Kikobeats/reachable-url

Resolve a URL as fast as possible and report whether the destination is reachable over HTTP.

https://github.com/Kikobeats/reachable-url · commit d87017026488 · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/Kikobeats/reachable-url
Commit: d8701702648844c83771b2655187bff830f9b779
Generated: 2026-11-14T00:10:22+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	47	explicit	95%	100%
Code quality	82	strong	90%	100%
Security	69	weak	85%	100%

AI provenance

Explicit AI attribution on 47% of first-party code added; an estimated 47% including velocity signals.

Explicitly attributed share (lower bound): 47.1%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 47.1%

AI tool	Attributed commits	Lines added
Claude Code	9	986
Cursor agent	6	478

Current source lines last changed by AI-attributed commits: 357 of 777.

Too few lines in one group to compare finding densities.

Stylometry index: 9.00 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 18). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2022-03	37	0%
2022-04	180	0%
2022-09	67	0%
2023-09	1	0%
2024-02	11	0%
2024-05	1	0%
2024-06	43	0%
2025-06	414	0%
2026-08	556	99%
2026-09	9	100%
2026-10	255	100%
2026-11	333	100%

Evidence

Cursor agent: trailer 'Co-authored-by: Cursor' (3964ec047850)
Claude Code: trailer 'Co-Authored-By: Claude' (9a00d6d82785)
Claude Code: trailer 'Co-authored-by: Claude' (3375a64829d3)
Claude Code: trailer 'Co-authored-by: Claude' (3d5c76a46658)
Cursor agent: trailer 'Co-authored-by: Cursor' (d10b66d6ab89)
Claude Code: trailer 'Co-Authored-By: Claude' (96a5b1ee5ea3)
Cursor agent: trailer 'Co-authored-by: Cursor Agent' (c71651aa84ae)
Claude Code: trailer 'Co-Authored-By: Claude' (39e953501286)
Claude Code: trailer 'Co-Authored-By: Claude' (7e0c676257c8)
Claude Code: trailer 'Co-Authored-By: Claude' (d6f7a3c9d38f)
Claude Code: trailer 'Co-Authored-By: Claude' (ed8670f0be32)
Claude Code: trailer 'Co-Authored-By: Claude' (dfdb5c99dc6a)
Cursor agent: trailer 'Co-authored-by: Cursor' (18105578e68f)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is strong: test-to-source ratio 1.34, CI runs tests; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: lint.

Area	Score
Complexity (lizard)	100
Duplication	100
Code smells (Opengrep)	47
Tests and CI	90
Documentation	85
Type safety	n/a
Process (Scorecard review/maintenance)	50

Functions: 88; mean complexity 1.9, 90th percentile 4; 0 complex and 0 long functions
Duplicated lines: 0.0% of 539 compared
Tests: 1,042 test lines for 777 source lines (ratio 1.34); CI test commands: npm test; 68% of recent source commits also change tests
Docs missing or thin: contributing

Security

Security posture is weak: 13 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	100
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	6
Posture (policy, updates, signing, lockfiles)	60
OpenSSF Scorecard	33

Posture checks passed: dependency updates, signed commits; missing: security policy, lockfiles
OpenSSF Scorecard aggregate: 4.1/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/benchmark.yml:20
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/benchmark.yml:25
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/benchmark.yml:31
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/benchmark.yml:35
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/benchmark.yml:121
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/main.yml:17
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/main.yml:21
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/main.yml:25
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/main.yml:35
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pull_request.yml:21
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pull_request.yml:25
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pull_request.yml:29
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pull_request.yml:39
medium	`zizmor/dependabot-cooldown`: insufficient cooldown in Dependabot updates [confidence high]	.github/dependabot.yml:3
medium	`zizmor/dependabot-cooldown`: insufficient cooldown in Dependabot updates [confidence high]	.github/dependabot.yml:7
medium	`zizmor/excessive-permissions`: overly broad permissions [confidence medium]	.github/workflows/main.yml:13
medium	`zizmor/excessive-permissions`: overly broad permissions [confidence medium]	.github/workflows/pull_request.yml:17
low	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/main.yml:16
low	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/pull_request.yml:20

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 777; test lines: 1,042

Language	Lines
JavaScript	1,819

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Kikobeats/reachable-url/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Kikobeats/reachable-url/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Kikobeats/reachable-url/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Kikobeats/reachable-url/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Kikobeats/reachable-url/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Kikobeats/reachable-url/)