Leaderboard github.com

Intervention/image

PHP Image Processing

View repository ↗
PHP
★ 14,389
commit 7f7da6117ed0
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

possible

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

83/100

strong

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

68/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% possible

Weak signals consistent with AI-assisted development.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts7%
Estimated AI-generated share0%
AI tool configuration files1
Work sessions at AI pace4
Releases at AI pace0
Coding-style index (1.0+ means possible)0.00

Lines added per month all AI-attributed share

2013-01735 · 0% AI
2013-021,095 · 0% AI
2013-031,701 · 0% AI
2013-04419 · 0% AI
2013-0597 · 0% AI
2013-060 · 0% AI
2013-0894 · 0% AI
2013-09537 · 0% AI
2013-11289 · 0% AI
2013-12133 · 0% AI
2014-0121 · 0% AI
2014-02161 · 0% AI
2014-031,685 · 0% AI
2014-04183 · 0% AI
2014-0514,529 · 0% AI
2014-06340 · 0% AI
2014-07634 · 0% AI
2014-08542 · 0% AI
2014-09267 · 0% AI
2014-10183 · 0% AI
2014-11184 · 0% AI
2014-12187 · 0% AI
2015-01310 · 0% AI
2015-026 · 0% AI
2015-0310 · 0% AI
2015-0477 · 0% AI
2015-055 · 0% AI
2015-06192 · 0% AI
2015-0785 · 0% AI
2015-0842 · 0% AI
2015-102 · 0% AI
2015-11104 · 0% AI
2015-120 · 0% AI
2016-0162 · 0% AI
2016-025 · 0% AI
2016-0419 · 0% AI
2016-060 · 0% AI
2016-073 · 0% AI
2016-085 · 0% AI
2016-0913 · 0% AI
2016-1052 · 0% AI
2017-01228 · 0% AI
2017-0214 · 0% AI
2017-032 · 0% AI
2017-0421 · 0% AI
2017-057 · 0% AI
2017-0626 · 0% AI
2017-07163 · 0% AI
2017-09539 · 0% AI
2017-1056 · 0% AI
2017-111 · 0% AI
2017-121 · 0% AI
2018-011 · 0% AI
2018-0322 · 0% AI
2018-04208 · 0% AI
2018-061 · 0% AI
2018-09221 · 0% AI
2018-101 · 0% AI
2018-1125 · 0% AI
2018-121 · 0% AI
2019-0126 · 0% AI
2019-031 · 0% AI
2019-05312 · 0% AI
2019-0627 · 0% AI
2019-097 · 0% AI
2019-100 · 0% AI
2019-1163 · 0% AI
2020-043 · 0% AI
2020-071 · 0% AI
2020-092 · 0% AI
2020-11100 · 0% AI
2020-121 · 0% AI
2021-041 · 0% AI
2021-051 · 0% AI
2021-061 · 0% AI
2021-07110 · 0% AI
2021-089 · 0% AI
2021-0928 · 0% AI
2021-104,423 · 0% AI
2021-112,267 · 0% AI
2021-123,779 · 0% AI
2022-0111 · 0% AI
2022-02337 · 0% AI
2022-0341 · 0% AI
2022-043 · 0% AI
2022-05607 · 0% AI
2022-061,894 · 0% AI
2022-072,626 · 0% AI
2022-08370 · 0% AI
2023-061 · 0% AI
2023-09657 · 0% AI
2023-108,357 · 0% AI
2023-118,999 · 0% AI
2023-124,968 · 0% AI
2024-016,838 · 0% AI
2024-022,267 · 0% AI
2024-033,112 · 0% AI
2024-041,716 · 0% AI
2024-051,888 · 0% AI
2024-061,819 · 0% AI
2024-0755 · 0% AI
2024-081,187 · 0% AI
2024-0945 · 0% AI
2024-10576 · 0% AI
2024-111,346 · 0% AI
2024-121,254 · 0% AI
2025-01861 · 0% AI
2025-02318 · 0% AI
2025-03192 · 0% AI
2025-0465 · 0% AI
2025-05176 · 0% AI
2025-061,080 · 0% AI
2025-07144 · 0% AI
2025-081,202 · 0% AI
2025-09755 · 0% AI
2025-10874 · 0% AI
2025-11356 · 0% AI
2025-1210,216 · 0% AI
2026-016,107 · 0% AI
2026-0210,996 · 0% AI
2026-032,636 · 0% AI
2026-041,928 · 0% AI
2026-051,935 · 0% AI
2026-06477 · 0% AI
2026-07211 · 0% AI
2026-083,595 · 0% AI
2026-09427 · 0% AI
2026-102,815 · 0% AI
2026-114 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 2,239
effective_loc: 136,052
tools_detected: 0

AI tool configurationok1 item

AGENTS.md (generic-agent configuration)

artifacts: 1
earliest_adoption: 2026-02-26
tools_configured: 1
workflow_agents: 0

Commit velocityok4 items

excluded_import_loc: 12,445
flagged_loc: 9,148
flagged_loc_share: 7.4%
flagged_units: 4
max_loc_per_hour: 1,244.35
measured_loc: 123,607
median_loc_per_hour: 62.50
pr_timed_units: 95
pre_ai_era_burst_loc: 3,354
pre_ai_era_bursts: 2
pre_ai_era_measured_loc: 19,285
work_units: 984

Release velocityok

flagged_releases: 0
max_loc_per_day: 2,904
releases: 99

Coding styleok

count:assistant_voice: 0
count:emoji_in_code: 0
count:narrated_steps: 0
count:placeholder: 0
files:assistant_voice: 0
files:emoji_in_code: 0
files:narrated_steps: 0
files:placeholder: 0
index: 0
lines_scanned: 30,052
per_kloc:assistant_voice: 0
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0
per_kloc:placeholder: 0

Code quality

83 strong

Code quality is strong: test-to-source ratio 0.90, CI runs tests; 1% of function code in complex or long functions; 13% duplicated lines. Weakest area: duplication.

How the score is built

Complexity96
Duplication46
Lint and smells100
Tests and CI100
Documentation80
Type safetynot measured
Review process50

Evidence by analyzer

Complexity (lizard)ok2 items

complex_functions: 1
function_nloc: 11,991
functions: 1,234
long_functions: 1
many_param_functions: 0
mean_ccn: 2.13
p90_ccn: 4
risky_nloc_share: 1.4%

Duplication (jscpd)ok10 items

compared_lines: 14,256
duplicated_lines: 1,820
duplicated_share: 12.8%
files: 404

Lintok

findings: 0
scanned_lines: 30,052
weighted_findings: 0

Tests and CIok3 items

CI config: .github/workflows/run-tests.yml .github/workflows/run-tests.yml
CI runs tests (phpunit)
CI runs linters (phpstan)

check:ci_present: yes
check:ci_runs_lint: yes
check:ci_runs_tests: yes
check:has_tests: yes
check:test_ratio: yes
check:tests_cochange: yes
ci_files: 1
cochange_commits: 234
cochange_share: 38.0%
source_lines: 30,052
test_lines: 26,997
test_ratio: 0.90

Documentationok3 items

readme.md readme.md
LICENSE LICENSE
CONTRIBUTING.md CONTRIBUTING.md

check:changelog: no
check:contributing: yes
check:license: yes
check:readme: yes
readme_lines: 60

Type safetyskipped

Security

68 weak

Security posture is weak: 2 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: posture.

How the score is built

Secrets100
Static analysis (SAST)97
Vulnerable dependenciesnot measured
CI workflows37
Security posture20
OpenSSF Scorecard25

Evidence by analyzer

OpenSSF Scorecardok9 items

aggregate: 3.50
check:Binary-Artifacts: yes
check:Branch-Protection: no
check:CII-Best-Practices: no
check:Code-Review: no
check:Fuzzing: no
check:License: yes
check:Maintained: yes
check:SAST: no
check:Security-Policy: no

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 0
secrets_low_confidence: 0
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 2
findings_high: 2
findings_low: 0
findings_medium: 0
parse_errors: 0
scanned_lines: 30,052
weighted_findings: 2.55

Dependencies (osv-scanner)skipped

CI workflows (zizmor)ok

findings: 5
findings_high: 5
findings_low: 0
findings_medium: 0
penalty: 60
workflows: 1

Security postureok1 item

composer.json has no lockfile alongside it (unpinned dependencies) composer.json

check:dependency_updates: no
check:lockfiles: no
check:security_policy: no
check:signed_commits: yes
signed_commit_share: 95.5%
unpinned_manifests: 1

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

7 high

Severity	Rule	Location	Message	Tool
high	`zizmor/unpinned-uses`	.github/workflows/run-tests.yml:22	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/run-tests.yml:27	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/run-tests.yml:41	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/run-tests.yml:49	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`zizmor/unpinned-uses`	.github/workflows/run-tests.yml:85	unpinned action reference [confidence high]	CI workflows (zizmor)
high	`opengrep/dockerfile.security.missing-user-entrypoint`	Dockerfile:53	By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile...	Static analysis (opengrep)
high	`opengrep/php.lang.security.weak-crypto`	src/Traits/CanHashColor.php:22	Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	Static analysis (opengrep)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	0
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	skipped	`—`	0
CI workflows (zizmor)	Security	ok	`zizmor 1.32.0`	5
Dependencies (osv-scanner)	Security	skipped	`—`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	2
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	0

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`7f7da6117ed0`	`prov-5+qual-2+sec-2`	0%	83	68

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Intervention/image/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Intervention/image/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Intervention/image/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Intervention/image/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Intervention/image/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Intervention/image/)

Full text report

Repository: https://github.com/Intervention/image
Commit: 7f7da6117ed0866df4489dc92a564f2ab9e559ce
Generated: 2026-11-14T15:54:03+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	65%	100%
Code quality	83	strong	90%	100%
Security	68	weak	85%	100%

AI provenance

Weak signals consistent with AI-assisted development.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 6.7%
Estimated AI-generated share: 0.0%
AI tooling configured in repo: generic-agent

Month	Lines added	Attributed to AI
2025-12	10,216	0%
2026-01	6,107	0%
2026-02	10,996	0%
2026-03	2,636	0%
2026-04	1,928	0%
2026-05	1,935	0%
2026-06	477	0%
2026-07	211	0%
2026-08	3,595	0%
2026-09	427	0%
2026-10	2,815	0%
2026-11	4	0%

Evidence

AGENTS.md (generic-agent configuration) (AGENTS.md)
1,792 lines of first-party code in ~1.8h (1,010 lines/hour, 1 commit session) (216d2ebdc101)
3,039 lines of first-party code in ~4.6h (654 lines/hour, 3 commit session) (0cf62e5f1d5f)
2,265 lines of first-party code in ~4.0h (566 lines/hour, 1 commit session) (228189b82edc)
2,052 lines of first-party code in ~4.0h (513 lines/hour, 1 commit session) (293c4efc8431)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is strong: test-to-source ratio 0.90, CI runs tests; 1% of function code in complex or long functions; 13% duplicated lines. Weakest area: duplication.

Area	Score
Complexity (lizard)	96
Duplication	46
Code smells (Opengrep)	100
Tests and CI	100
Documentation	80
Type safety	n/a
Process (Scorecard review/maintenance)	50

Functions: 1,234; mean complexity 2.1, 90th percentile 4; 1 complex and 1 long functions
Duplicated lines: 12.8% of 14,256 compared
Tests: 26,997 test lines for 30,052 source lines (ratio 0.90); CI test commands: phpunit; 38% of recent source commits also change tests
Docs missing or thin: changelog

Most complex functions:

Security

Security posture is weak: 2 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	97
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	37
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	25

Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles
OpenSSF Scorecard aggregate: 3.5/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
high	`opengrep/dockerfile.security.missing-user-entrypoint`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	Dockerfile:53
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	src/Traits/CanHashColor.php:22
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/run-tests.yml:22
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/run-tests.yml:27
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/run-tests.yml:41
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/run-tests.yml:49
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/run-tests.yml:85

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 30,052; test lines: 26,997

Language	Lines
PHP	57,043
Shell	6