Leaderboard github.com
JetBrains/compose-multiplatform
Compose Multiplatform, a modern UI framework for Kotlin that makes building performant and beautiful user interfaces easy and enjoyable.
AI provenance
<1%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
68/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
61/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% explicit
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts1%
- Estimated AI-generated share0%
- AI tool configuration files0
- Work sessions at AI pace3
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.25
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| OpenAI Codex | 2 | 699 | 2026-09-16 | 2026-11-10 |
| Claude Code | 1 | 141 | 2026-06-04 | 2026-06-04 |
Lines added per month all AI-attributed share
- 2020-096,179 · 0% AI
- 2020-106,268 · 0% AI
- 2020-111,795 · 0% AI
- 2020-124,121 · 0% AI
- 2021-011,446 · 0% AI
- 2021-023,523 · 0% AI
- 2021-031,518 · 0% AI
- 2021-041,402 · 0% AI
- 2021-0514,761 · 0% AI
- 2021-0613,277 · 0% AI
- 2021-0713,113 · 0% AI
- 2021-085,627 · 0% AI
- 2021-09871 · 0% AI
- 2021-103,663 · 0% AI
- 2021-113,755 · 0% AI
- 2021-122,043 · 0% AI
- 2022-014,399 · 0% AI
- 2022-022,480 · 0% AI
- 2022-031,904 · 0% AI
- 2022-041,389 · 0% AI
- 2022-05278 · 0% AI
- 2022-06143 · 0% AI
- 2022-07752 · 0% AI
- 2022-086 · 0% AI
- 2022-091,952 · 0% AI
- 2022-101,449 · 0% AI
- 2022-119,374 · 0% AI
- 2022-125,321 · 0% AI
- 2023-011,965 · 0% AI
- 2023-023,596 · 0% AI
- 2023-036,355 · 0% AI
- 2023-043,875 · 0% AI
- 2023-053,273 · 0% AI
- 2023-0666 · 0% AI
- 2023-071,528 · 0% AI
- 2023-082,524 · 0% AI
- 2023-092,008 · 0% AI
- 2023-10911 · 0% AI
- 2023-112,097 · 0% AI
- 2023-122,210 · 0% AI
- 2024-011,823 · 0% AI
- 2024-021,104,319 · 0% AI
- 2024-03256,562 · 0% AI
- 2024-044,054 · 0% AI
- 2024-0510,789 · 0% AI
- 2024-06681 · 0% AI
- 2024-072,018 · 0% AI
- 2024-08785 · 0% AI
- 2024-09745 · 0% AI
- 2024-10341 · 0% AI
- 2024-11659 · 0% AI
- 2024-121,433 · 0% AI
- 2025-014,144 · 0% AI
- 2025-02472 · 0% AI
- 2025-03889 · 0% AI
- 2025-042,010 · 0% AI
- 2025-0519,960 · 0% AI
- 2025-06417 · 0% AI
- 2025-071,404 · 0% AI
- 2025-081,880 · 0% AI
- 2025-09163 · 0% AI
- 2025-101,931 · 0% AI
- 2025-11684 · 0% AI
- 2025-12264 · 0% AI
- 2026-01290 · 0% AI
- 2026-02794 · 0% AI
- 2026-032,568 · 0% AI
- 2026-04408 · 0% AI
- 2026-05900 · 0% AI
- 2026-061,745 · 8% AI
- 2026-073,700 · 0% AI
- 2026-0841,303 · 0% AI
- 2026-0943,377 · 0% AI
- 2026-1020,862 · 0% AI
- 2026-11656 · 83% AI
Findings in AI-attributed lines vs the rest
From git blame: 512 lines trace to AI-attributed commits, 164,629 to others (sampled). Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.15 | 0.00× |
| Security | 0.00 | 0.12 | 0.00× |
Evidence by analyzer
Explicit AI attributionok5 items
- OpenAI Codex: 2 attributed commits, 699 lines added
- Claude Code: 1 attributed commits, 141 lines added
- OpenAI Codex: trailer 'Co-authored-by: Codex'
- OpenAI Codex: trailer 'Co-authored-by: Codex'
- Claude Code: trailer 'Co-authored-by: Claude'
- attributed_commit_share
- 0.1%
- attributed_commits
- 3
- attributed_loc
- 840
- attributed_loc_share
- 0.1%
- commits
- 2,804
- effective_loc
- 1,678,247
- tools_detected
- 2
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok3 items
- 2,121 lines of first-party code in ~1.6h (1,354 lines/hour, PR #5781)
- 3,680 lines of first-party code in ~4.8h (763 lines/hour, PR #2500)
- 2,974 lines of first-party code in ~4.0h (744 lines/hour, 1 commit session)
- excluded_import_loc
- 1,450,688
- flagged_loc
- 8,775
- flagged_loc_share
- 3.9%
- flagged_units
- 3
- max_loc_per_hour
- 2,451.01
- measured_loc
- 227,559
- median_loc_per_hour
- 14.74
- pr_timed_units
- 1,148
- pre_ai_era_burst_loc
- 3,824
- pre_ai_era_bursts
- 2
- pre_ai_era_measured_loc
- 38,705
- work_units
- 1,609
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 5,753
- releases
- 99
Coding styleok2 items
- step-by-step narration comment: // now we can remove the root of the composition.
- placeholder or demo-only phrasing: "You might need to replace currentOs with these explicit dependencies:\n" +
- count:assistant_voice
- 0
- count:emoji_in_code
- 78
- count:narrated_steps
- 1
- count:placeholder
- 1
- files:assistant_voice
- 0
- files:emoji_in_code
- 29
- files:narrated_steps
- 1
- files:placeholder
- 1
- index
- 0.25
- lines_scanned
- 169,381
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.46
- per_kloc:narrated_steps
- 0.01
- per_kloc:placeholder
- 0.01
Findings in AI-written linesok
- ai_lines
- 512
- blame_failures
- 0
- files_blamed
- 1,500
- other_lines
- 164,629
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 25
- quality:other_per_kloc
- 0.15
- quality:ratio
- 0
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 19
- security:other_per_kloc
- 0.12
- security:ratio
- 0
Code quality
68 adequate
Code quality is adequate: test-to-source ratio 0.23, no CI test run detected; 6% of function code in complex or long functions; 32% duplicated lines. Weakest area: duplication.
How the score is built
- Complexity84
- Duplication14
- Lint and smells99
- Tests and CI56
- Documentation100
- Type safetynot measured
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- FormApp in html/eap/benchmarks/src/commonMain/kotlin/benchmarks/compose/FormApp.kt: complexity 31, 103 lines
- (anonymous) in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt: complexity 26, 37 lines
- parseArgs in benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/Config.kt: complexity 24, 73 lines
- (anonymous) in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt: complexity 24, 71 lines
- formatBinary32 in html/eap/core/src/jvmMain/kotlin/org/jetbrains/compose/web/css/CSSNumberFormatting.jvm.kt: complexity 23, 49 lines
- foldExpression in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/ConstantEvaluator.kt: complexity 22, 41 lines
- BenchmarkRunner in benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/Benchmarks.kt: complexity 21, 140 lines
- fromString in html/core/src/jsMain/kotlin/org/jetbrains/compose/web/attributes/PredefinedAttrValues.kt: complexity 21, 25 lines
- fromString in html/eap/core/src/commonMain/kotlin/org/jetbrains/compose/web/attributes/PredefinedAttrValues.kt: complexity 21, 25 lines
- encodeChildren in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/HtmlAnalysis.kt: complexity 20, 56 lines
- complex_functions
- 19
- function_nloc
- 73,468
- functions
- 7,417
- long_functions
- 23
- many_param_functions
- 43
- mean_ccn
- 1.48
- p90_ccn
- 2
- risky_nloc_share
- 6.0%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/build.gradle.kts:16 and benchmarks/multiplatform/build.gradle.kts:18
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/androidMain/kotlin/MeasureComposable.android.kt:14 and benchmarks/multiplatform/benchmarks/src/skikoMain/kotlin/MeasureComposable.skiko.kt:53
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/androidMain/kotlin/MeasureComposable.android.kt:15 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/MeasureComposable.kt:14
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/appleMain/kotlin/GraphicsContext.apple.kt:43 and benchmarks/multiplatform/benchmarks/src/desktopMain/kotlin/GraphicsContext.desktop.kt:33
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/canvasdrawing/CanvasDrawing.kt:46 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/heavyshader/HeavyShader.kt:45
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/components/MultiLevelCell.kt:116 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/components/MultiLevelCell.kt:139
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/models/FollowItem.kt:4 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/models/HotItem.kt:4
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt:4 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/MultipleComponents.kt:4
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt:231 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt:253
- 6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/MultipleComponents.kt:2 and components/ui-tooling-preview/library/src/androidMain/kotlin/org/jetbrains/compose/ui/tooling/preview/PreviewParameter.android.kt:2
- compared_lines
- 100,685
- duplicated_lines
- 32,357
- duplicated_share
- 32.1%
- files
- 1,554
Lintok
- category:best-practice
- 3
- category:correctness
- 26
- findings
- 29
- scanned_lines
- 169,381
- weighted_findings
- 9.50
Tests and CIok7 items
- CI config: .github/workflows/benchmarks-smoke.yml
.github/workflows/benchmarks-smoke.yml - CI config: .github/workflows/check-release-notes.yml
.github/workflows/check-release-notes.yml - CI config: .github/workflows/ci-build-helpers.yml
.github/workflows/ci-build-helpers.yml - CI config: .github/workflows/compose-html-eap.yml
.github/workflows/compose-html-eap.yml - CI config: .github/workflows/examples.yml
.github/workflows/examples.yml - CI config: .github/workflows/gradle-plugin.yml
.github/workflows/gradle-plugin.yml - CI config: .github/workflows/kotlinx-browser-common-subset.yml
.github/workflows/kotlinx-browser-common-subset.yml
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 7
- cochange_commits
- 193
- cochange_share
- 24.3%
- source_lines
- 169,381
- test_lines
- 38,840
- test_ratio
- 0.23
Documentationok4 items
- README.md
README.md - LICENSE.txt
LICENSE.txt - CONTRIBUTING.md
CONTRIBUTING.md - CHANGELOG.md
CHANGELOG.md
- check:changelog
- yes
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 58
Type safetyskipped
Security
61 weak
Security posture is weak: 29 known vulnerabilities in 13 dependencies; 30 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets97
- Static analysis (SAST)98
- Vulnerable dependencies26
- CI workflows0
- Security posture60
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesskipped
no registry dependencies declared
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 1
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 24
- findings_high
- 0
- findings_low
- 1
- findings_medium
- 23
- parse_errors
- 24
- scanned_lines
- 169,381
- weighted_findings
- 7.91
Dependencies (osv-scanner)ok
- penalty
- 82
- vulnerabilities
- 29
- vulnerable_packages
- 13
- vulns_critical
- 0
- vulns_high
- 14
- vulns_low
- 4
- vulns_medium
- 11
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 63
- findings_high
- 30
- findings_low
- 6
- findings_medium
- 27
- penalty
- 415.20
- workflows
- 7
Security postureok1 item
- Security policy: SECURITY.md
SECURITY.md
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- yes
- check:signed_commits
- yes
- signed_commit_share
- 100.0%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
44 high64 medium38 low
146 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | zizmor/unpinned-uses |
.github/actions/setup-prerequisites/action.yml:14 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/actions/setup-prerequisites/action.yml:19 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/actions/setup-prerequisites/action.yml:6 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/actions/setup-xcode/action.yml:17 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/actions/setup-xcode/action.yml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmarks-smoke.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmarks-smoke.yml:19 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmarks-smoke.yml:32 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmarks-smoke.yml:33 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmarks-smoke.yml:46 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/benchmarks-smoke.yml:47 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/check-release-notes.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci-build-helpers.yml:19 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci-build-helpers.yml:22 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/compose-html-eap.yml:34 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/compose-html-eap.yml:37 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/compose-html-eap.yml:45 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/examples.yml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/examples.yml:36 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/examples.yml:49 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/examples.yml:62 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gradle-plugin.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gradle-plugin.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gradle-plugin.yml:51 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/gradle-plugin.yml:70 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/kotlinx-browser-common-subset.yml:22 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/kotlinx-browser-common-subset.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/kotlinx-browser-common-subset.yml:33 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | osv/GHSA-2883-xcg3-v3hh |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-5c6j-r48x-rmvq |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-5c6j-r48x-rmvq; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| high | osv/GHSA-27r3-jxmh-p828 |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 | Dependencies (osv-scanner) |
| high | osv/GHSA-2gc4-cqfq-p2gv |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-2gc4-cqfq-p2gv | Dependencies (osv-scanner) |
| high | osv/GHSA-58mr-gqgx-xq4g |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-58mr-gqgx-xq4g | Dependencies (osv-scanner) |
| high | osv/GHSA-68fv-2mgg-jv7q |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-8r9p-f939-6h3c |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-8r9p-f939-6h3c | Dependencies (osv-scanner) |
| high | osv/GHSA-mrwp-f3q8-3g9p |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-mrwp-f3q8-3g9p | Dependencies (osv-scanner) |
| high | osv/GHSA-q3jh-wrc6-jgq8 |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-q3jh-wrc6-jgq8 | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-qw65-cvwx-89v3 |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 | Dependencies (osv-scanner) |
| high | zizmor/unpinned-uses |
tools/changelog/check-release-notes-github-action/action.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
tools/changelog/check-release-notes-github-action/action.yml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
html/test-utils/conf/karma-kotlin-runner-decorator/karma-kotlin-reporter-decorated.js:12 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
html/test-utils/conf/karma-kotlin-runner-decorator/karma-kotlin-reporter-decorated.js:8 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | opengrep/javascript.lang.best-practice.lazy-load-module |
html/test-utils/conf/karma-kotlin-runner-decorator/karma-kotlin-reporter-decorated.js:9 | Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The... | Lint |
| medium | zizmor/excessive-permissions |
.github/workflows/benchmarks-smoke.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/benchmarks-smoke.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/benchmarks-smoke.yml:18 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/benchmarks-smoke.yml:29 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/benchmarks-smoke.yml:32 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/benchmarks-smoke.yml:43 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/benchmarks-smoke.yml:46 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/check-release-notes.yml:13 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/check-release-notes.yml:16 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci-build-helpers.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci-build-helpers.yml:18 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/compose-html-eap.yml:30 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/compose-html-eap.yml:33 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/examples.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/examples.yml:19 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/examples.yml:22 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/examples.yml:32 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/examples.yml:35 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/examples.yml:45 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/examples.yml:48 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/examples.yml:58 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/examples.yml:61 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/gradle-plugin.yml:15 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/gradle-plugin.yml:24 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/kotlinx-browser-common-subset.yml:18 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/kotlinx-browser-common-subset.yml:21 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/java.android.security.exported_activity |
benchmarks/multiplatform/benchmarks/androidApp/src/main/AndroidManifest.xml:8 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
benchmarks/showcases/LazyGridImageView/composeApp/src/androidMain/AndroidManifest.xml:11 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
benchmarks/showcases/LazyGridImageView/nativeAndroidApp/app/src/main/AndroidManifest.xml:15 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
ci/templates/multiplatform-template/android/src/main/AndroidManifest.xml:11 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
components/resources/demo/androidApp/src/main/AndroidManifest.xml:9 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:14 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:15 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:22 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:25 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:26 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:27 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:28 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:29 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:30 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:31 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:32 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:33 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:35 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:36 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal |
components/resources/library/karma.config.d/config.js:42 | Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to... | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.use-of-md5 |
gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/internal/files/fileUtils.kt:31 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
gradle-plugins/preview-rpc/src/main/kotlin/org/jetbrains/compose/desktop/ui/tooling/preview/rpc/utils.kt:22 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | opengrep/kotlin.lang.security.unencrypted-socket |
gradle-plugins/preview-rpc/src/main/kotlin/org/jetbrains/compose/desktop/ui/tooling/preview/rpc/utils.kt:35 | This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low] | Static analysis (opengrep) |
| medium | osv/GHSA-3g3m-2fjr-6pw4 |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-3g3m-2fjr-6pw4; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-g3hv-75wg-m249 |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-g3hv-75wg-m249; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-qj8w-gfj5-8c6v |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-qj8w-gfj5-8c6v; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| medium | osv/GHSA-4mjr-xmp4-gh2g |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-4mjr-xmp4-gh2g | Dependencies (osv-scanner) |
| medium | osv/GHSA-6pq8-jhm2-2vcw |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-6pq8-jhm2-2vcw | Dependencies (osv-scanner) |
| medium | osv/GHSA-hrr3-gc8f-f4qj |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-hrr3-gc8f-f4qj | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-w74x-v6f9-j3xg |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-w74x-v6f9-j3xg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wjr9-j795-jxcr |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-wjr9-j795-jxcr | Dependencies (osv-scanner) |
| medium | osv/GHSA-x5fp-wj9c-mxmx |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-x5fp-wj9c-mxmx | Dependencies (osv-scanner) |
| medium | zizmor/artipacked |
tools/changelog/check-release-notes-github-action/action.yml:16 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
benchmarks/showcases/LazyGridImageView/download_images.sh:15 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
benchmarks/showcases/LazyGridImageView/download_images.sh:40 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
benchmarks/showcases/LazyGridImageView/download_images.sh:43 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
compose/scripts/validateProjects.sh:16 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
compose/scripts/validateProjects.sh:17 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replaceVersionInExamples.sh:41 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replaceVersionInExamples.sh:42 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replaceVersionInExamples.sh:43 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replaceVersionInLibs.sh:40 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replaceVersionInLibs.sh:41 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replaceVersionInLibs.sh:42 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:11 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:16 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:17 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:18 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:19 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:20 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:21 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:22 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:23 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:24 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:25 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:26 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:27 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/replace_version_common.sh:28 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
tools/upload_package_from_prebuilts.sh:43 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | zizmor/self-repository |
.github/workflows/check-release-notes.yml:19 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/examples.yml:26 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/examples.yml:39 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/examples.yml:52 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/examples.yml:65 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/examples.yml:68 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | opengrep/javascript.lang.security.audit.unsafe-formatstring |
benchmarks/multiplatform/benchmarks/src/webMain/resources/polyfills.mjs:89 | Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.... | Static analysis (opengrep) |
| low | osv/GHSA-73rr-hh4g-fpgx |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-73rr-hh4g-fpgx; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| low | osv/GHSA-m5mm-p8h7-m29v |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-m5mm-p8h7-m29v; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | Dependencies (osv-scanner) |
| low | osv/GHSA-333x-w4r6-6crp |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-333x-w4r6-6crp | Dependencies (osv-scanner) |
| low | osv/GHSA-xhq7-xmqj-769h |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock | [email protected] (npm) is affected by GHSA-xhq7-xmqj-769h | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
private/src/main/kotlin/androidx/build/FtlRunner.kt:126 | Possible generic-api-key secret in history (commit b7cdad725c); removed from the current tree but still retrievable | Secrets (gitleaks) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 29 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 63 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 29 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | skipped | — | 0 | no registry dependencies declared |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 24 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 1 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 8431de3fdab6 | prov-5+qual-2+sec-2 | 0% | 68 | 61 |
Full text report
- Repository: https://github.com/JetBrains/compose-multiplatform
- Commit:
8431de3fdab6251ce5a0d7ab07303f5c85b13827 - Generated: 2026-11-14T15:57:42+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | explicit | 95% | 100% |
| Code quality | 68 | adequate | 90% | 100% |
| Security | 61 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals.
- Explicitly attributed share (lower bound): 0.1%
- Unattributed share in AI-consistent velocity bursts: 0.5%
- Estimated AI-generated share: 0.1%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 2 | 699 |
| Claude Code | 1 | 141 |
Current source lines last changed by AI-attributed commits: 512 of 165,141 (sampled).
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.152 | 0.0x |
| Security | 0.0 | 0.115 | 0.0x |
- Stylometry index: 0.25 per 1,000 lines (narrated steps 1, placeholders 1, assistant phrasing 0, emoji 78). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 264 | 0% |
| 2026-01 | 290 | 0% |
| 2026-02 | 794 | 0% |
| 2026-03 | 2,568 | 0% |
| 2026-04 | 408 | 0% |
| 2026-05 | 900 | 0% |
| 2026-06 | 1,745 | 8% |
| 2026-07 | 3,700 | 0% |
| 2026-08 | 41,303 | 0% |
| 2026-09 | 43,377 | 0% |
| 2026-10 | 20,862 | 0% |
| 2026-11 | 656 | 83% |
Evidence
- OpenAI Codex: trailer 'Co-authored-by: Codex' (8431de3fdab6)
- OpenAI Codex: trailer 'Co-authored-by: Codex' (7a793b012376)
- Claude Code: trailer 'Co-authored-by: Claude' (8ebd34efd881)
- 2,121 lines of first-party code in ~1.6h (1,354 lines/hour, PR #5781) (57dffdc7a7f4)
- 3,680 lines of first-party code in ~4.8h (763 lines/hour, PR #2500) (e8786ea73fbd)
- 2,974 lines of first-party code in ~4.0h (744 lines/hour, 1 commit session) (6fa567032e56)
- step-by-step narration comment: // now we can remove the root of the composition. (examples/htm)
- placeholder or demo-only phrasing: "You might need to replace currentOs with these explicit dependencies:\n" + (gradle-plugi)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.23, no CI test run detected; 6% of function code in complex or long functions; 32% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 84 |
| Duplication | 14 |
| Code smells (Opengrep) | 99 |
| Tests and CI | 56 |
| Documentation | 100 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 7,417; mean complexity 1.5, 90th percentile 2; 19 complex and 23 long functions
- Duplicated lines: 32.1% of 100,685 compared
- Tests: 38,840 test lines for 169,381 source lines (ratio 0.23); CI test commands: none detected; 24% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- FormApp in html/eap/benchmarks/src/commonMain/kotlin/benchmarks/compose/FormApp.kt: complexity 31, 103 lines
- (anonymous) in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt: complexity 26, 37 lines
- parseArgs in benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/Config.kt: complexity 24, 73 lines
- (anonymous) in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt: complexity 24, 71 lines
- formatBinary32 in html/eap/core/src/jvmMain/kotlin/org/jetbrains/compose/web/css/CSSNumberFormatting.jvm.kt: complexity 23, 49 lines
Security
Security posture is weak: 29 known vulnerabilities in 13 dependencies; 30 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 98 |
| Vulnerable dependencies (OSV) | 26 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 29 in 13 packages (critical 0, high 14, medium 11, low 4)
-
Posture checks passed: security policy, signed commits, lockfiles; missing: dependency updates
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock |
| high | osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock |
| high | osv/GHSA-2883-xcg3-v3hh: [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock |
| high | osv/GHSA-5c6j-r48x-rmvq: [email protected] (npm) is affected by GHSA-5c6j-r48x-rmvq; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock |
| high | osv/GHSA-27r3-jxmh-p828: [email protected] (npm) is affected by GHSA-27r3-jxmh-p828 |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | osv/GHSA-2gc4-cqfq-p2gv: [email protected] (npm) is affected by GHSA-2gc4-cqfq-p2gv |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | osv/GHSA-58mr-gqgx-xq4g: [email protected] (npm) is affected by GHSA-58mr-gqgx-xq4g |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | osv/GHSA-qw65-cvwx-89v3: [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3 |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | osv/GHSA-8r9p-f939-6h3c: [email protected] (npm) is affected by GHSA-8r9p-f939-6h3c |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | osv/GHSA-mrwp-f3q8-3g9p: [email protected] (npm) is affected by GHSA-mrwp-f3q8-3g9p |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | osv/GHSA-q3jh-wrc6-jgq8: [email protected] (npm) is affected by GHSA-q3jh-wrc6-jgq8 |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | osv/GHSA-68fv-2mgg-jv7q: [email protected] (npm) is affected by GHSA-68fv-2mgg-jv7q |
html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/actions/setup-prerequisites/action.yml:6 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/actions/setup-prerequisites/action.yml:14 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/actions/setup-prerequisites/action.yml:19 |
| high | zizmor/template-injection: code injection via template expansion [confidence high] |
.github/actions/setup-xcode/action.yml:17 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/actions/setup-xcode/action.yml:21 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmarks-smoke.yml:18 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmarks-smoke.yml:19 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmarks-smoke.yml:32 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmarks-smoke.yml:33 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmarks-smoke.yml:46 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmarks-smoke.yml:47 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 169,381; test lines: 38,840
| Language | Lines |
|---|---|
| Kotlin | 206,035 |
| Swift | 1,015 |
| Shell | 783 |
| JavaScript | 343 |
| Java | 45 |