Leaderboard github.com
JingMatrix/Vector
Modern Xposed Framework
AI provenance
<1%
possible
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
60/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
72/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% possible
Weak signals consistent with AI-assisted development. 2 commit(s) carry explicit AI attribution, too few to characterize the codebase.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts3%
- Estimated AI-generated share0%
- AI tool configuration files0
- Work sessions at AI pace3
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.05
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| OpenAI Codex | 1 | 383 | 2026-07-15 | 2026-07-15 |
| Claude Code | 1 | 315 | 2026-07-25 | 2026-07-25 |
Lines added per month all AI-attributed share
- 2014-0117 · 0% AI
- 2019-01134,065 · 0% AI
- 2019-022,055 · 0% AI
- 2019-039,690 · 0% AI
- 2019-041,586 · 0% AI
- 2019-058,025 · 0% AI
- 2019-062,923 · 0% AI
- 2019-070 · 0% AI
- 2019-0916 · 0% AI
- 2019-1038 · 0% AI
- 2019-1172 · 0% AI
- 2019-1237 · 0% AI
- 2020-01758 · 0% AI
- 2020-0210,666 · 0% AI
- 2020-032,615 · 0% AI
- 2020-041,030 · 0% AI
- 2020-0517 · 0% AI
- 2020-0671 · 0% AI
- 2020-07143 · 0% AI
- 2020-08343 · 0% AI
- 2020-0912 · 0% AI
- 2020-10277 · 0% AI
- 2020-113,967 · 0% AI
- 2020-1213,640 · 0% AI
- 2021-0142,096 · 0% AI
- 2021-0217,628 · 0% AI
- 2021-034,212 · 0% AI
- 2021-044,567 · 0% AI
- 2021-053,996 · 0% AI
- 2021-061,044 · 0% AI
- 2021-07814 · 0% AI
- 2021-083,965 · 0% AI
- 2021-093,061 · 0% AI
- 2021-102,779 · 0% AI
- 2021-115,375 · 0% AI
- 2021-121,053 · 0% AI
- 2022-011,254 · 0% AI
- 2022-022,065 · 0% AI
- 2022-031,812 · 0% AI
- 2022-041,947 · 0% AI
- 2022-05282 · 0% AI
- 2022-06103 · 0% AI
- 2022-0729 · 0% AI
- 2022-0823 · 0% AI
- 2022-0939 · 0% AI
- 2022-10366 · 0% AI
- 2022-11157 · 0% AI
- 2022-122,573 · 0% AI
- 2023-015,604 · 0% AI
- 2023-02810 · 0% AI
- 2023-03369 · 0% AI
- 2023-04111 · 0% AI
- 2023-0580 · 0% AI
- 2023-0685 · 0% AI
- 2023-07610 · 0% AI
- 2023-081,018 · 0% AI
- 2023-0941 · 0% AI
- 2023-10185 · 0% AI
- 2023-110 · 0% AI
- 2023-1274 · 0% AI
- 2024-01192 · 0% AI
- 2024-02188 · 0% AI
- 2024-054,210 · 0% AI
- 2024-061 · 0% AI
- 2024-072,402 · 0% AI
- 2024-08287 · 0% AI
- 2024-091,133 · 0% AI
- 2024-1066 · 0% AI
- 2024-11143 · 0% AI
- 2024-12265 · 0% AI
- 2025-01164 · 0% AI
- 2025-028 · 0% AI
- 2025-0388 · 0% AI
- 2025-040 · 0% AI
- 2025-0710 · 0% AI
- 2025-08588 · 0% AI
- 2025-0972 · 0% AI
- 2025-11113 · 0% AI
- 2026-01801 · 0% AI
- 2026-0274 · 0% AI
- 2026-0310,020 · 0% AI
- 2026-045,664 · 0% AI
- 2026-0731,106 · 2% AI
- 2026-0819,526 · 0% AI
- 2026-09484 · 0% AI
- 2026-10370 · 0% AI
- 2026-11995 · 0% AI
Findings in AI-attributed lines vs the rest
From git blame: 75 lines trace to AI-attributed commits, 65,603 to others. Too few lines in one group for a fair comparison. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.03 | — |
| Security | 0.00 | 0.06 | — |
Evidence by analyzer
Explicit AI attributionok4 items
- OpenAI Codex: 1 attributed commits, 383 lines added
- Claude Code: 1 attributed commits, 315 lines added
- Claude Code: PR description attribution
- OpenAI Codex: PR branch 'codex/fix-module-repo-loader'
- attributed_commit_share
- 0.1%
- attributed_commits
- 2
- attributed_loc
- 698
- attributed_loc_share
- 0.2%
- commits
- 3,072
- effective_loc
- 381,260
- tools_detected
- 2
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok3 items
- 3,735 lines of first-party code in ~4.0h (934 lines/hour, 1 commit session)
- 4,182 lines of first-party code in ~4.6h (906 lines/hour, 3 commit session)
- 2,382 lines of first-party code in ~4.0h (596 lines/hour, 1 commit session)
- excluded_import_loc
- 243,267
- flagged_loc
- 10,299
- flagged_loc_share
- 7.5%
- flagged_units
- 3
- max_loc_per_hour
- 3,403.24
- measured_loc
- 137,993
- median_loc_per_hour
- 55.50
- pr_timed_units
- 86
- pre_ai_era_burst_loc
- 13,485
- pre_ai_era_bursts
- 5
- pre_ai_era_measured_loc
- 69,355
- work_units
- 1,755
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 2,138
- releases
- 13
Coding styleok3 items
- step-by-step narration comment: // First, check if it exists. If not, we need to "discover" it.
- step-by-step narration comment: * first, and someone who keeps two and switches between them should not be offered a shortcut
- step-by-step narration comment: // first, because findLibrary answers with the first candidate it can open.
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 3
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 3
- files:placeholder
- 0
- index
- 0.05
- lines_scanned
- 65,678
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0.05
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 75
- blame_failures
- 0
- files_blamed
- 376
- other_lines
- 65,603
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 2
- quality:other_per_kloc
- 0.03
- security:ai_findings
- 0
- security:ai_per_kloc
- 0
- security:other_findings
- 4
- security:other_per_kloc
- 0.06
Code quality
60 weak
Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 11% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing.
How the score is built
- Complexity71
- Duplication84
- Lint and smells100
- Tests and CI15
- Documentation65
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- get in daemon/src/main/kotlin/org/matrix/vector/daemon/data/FileSystem.kt: complexity 61, 468 lines
- vector::native::jni::VECTOR_DEF_NATIVE_METHOD in native/src/jni/hook_bridge.cpp: complexity 38, 147 lines
- (anonymous) in xposed/src/main/kotlin/org/matrix/vector/impl/hooks/VectorInvocation.kt: complexity 38, 63 lines
- install in manager/src/main/kotlin/org/matrix/vector/manager/ui/components/PackageActionMenu.kt: complexity 28, 259 lines
- vector::native::ElfImage::findModuleBase in native/src/elf/elf_image.cpp: complexity 25, 87 lines
- Java_org_matrix_vector_daemon_env_Dex2OatServer_doMountNative in daemon/src/main/jni/dex2oat.cpp: complexity 23, 57 lines
- parseEntry in manager/src/main/kotlin/org/matrix/vector/manager/data/log/LogFormat.kt: complexity 21, 42 lines
- vector::native::ElfImage::parseHeaders in native/src/elf/elf_image.cpp: complexity 21, 59 lines
- dispatchModuleScope in daemon/src/main/kotlin/org/matrix/vector/daemon/VectorService.kt: complexity 20, 66 lines
- PanelItem in manager-ui/src/main/kotlin/org/matrix/vector/ui/navigation/PanelBar.kt: complexity 20, 139 lines
- complex_functions
- 23
- function_nloc
- 27,702
- functions
- 2,453
- long_functions
- 14
- many_param_functions
- 17
- mean_ccn
- 2.51
- p90_ccn
- 5
- risky_nloc_share
- 11.4%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: daemon/build.gradle.kts:17 and zygisk/build.gradle.kts:25
- 6+ duplicated lines: daemon/src/main/jni/logging.h:9 and dex2oat/src/main/cpp/include/logging.h:8
- 6+ duplicated lines: daemon/src/main/kotlin/org/matrix/vector/daemon/Cli.kt:379 and daemon/src/main/kotlin/org/matrix/vector/daemon/Cli.kt:393
- 6+ duplicated lines: daemon/src/main/kotlin/org/matrix/vector/daemon/system/SystemExtensions.kt:311 and daemon/src/main/kotlin/org/matrix/vector/daemon/system/SystemExtensions.kt:312
- 6+ duplicated lines: daemon/src/main/kotlin/org/matrix/vector/daemon/utils/Workarounds.kt:89 and daemon/src/main/kotlin/org/matrix/vector/daemon/utils/Workarounds.kt:99
- 6+ duplicated lines: dex2oat/src/main/cpp/include/base_macros.h:2 and hiddenapi/stubs/src/main/java/androidx/annotation/IntRange.java:2
- 6+ duplicated lines: dex2oat/src/main/cpp/include/base_macros.h:4 and dex2oat/src/main/cpp/include/macros.h:4
- 6+ duplicated lines: external/apache/build.gradle.kts:1 and external/axml/build.gradle.kts:1
- 6+ duplicated lines: hiddenapi/stubs/src/main/java/android/annotation/NonNull.java:2 and hiddenapi/stubs/src/main/java/android/annotation/Nullable.java:2
- 6+ duplicated lines: legacy/src/main/java/android/content/res/XResources.java:722 and legacy/src/main/java/android/content/res/XResources.java:1364
- compared_lines
- 43,095
- duplicated_lines
- 1,244
- duplicated_share
- 2.9%
- files
- 376
Lintok
- category:correctness
- 2
- findings
- 2
- scanned_lines
- 65,678
- weighted_findings
- 0.50
Tests and CIok2 items
- CI config: .github/workflows/core.yml
.github/workflows/core.yml - CI config: .github/workflows/crowdin.yml
.github/workflows/crowdin.yml
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- no
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 2
- cochange_commits
- 209
- cochange_share
- 0.0%
- source_lines
- 65,678
- test_lines
- 0
- test_ratio
- 0
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 82
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 0
- escapes_per_kloc
- 0
Security
72 adequate
Security posture is adequate: 2 high-severity SAST findings; 15 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets97
- Static analysis (SAST)97
- Vulnerable dependenciesnot measured
- CI workflows5
- Security posture60
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesskipped
no registry dependencies declared
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 1
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 6
- findings_high
- 2
- findings_low
- 0
- findings_medium
- 4
- parse_errors
- 11
- scanned_lines
- 65,678
- weighted_findings
- 5.75
Dependencies (osv-scanner)skipped
CI workflows (zizmor)ok
- findings
- 21
- findings_high
- 15
- findings_low
- 2
- findings_medium
- 4
- penalty
- 178.20
- workflows
- 2
Security postureok1 item
- Dependency updates: .github/dependabot.yml
.github/dependabot.yml
- check:dependency_updates
- yes
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- yes
- signed_commit_share
- 57.5%
- unpinned_manifests
- 0
Release downloadsok5 items
- release canary-3118 ships Vector-v2.2-3118-Debug.zip (1277 downloads)
- release canary-3118 ships Vector-v2.2-3118-Release.zip (8614 downloads)
- release canary-3117 ships Vector-v2.2-3117-Debug.zip (256 downloads)
- release canary-3117 ships Vector-v2.2-3117-Release.zip (1657 downloads)
- release canary-3116 ships Vector-v2.2-3116-Debug.zip (898 downloads)
- binary_assets
- 20
- signals
- 1
- suspicious
- 0
Findings
17 high8 medium5 low
30 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:103 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/core.yml:108 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:108 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:118 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:140 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:146 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:155 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:166 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:39 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/core.yml:71 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:88 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/core.yml:94 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/core.yml:94 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/crowdin.yml:26 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/crowdin.yml:29 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/python.lang.security.use-defused-xml |
manager/tools/check_translations.py:1 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml-parse |
manager/tools/check_translations.py:6 | The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the... | Static analysis (opengrep) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:11 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:19 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:3 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/crowdin.yml:22 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | opengrep/java.lang.security.audit.crypto.use-of-md5 |
legacy/src/main/java/de/robv/android/xposed/XSharedPreferences.java:250 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. [confidence high] | Static analysis (opengrep) |
| medium | opengrep/java.lang.security.audit.crypto.use-of-md5 |
legacy/src/main/java/de/robv/android/xposed/XposedHelpers.java:1758 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. [confidence high] | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
manager/src/debug/AndroidManifest.xml:18 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| medium | opengrep/java.android.security.exported_activity |
manager/src/main/AndroidManifest.xml:32 | The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access... | Static analysis (opengrep) |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
zygisk/module/customize.sh:37 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
zygisk/module/customize.sh:40 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | zizmor/artipacked |
.github/workflows/core.yml:38 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/crowdin.yml:25 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
edxp-core/src/main/cpp/main/src/riru_hook.h:24 | Possible generic-api-key secret in history (commit c362449e33); removed from the current tree but still retrievable | Secrets (gitleaks) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 2 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 21 | |
| Dependencies (osv-scanner) | Security | skipped | — | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | skipped | — | 0 | no registry dependencies declared |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 6 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 1 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 91e77e439619 | prov-5+qual-2+sec-2 | 0% | 60 | 72 |
Full text report
- Repository: https://github.com/JingMatrix/Vector
- Commit:
91e77e439619bdee53c106ba9c82b9e08051c3e9 - Generated: 2026-11-14T15:58:32+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 65% | 100% |
| Code quality | 60 | weak | 90% | 100% |
| Security | 72 | adequate | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development. 2 commit(s) carry explicit AI attribution, too few to characterize the codebase.
- Explicitly attributed share (lower bound): 0.2%
- Unattributed share in AI-consistent velocity bursts: 2.7%
- Estimated AI-generated share: 0.2%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 1 | 383 |
| Claude Code | 1 | 315 |
Current source lines last changed by AI-attributed commits: 75 of 65,678.
Too few lines in one group to compare finding densities.
- Stylometry index: 0.05 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-08 | 588 | 0% |
| 2025-09 | 72 | 0% |
| 2025-11 | 113 | 0% |
| 2026-01 | 801 | 0% |
| 2026-02 | 74 | 0% |
| 2026-03 | 10,020 | 0% |
| 2026-04 | 5,664 | 0% |
| 2026-07 | 31,106 | 2% |
| 2026-08 | 19,526 | 0% |
| 2026-09 | 484 | 0% |
| 2026-10 | 370 | 0% |
| 2026-11 | 995 | 0% |
Evidence
- Claude Code: PR description attribution (7fd88c9ecd5f)
- OpenAI Codex: PR branch 'codex/fix-module-repo-loader' (2a633ef0943f)
- 3,735 lines of first-party code in ~4.0h (934 lines/hour, 1 commit session) (5d782a768036)
- 4,182 lines of first-party code in ~4.6h (906 lines/hour, 3 commit session) (17625a04d5cd)
- 2,382 lines of first-party code in ~4.0h (596 lines/hour, 1 commit session) (779faeb5ee92)
- step-by-step narration comment: // First, check if it exists. If not, we need to "discover" it. (daemon/src/m)
- step-by-step narration comment: * first, and someone who keeps two and switches between them should not be offered a shortcut (manager/src/)
- step-by-step narration comment: // first, because findLibrary answers with the first candidate it can open. (xposed/src/m)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 11% of function code in complex or long functions; 3% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 71 |
| Duplication | 84 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 15 |
| Documentation | 65 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,453; mean complexity 2.5, 90th percentile 5; 23 complex and 14 long functions
- Duplicated lines: 2.9% of 43,095 compared
- Tests: 0 test lines for 65,678 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- get in daemon/src/main/kotlin/org/matrix/vector/daemon/data/FileSystem.kt: complexity 61, 468 lines
- vector::native::jni::VECTOR_DEF_NATIVE_METHOD in native/src/jni/hook_bridge.cpp: complexity 38, 147 lines
- (anonymous) in xposed/src/main/kotlin/org/matrix/vector/impl/hooks/VectorInvocation.kt: complexity 38, 63 lines
- install in manager/src/main/kotlin/org/matrix/vector/manager/ui/components/PackageActionMenu.kt: complexity 28, 259 lines
- vector::native::ElfImage::findModuleBase in native/src/elf/elf_image.cpp: complexity 25, 87 lines
Security
Security posture is adequate: 2 high-severity SAST findings; 15 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 97 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 5 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: dependency updates, signed commits, lockfiles; missing: security policy
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
manager/tools/check_translations.py:1 |
| high | opengrep/python.lang.security.use-defused-xml-parse: The native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using defusedxml. [confidence medium] |
manager/tools/check_translations.py:6 |
| high | zizmor/template-injection: code injection via template expansion [confidence high] |
.github/workflows/core.yml:71 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:39 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:88 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:94 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:103 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:108 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:118 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:140 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:146 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:155 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/core.yml:166 |
| high | zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] |
.github/workflows/core.yml:94 |
| high | zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] |
.github/workflows/core.yml:108 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/crowdin.yml:26 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/crowdin.yml:29 |
| medium | opengrep/java.lang.security.audit.crypto.use-of-md5: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. [confidence high] |
legacy/src/main/java/de/robv/android/xposed/XSharedPreferences.java:250 |
| medium | opengrep/java.lang.security.audit.crypto.use-of-md5: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use HMAC instead. [confidence high] |
legacy/src/main/java/de/robv/android/xposed/XposedHelpers.java:1758 |
| medium | opengrep/java.android.security.exported_activity: The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium] |
manager/src/debug/AndroidManifest.xml:18 |
| medium | opengrep/java.android.security.exported_activity: The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data. Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium] |
manager/src/main/AndroidManifest.xml:32 |
| medium | zizmor/dependabot-cooldown: insufficient cooldown in Dependabot updates [confidence high] |
.github/dependabot.yml:3 |
| medium | zizmor/dependabot-cooldown: insufficient cooldown in Dependabot updates [confidence high] |
.github/dependabot.yml:11 |
| medium | zizmor/dependabot-cooldown: insufficient cooldown in Dependabot updates [confidence high] |
.github/dependabot.yml:19 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/crowdin.yml:22 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release canary-3118 ships Vector-v2.2-3118-Debug.zip (1277 downloads)
- binary-release-asset: release canary-3118 ships Vector-v2.2-3118-Release.zip (8614 downloads)
- binary-release-asset: release canary-3117 ships Vector-v2.2-3117-Debug.zip (256 downloads)
- binary-release-asset: release canary-3117 ships Vector-v2.2-3117-Release.zip (1657 downloads)
- binary-release-asset: release canary-3116 ships Vector-v2.2-3116-Debug.zip (898 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 65,678; test lines: 0
| Language | Lines |
|---|---|
| Kotlin | 49,526 |
| Java | 8,610 |
| C++ | 5,214 |
| C | 2,101 |
| Shell | 160 |
| Python | 67 |