 | 11,469 | 6% |
| 2026-03 | 20,182 | 4% |
| 2026-04 | 14,048 | 9% |
| 2026-05 | 39,967 | 0% |
| 2026-06 | 23,102 | 4% |
| 2026-07 | 40,556 | 3% |
| 2026-08 | 26,972 | 0% |
| 2026-09 | 42,245 | 0% |
| 2026-10 | 22,592 | 3% |
| 2026-11 | 19,355 | 5% |
Evidence
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (237a47e76168)
- OpenAI Codex: on merged branch (6071b1f1bb) (783b9e5eef19)
- Claude Code: on merged branch (3264f71d24) (c0854395c8e2)
- Claude Code: on merged branch (3264f71d24) (f4402a51a774)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (ccdf5e593b0d)
- Cursor agent: trailer 'Co-authored-by: Cursor' (867ebd864948)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (7d714cd81ae8)
- Claude Code: trailer 'Co-Authored-By: Claude' (beb9bf27fe5a)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (590816c8e056)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (b41be7915c9a)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (c9907afe9956)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (d5f86b0818d5)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (80bf383a67b5)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (9fe057afacc7)
- GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot' (4e35c7c03a76)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 1.04, CI runs tests; 14% of function code in complex or long functions; 4% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 65 |
| Duplication | 78 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 100 |
| Documentation | 100 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | 100 |
- Functions: 7,889; mean complexity 3.2, 90th percentile 7; 148 complex and 36 long functions
- Duplicated lines: 4.1% of 122,944 compared
- Tests: 179,980 test lines for 173,796 source lines (ratio 1.04); CI test commands: rspec, rake test; 85% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- run_install_step in Library/Homebrew/install_steps.rb: complexity 82, 208 lines
- audit_deps in Library/Homebrew/formula_auditor.rb: complexity 73, 192 lines
- self.resource_version in Library/Homebrew/livecheck/livecheck.rb: complexity 71, 169 lines
- self.installed_dependent_names in Library/Homebrew/cmd/info.rb: complexity 65, 244 lines
- self.fetch_json_api_file in Library/Homebrew/api.rb: complexity 55, 133 lines
Security
Security posture is adequate: 35 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: scorecard.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 82 |
| Static analysis (Opengrep) | 92 |
| Vulnerable dependencies (OSV) | 100 |
| CI workflows (zizmor) | 60 |
| Posture (policy, updates, signing, lockfiles) | 100 |
| OpenSSF Scorecard | 41 |
- Posture checks passed: security policy, dependency updates, signed commits, lockfiles; missing: none
- OpenSSF Scorecard aggregate: 5.9/10 (published 2026-11-09)
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
.github/scripts/approve_stale_lead_maintainer_prs.rb:42 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/bundle/extensions/winget.rb:14 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/cask_dependent.rb:9 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/cli/parser.rb:32 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/cmd/info.rb:27 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/cmd/upgrade.rb:20 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/cmd/upgrade.rb:28 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/cmd/uses.rb:18 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/compilers/compiler_selector.rb:8 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/debrew.rb:35 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/dev-cmd/advisory-match.rb:681 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/dev-cmd/advisory-match.rb:1305 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/dev-cmd/advisory-match.rb:1325 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/dev-cmd/benchmark.rb:30 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/dev-cmd/benchmark.rb:36 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/dev-cmd/bump.rb:37 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/dev-cmd/bump.rb:45 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/os/linux/elf.rb:211 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/rubocops/extend/formula_cop.rb:22 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/rubocops/shared/install_steps_helper.rb:149 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/utils/analytics/formula_feeds.rb:10 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/utils/analytics/formula_history.rb:13 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/utils/analytics/formula_history.rb:20 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/utils/analytics/formula_history.rb:28 |
| high | opengrep/ruby.lang.security.model-attributes-attr-accessible: Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low] |
Library/Homebrew/utils/analytics/formula_history.rb:38 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release 7.0.13 ships Homebrew.pkg (28259 downloads)
- binary-release-asset: release 7.0.12 ships Homebrew.pkg (33809 downloads)
- binary-release-asset: release 7.0.11 ships Homebrew.pkg (33844 downloads)
- binary-release-asset: release 7.0.10 ships Homebrew.pkg (33414 downloads)
- binary-release-asset: release 7.0.9 ships Homebrew.pkg (50571 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 173,796; test lines: 179,980
| Language | Lines |
|---|---|
| Ruby | 347,213 |
| Shell | 6,465 |
| Python | 43 |
| C# | 34 |
| Objective-C | 21 |