Leaderboard github.com
KnifeLemon/Filee
Free, open-source file converter. Convert 263 formats offline by drag & drop — images, PDF, Word, Excel, PowerPoint, HWP/HWPX, video, audio, e-books and archives. No upload, no Office needed.
AI provenance
93%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
85/100
strong
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
73/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
93% explicit
Explicit AI attribution on 93% of first-party code added; an estimated 93% including velocity signals.
How the score is built
- Explicitly attributed share93%
- Unattributed share in AI-pace bursts2%
- Estimated AI-generated share93%
- AI tool configuration files0
- Work sessions at AI pace41
- Releases at AI pace8
- Coding-style index (1.0+ means possible)0.06
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 1,476 | 330,471 | 2026-09-29 | 2026-11-14 |
| OpenAI Codex | 21 | 2,047 | 2026-10-19 | 2026-11-11 |
| Cursor agent | 1 | 16 | 2026-10-21 | 2026-10-21 |
Lines added per month all AI-attributed share
- 2026-0958,807 · 100% AI
- 2026-10183,718 · 94% AI
- 2026-11115,229 · 87% AI
Findings in AI-attributed lines vs the rest
From git blame: 169,192 lines trace to AI-attributed commits, 8,078 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.40 | 0.00 | — |
| Security | 0.07 | 0.00 | — |
Evidence by analyzer
Explicit AI attributionok28 items
- Claude Code: 1476 attributed commits, 330,471 lines added
- OpenAI Codex: 21 attributed commits, 2,047 lines added
- Cursor agent: 1 attributed commits, 16 lines added
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: on merged branch (8661c08290)
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: on merged branch (8661c08290)
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: on merged branch (8661c08290)
- Claude Code: on merged branch (8661c08290)
- attributed_commit_share
- 90.7%
- attributed_commits
- 1,498
- attributed_loc
- 332,534
- attributed_loc_share
- 93.0%
- commits
- 1,652
- effective_loc
- 357,754
- tools_detected
- 3
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok15 items
- 9,412 lines of first-party code in ~1.3h (7,002 lines/hour, 3 commit session)
- 36,964 lines of first-party code in ~6.1h (6,025 lines/hour, 20 commit session)
- 6,904 lines of first-party code in ~1.9h (3,575 lines/hour, 4 commit session)
- 5,889 lines of first-party code in ~2.0h (2,961 lines/hour, 3 commit session)
- 2,691 lines of first-party code in ~1.2h (2,162 lines/hour, 3 commit session)
- 2,400 lines of first-party code in ~1.2h (2,013 lines/hour, 1 commit session)
- 7,959 lines of first-party code in ~4.2h (1,910 lines/hour, 2 commit session)
- 22,983 lines of first-party code in ~14.4h (1,595 lines/hour, 44 commit session)
- 1,848 lines of first-party code in ~1.2h (1,529 lines/hour, 5 commit session)
- 6,091 lines of first-party code in ~4.0h (1,523 lines/hour, 1 commit session)
- 1,591 lines of first-party code in ~1.1h (1,501 lines/hour, 4 commit session)
- 7,581 lines of first-party code in ~5.3h (1,431 lines/hour, 9 commit session)
- 2,702 lines of first-party code in ~1.9h (1,411 lines/hour, 11 commit session)
- 5,505 lines of first-party code in ~4.0h (1,376 lines/hour, 4 commit session)
- 1,096 lines of first-party code in ~0.8h (1,360 lines/hour, 1 commit session)
- excluded_import_loc
- 16,477
- flagged_loc
- 195,862
- flagged_loc_share
- 57.4%
- flagged_units
- 41
- max_loc_per_hour
- 7,002.11
- measured_loc
- 341,277
- median_loc_per_hour
- 154.08
- pr_timed_units
- 12
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 500
Release velocityok8 items
- v1.0.1 → v1.1.0: 40,726 lines in 1.13 days (36,171.5 lines/day)
- v1.10.4 → v1.11.0: 20,361 lines in 1.24 days (16,408.1 lines/day)
- v1.11.0 → v1.12.0: 8,534 lines in 1.9 days (4,490.7 lines/day)
- v1.12.0 → v2.0.0: 56,061 lines in 2.33 days (24,087.0 lines/day)
- v2.0.0 → v2.1.0: 42,109 lines in 3.19 days (13,180.0 lines/day)
- v2.1.0 → v2.2.0: 22,844 lines in 3.65 days (6,255.9 lines/day)
- v2.2.0 → v2.3.0: 32,836 lines in 6.55 days (5,014.3 lines/day)
- v2.3.0 → v2.4.0: 43,161 lines in 5.91 days (7,301.3 lines/day)
- flagged_releases
- 8
- max_loc_per_day
- 36,171.50
- releases
- 31
Coding styleok3 items
- step-by-step narration comment: // first, pictures named by Content-Location (the URL they came from) and style sheets as "cid:…@mhtml.blink" parts;
- step-by-step narration comment: // first, its pictures are checked by Filee's own rule (DocumentFiles: only from the source's folder, never from
- step-by-step narration comment: // first, through their own profile when they have one.
- count:assistant_voice
- 0
- count:emoji_in_code
- 15
- count:narrated_steps
- 3
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 3
- files:narrated_steps
- 3
- files:placeholder
- 0
- index
- 0.06
- lines_scanned
- 177,270
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.09
- per_kloc:narrated_steps
- 0.02
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 169,192
- blame_failures
- 0
- files_blamed
- 691
- other_lines
- 8,078
- quality:ai_findings
- 68
- quality:ai_per_kloc
- 0.40
- quality:other_findings
- 0
- quality:other_per_kloc
- 0
- security:ai_findings
- 12
- security:ai_per_kloc
- 0.07
- security:other_findings
- 0
- security:other_per_kloc
- 0
Code quality
85 strong
Code quality is strong: test-to-source ratio 0.80, CI runs tests; 19% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity57
- Duplication92
- Lint and smells97
- Tests and CI100
- Documentation100
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- SettingsMigrations::ApplyToLibrary in src/Filee.Core/Settings/UserDataStore.cs: complexity 180, 474 lines
- SliceLabelInput::PlanRing in src/Filee.App/Controls/SliceLabelLayout.cs: complexity 112, 171 lines
- JobQueue::RunFileAsync in src/Filee.Core/Conversion/JobQueue.cs: complexity 94, 217 lines
- struct::Evaluate in src/Filee.App/Services/PresetAvailability.cs: complexity 91, 189 lines
- FitFormat::Read in src/Filee.Engines/Geo/FitFormat.cs: complexity 82, 151 lines
- ToolbarPageViewModel::Rebuild in src/Filee.App/ViewModels/Pages/ToolbarPageViewModel.cs: complexity 73, 140 lines
- struct::for in src/Filee.Engines/Pdf/PdfMergeStructure.cs: complexity 70, 120 lines
- PresetEditorViewModel::PresetEditorViewModel in src/Filee.App/ViewModels/PresetEditorViewModel.cs: complexity 66, 264 lines
- PresetEditorViewModel::Apply in src/Filee.App/ViewModels/PresetEditorViewModel.cs: complexity 65, 198 lines
- RoutePlanner::Plan in src/Filee.Core/Conversion/RoutePlanner.cs: complexity 64, 98 lines
- complex_functions
- 388
- function_nloc
- 140,366
- functions
- 8,426
- long_functions
- 86
- many_param_functions
- 53
- mean_ccn
- 4.52
- p90_ccn
- 10
- risky_nloc_share
- 18.8%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: src/Filee.App/Controls/AnnotationCanvas.cs:121 and src/Filee.App/Controls/CropCanvas.cs:273
- 6+ duplicated lines: src/Filee.App/Controls/AnnotationCanvas.cs:124 and src/Filee.App/Controls/HideCanvas.cs:141
- 6+ duplicated lines: src/Filee.App/Controls/AnnotationSet.cs:149 and src/Filee.App/Controls/HideAreaSet.cs:170
- 6+ duplicated lines: src/Filee.App/Controls/AspectDial.cs:67 and src/Filee.App/Controls/DonutMenu.cs:1755
- 6+ duplicated lines: src/Filee.App/Controls/ClipSequence.cs:583 and src/Filee.App/Controls/ClipTimeline.cs:486
- 6+ duplicated lines: src/Filee.App/Controls/CropCanvas.cs:24 and src/Filee.App/Controls/HideCanvas.cs:85
- 6+ duplicated lines: src/Filee.App/Services/Connect/SharedFolderManager.cs:328 and src/Filee.App/Services/Connect/SharedFolderManager.cs:356
- 6+ duplicated lines: src/Filee.App/Services/CropService.cs:68 and src/Filee.App/Services/CropService.cs:143
- 6+ duplicated lines: src/Filee.App/Services/LocalizationService.cs:38 and src/Filee.Setup/SetupTexts.cs:29
- 6+ duplicated lines: src/Filee.App/Services/RadialController.cs:596 and src/Filee.App/Services/RadialController.cs:684
- compared_lines
- 123,275
- duplicated_lines
- 1,606
- duplicated_share
- 1.3%
- files
- 691
Lintok
- category:best-practice
- 68
- findings
- 68
- scanned_lines
- 177,270
- weighted_findings
- 19.25
Tests and CIok10 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/flag-duplicate-issue.yml
.github/workflows/flag-duplicate-issue.yml - CI config: .github/workflows/label-issue.yml
.github/workflows/label-issue.yml - CI config: .github/workflows/label-pr.yml
.github/workflows/label-pr.yml - CI config: .github/workflows/magick-native-macos.yml
.github/workflows/magick-native-macos.yml - CI config: .github/workflows/portable.yml
.github/workflows/portable.yml - CI config: .github/workflows/release.yml
.github/workflows/release.yml - CI config: .github/workflows/windows-arm64-native.yml
.github/workflows/windows-arm64-native.yml - CI runs tests (dotnet test)
- CI runs linters (dotnet format)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 8
- cochange_commits
- 194
- cochange_share
- 89.7%
- source_lines
- 177,270
- test_lines
- 141,616
- test_ratio
- 0.80
Documentationok4 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md - CHANGELOG.md
CHANGELOG.md
- check:changelog
- yes
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 218
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 0
- escapes_per_kloc
- 0
Security
73 adequate
Security posture is adequate: 44 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets88
- Static analysis (SAST)99
- Vulnerable dependencies100
- CI workflows0
- Security posture40
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 3
- declared
- 3
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 2
- secrets_nonprod
- 2
Static analysis (opengrep)ok
- findings
- 10
- findings_high
- 0
- findings_low
- 0
- findings_medium
- 10
- parse_errors
- 2
- scanned_lines
- 177,270
- weighted_findings
- 6
Dependencies (osv-scanner)ok
- penalty
- 0
- vulnerabilities
- 0
- vulnerable_packages
- 0
- vulns_critical
- 0
- vulns_high
- 0
- vulns_low
- 0
- vulns_medium
- 0
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 59
- findings_high
- 44
- findings_low
- 15
- findings_medium
- 0
- penalty
- 527.60
- workflows
- 8
Security postureok1 item
- Security policy: SECURITY.md
SECURITY.md
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- yes
- check:signed_commits
- no
- signed_commit_share
- 19.0%
- unpinned_manifests
- 0
Release downloadsok6 items
- release v2.4.1 ships Filee-2.4.1-linux-arm64.tar.gz (141 downloads)
- release v2.4.1 ships Filee-2.4.1-linux-x64.tar.gz (702 downloads)
- release v2.4.1 ships Filee-2.4.1-osx-arm64.dmg (607 downloads)
- release v2.4.1 ships Filee-2.4.1-osx-arm64.tar.gz (265 downloads)
- release v2.4.1 ships Filee-2.4.1-osx-x64.dmg (175 downloads)
- 27073 stars in 46 days (591/day)
- binary_assets
- 70
- signals
- 2
- suspicious
- 0
Findings
44 high13 medium79 low5 info
141 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:115 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:117 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:140 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:152 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:182 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:190 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:206 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:208 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:246 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:248 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:284 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:308 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:316 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:40 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/label-pr.yml:10 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/magick-native-macos.yml:118 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/magick-native-macos.yml:56 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:106 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:130 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:134 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:139 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:144 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:165 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:238 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:249 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:280 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:290 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:315 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:57 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:66 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/portable.yml:85 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:105 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:113 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release.yml:140 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release.yml:153 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/excessive-permissions |
.github/workflows/release.yml:24 | overly broad permissions [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:36 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:38 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/template-injection |
.github/workflows/release.yml:46 | code injection via template expansion [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:54 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release.yml:83 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows-arm64-native.yml:32 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows-arm64-native.yml:37 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/windows-arm64-native.yml:84 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
src/Filee.App/Resources/Connect/mobile.js:274 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-prompt |
src/Filee.App/Resources/Connect/mobile.js:298 | found prompt() call; should this be in production code? | Lint |
| medium | opengrep/javascript.lang.best-practice.javascript-alert |
src/Filee.App/Resources/Connect/shared-files.js:262 | found alert() call; should this be in production code? | Lint |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Core/Settings/PortableImport.cs:106 | String argument destination is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Core/Settings/PortableImport.cs:33 | String argument destination is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Core/Settings/PortableImport.cs:76 | String argument source is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Engines/Archives/SevenZip.cs:113 | String argument workDirectory is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Engines/Archives/SevenZip.cs:74 | String argument workDirectory is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Engines/Ebooks/ComicBook.cs:173 | String argument folder is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Engines/Media/CoverArt.cs:42 | String argument workDirectory is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Engines/Media/CoverArt.cs:58 | String argument workDirectory is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Engines/Media/CoverArt.cs:60 | String argument workDirectory is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/csharp.lang.security.filesystem.unsafe-path-combine |
src/Filee.Setup/Payload/SetupPayload.cs:388 | String argument appFolder is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal. [confidence medium] | Static analysis (opengrep) |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/FileSwap.cs:115 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/FileSwap.cs:82 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:113 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:137 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:148 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:202 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:209 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:228 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:237 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:242 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:251 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:293 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:332 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:385 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:77 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Installer.cs:93 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/PreviousInstall.cs:101 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/PreviousInstall.cs:122 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:131 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:138 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:155 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:160 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:171 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:242 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:267 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:277 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:300 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:66 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Installation/Uninstaller.cs:77 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:115 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:158 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:168 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:174 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:185 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:194 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:219 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:233 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:313 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Platform/SetupSystem.cs:355 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:121 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:174 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:178 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:203 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:223 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:263 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:292 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:339 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:343 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:368 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:372 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:382 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:401 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:406 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:413 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:417 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:431 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:435 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:459 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:503 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:54 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:56 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:58 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:71 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:77 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | opengrep/csharp.lang.best-practice.structured-logging |
src/Filee.Setup/Program.cs:87 | String interpolation in log message obscures the distinction between variables and the log message. Use structured logging instead, where the variables are passed as additional arguments and the interpolation is performed by the logging... | Lint |
| low | zizmor/self-repository |
.github/workflows/ci.yml:106 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:115 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:206 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:246 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:40 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/portable.yml:130 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/portable.yml:280 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/portable.yml:57 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/self-repository |
.github/workflows/release.yml:28 | use GitHub's dedicated self-repository syntax [confidence high] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release.yml:36 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
src/Filee.App/Services/Triggers/GestureDetector.cs:81 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
src/Filee.Engines/Metadata/ExifTool.cs:107 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/Filee.App.Tests/FileeConnectTests.cs:445 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
tests/Filee.App.Tests/UpdateServiceTests.cs:920 | Possible generic-api-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:272 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/ci.yml:278 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/release.yml:124 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/release.yml:63 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
| info | zizmor/template-injection |
.github/workflows/release.yml:94 | code injection via template expansion [confidence low] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 68 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 59 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 10 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 4 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 770e9820518f | prov-5+qual-2+sec-2 | 93% | 85 | 73 |
Full text report
- Repository: https://github.com/KnifeLemon/Filee
- Commit:
770e9820518f77c493c1946c9533b82ae2a67595 - Generated: 2026-11-14T16:02:06+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 93 | explicit | 95% | 100% |
| Code quality | 85 | strong | 90% | 100% |
| Security | 73 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 93% of first-party code added; an estimated 93% including velocity signals.
- Explicitly attributed share (lower bound): 93.0%
- Unattributed share in AI-consistent velocity bursts: 1.6%
- Estimated AI-generated share: 93.0%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 1,476 | 330,471 |
| OpenAI Codex | 21 | 2,047 |
| Cursor agent | 1 | 16 |
Current source lines last changed by AI-attributed commits: 169,192 of 177,270.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.402 | 0.0 | n/a |
| Security | 0.071 | 0.0 | n/a |
- Stylometry index: 0.06 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 0, emoji 15). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-09 | 58,807 | 100% |
| 2026-10 | 183,718 | 94% |
| 2026-11 | 115,229 | 87% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (07393467090b)
- Claude Code: trailer 'Co-Authored-By: Claude' (ce3afc57d39e)
- Claude Code: trailer 'Co-Authored-By: Claude' (7fdb936d000f)
- Claude Code: trailer 'Co-Authored-By: Claude' (7641889aef6a)
- Claude Code: trailer 'Co-Authored-By: Claude' (1466964a1e73)
- Claude Code: trailer 'Co-Authored-By: Claude' (317a903d3f48)
- Claude Code: trailer 'Co-Authored-By: Claude' (b813ae46bc0a)
- Claude Code: trailer 'Co-Authored-By: Claude' (791b1e514562)
- Claude Code: trailer 'Co-Authored-By: Claude' (9a6dff6ba993)
- Claude Code: trailer 'Co-Authored-By: Claude' (cc31827cee07)
- Claude Code: trailer 'Co-Authored-By: Claude' (bbbaa946d916)
- Claude Code: trailer 'Co-Authored-By: Claude' (08704be00b6d)
- Claude Code: trailer 'Co-Authored-By: Claude' (673bb60d4633)
- Claude Code: trailer 'Co-Authored-By: Claude' (93c5a4f6da14)
- Claude Code: on merged branch (8661c08290) (e88ffc2bb713)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 0.80, CI runs tests; 19% of function code in complex or long functions; 1% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 57 |
| Duplication | 92 |
| Code smells (Opengrep) | 97 |
| Tests and CI | 100 |
| Documentation | 100 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 8,426; mean complexity 4.5, 90th percentile 10; 388 complex and 86 long functions
- Duplicated lines: 1.3% of 123,275 compared
- Tests: 141,616 test lines for 177,270 source lines (ratio 0.80); CI test commands: dotnet test; 90% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- SettingsMigrations::ApplyToLibrary in src/Filee.Core/Settings/UserDataStore.cs: complexity 180, 474 lines
- SliceLabelInput::PlanRing in src/Filee.App/Controls/SliceLabelLayout.cs: complexity 112, 171 lines
- JobQueue::RunFileAsync in src/Filee.Core/Conversion/JobQueue.cs: complexity 94, 217 lines
- struct::Evaluate in src/Filee.App/Services/PresetAvailability.cs: complexity 91, 189 lines
- FitFormat::Read in src/Filee.Engines/Geo/FitFormat.cs: complexity 82, 151 lines
Security
Security posture is adequate: 44 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 88 |
| Static analysis (Opengrep) | 99 |
| Vulnerable dependencies (OSV) | 100 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: security policy, lockfiles; missing: dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:40 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:115 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:117 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:140 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:152 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:182 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:190 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:206 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:208 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:246 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:248 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:284 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:308 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:316 |
| high | zizmor/dangerous-triggers: use of fundamentally insecure workflow trigger [confidence medium] |
.github/workflows/label-pr.yml:10 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/magick-native-macos.yml:56 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/magick-native-macos.yml:118 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/portable.yml:57 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/portable.yml:66 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/portable.yml:85 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/portable.yml:106 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/portable.yml:130 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/portable.yml:134 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/portable.yml:139 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/portable.yml:144 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v2.4.1 ships Filee-2.4.1-linux-arm64.tar.gz (141 downloads)
- binary-release-asset: release v2.4.1 ships Filee-2.4.1-linux-x64.tar.gz (702 downloads)
- binary-release-asset: release v2.4.1 ships Filee-2.4.1-osx-arm64.dmg (607 downloads)
- binary-release-asset: release v2.4.1 ships Filee-2.4.1-osx-arm64.tar.gz (265 downloads)
- binary-release-asset: release v2.4.1 ships Filee-2.4.1-osx-x64.dmg (175 downloads)
- star-burst: 27073 stars in 46 days (591/day)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 177,270; test lines: 141,616
| Language | Lines |
|---|---|
| C# | 316,511 |
| JavaScript | 986 |
| C | 515 |
| Shell | 475 |
| Python | 399 |