Leaderboard github.com

Kotlin/kotlinx.coroutines

Library support for Kotlin coroutines

View repository ↗
Kotlin
★ 13,820
commit ead082131ceb
scored 2026-11-14
scoring prov-5+qual-2+sec-2

AI provenance

possible

Confidence: 65%
Coverage: 100%

Estimated share of AI-generated code. Explicit attribution is a lower bound.

Code quality

76/100

adequate

Confidence: 90%
Coverage: 100%

Complexity, duplication, lint density, tests, CI, docs and review process.

Security

68/100

weak

Confidence: 85%
Coverage: 100%

Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.

Dispute or request a re-score Full report JSON

AI provenance

0% possible

Weak signals consistent with AI-assisted development.

How the score is built

Explicitly attributed share0%
Unattributed share in AI-pace bursts0%
Estimated AI-generated share0%
AI tool configuration files2
Work sessions at AI pace0
Releases at AI pace0
Coding-style index (1.0+ means possible)0.40

Lines added per month all AI-attributed share

2016-06604 · 0% AI
2016-07289 · 0% AI
2016-100 · 0% AI
2016-11117 · 0% AI
2016-12381 · 0% AI
2017-015,660 · 0% AI
2017-0215,100 · 0% AI
2017-035,224 · 0% AI
2017-043,120 · 0% AI
2017-051,536 · 0% AI
2017-062,287 · 0% AI
2017-076,794 · 0% AI
2017-085,957 · 0% AI
2017-095,639 · 0% AI
2017-101,822 · 0% AI
2017-112,671 · 0% AI
2017-126,952 · 0% AI
2018-013,298 · 0% AI
2018-021,208 · 0% AI
2018-034,835 · 0% AI
2018-047,031 · 0% AI
2018-052,803 · 0% AI
2018-061,977 · 0% AI
2018-077,854 · 0% AI
2018-082,957 · 0% AI
2018-0910,129 · 0% AI
2018-103,609 · 0% AI
2018-112,326 · 0% AI
2018-123,376 · 0% AI
2019-01330 · 0% AI
2019-023,804 · 0% AI
2019-032,369 · 0% AI
2019-0410,359 · 0% AI
2019-052,643 · 0% AI
2019-064,331 · 0% AI
2019-074,840 · 0% AI
2019-084,196 · 0% AI
2019-092,643 · 0% AI
2019-101,952 · 0% AI
2019-111,023 · 0% AI
2019-121,189 · 0% AI
2020-01215 · 0% AI
2020-022,491 · 0% AI
2020-033,271 · 0% AI
2020-047,232 · 0% AI
2020-051,378 · 0% AI
2020-06177 · 0% AI
2020-071,382 · 0% AI
2020-08629 · 0% AI
2020-09403 · 0% AI
2020-109,303 · 0% AI
2020-11775 · 0% AI
2020-12863 · 0% AI
2021-01429 · 0% AI
2021-02967 · 0% AI
2021-03854 · 0% AI
2021-044,944 · 0% AI
2021-05717 · 0% AI
2021-06651 · 0% AI
2021-07487 · 0% AI
2021-08212 · 0% AI
2021-09718 · 0% AI
2021-101,693 · 0% AI
2021-115,995 · 0% AI
2021-12316 · 0% AI
2022-01212 · 0% AI
2022-02498 · 0% AI
2022-03111 · 0% AI
2022-04390 · 0% AI
2022-05179 · 0% AI
2022-06228 · 0% AI
2022-071,081 · 0% AI
2022-082,236 · 0% AI
2022-09456 · 0% AI
2022-10934 · 0% AI
2022-11197 · 0% AI
2022-1273 · 0% AI
2023-01406 · 0% AI
2023-026,349 · 0% AI
2023-03841 · 0% AI
2023-04126 · 0% AI
2023-05266 · 0% AI
2023-06386 · 0% AI
2023-0795 · 0% AI
2023-08104 · 0% AI
2023-0971 · 0% AI
2023-10192 · 0% AI
2023-11353 · 0% AI
2023-122,778 · 0% AI
2024-011,830 · 0% AI
2024-02848 · 0% AI
2024-03249 · 0% AI
2024-04557 · 0% AI
2024-051,533 · 0% AI
2024-0635 · 0% AI
2024-07655 · 0% AI
2024-08588 · 0% AI
2024-0932 · 0% AI
2024-101,668 · 0% AI
2024-11205 · 0% AI
2024-12370 · 0% AI
2025-01157 · 0% AI
2025-02689 · 0% AI
2025-0373 · 0% AI
2025-04653 · 0% AI
2025-05381 · 0% AI
2025-06118 · 0% AI
2025-07211 · 0% AI
2025-0862 · 0% AI
2025-0919 · 0% AI
2025-10186 · 0% AI
2025-11698 · 0% AI
2025-12129 · 0% AI
2026-010 · 0% AI
2026-027 · 0% AI
2026-031,363 · 0% AI
2026-043,377 · 0% AI
2026-0512 · 0% AI
2026-06269 · 0% AI
2026-0717 · 0% AI
2026-085 · 0% AI
2026-090 · 0% AI
2026-102 · 0% AI
2026-110 · 0% AI

Evidence by analyzer

Explicit AI attributionok

attributed_commit_share: 0.0%
attributed_commits: 0
attributed_loc: 0
attributed_loc_share: 0.0%
commits: 3,014
effective_loc: 236,897
tools_detected: 0

AI tool configurationok2 items

artifacts: 2
earliest_adoption: 2026-09-16
tools_configured: 2
workflow_agents: 0

Commit velocityok

excluded_import_loc: 17,231
flagged_loc: 0
flagged_loc_share: 0.0%
flagged_units: 0
max_loc_per_hour: 3,412
measured_loc: 216,682
median_loc_per_hour: 42.77
pr_timed_units: 1,051
pre_ai_era_burst_loc: 22,077
pre_ai_era_bursts: 11
pre_ai_era_measured_loc: 176,201
work_units: 1,882

Release velocityok

flagged_releases: 0
max_loc_per_day: 1,047.20
releases: 99

Coding styleok8 items

count:assistant_voice: 1
count:emoji_in_code: 0
count:narrated_steps: 20
count:placeholder: 0
files:assistant_voice: 1
files:emoji_in_code: 0
files:narrated_steps: 9
files:placeholder: 0
index: 0.40
lines_scanned: 55,055
per_kloc:assistant_voice: 0.02
per_kloc:emoji_in_code: 0
per_kloc:narrated_steps: 0.36
per_kloc:placeholder: 0

Code quality

76 adequate

Code quality is adequate: test-to-source ratio 1.05, no CI test run detected; 3% of function code in complex or long functions; 10% duplicated lines. Weakest area: type safety.

How the score is built

Complexity92
Duplication55
Lint and smells100
Tests and CI55
Documentation100
Type safety40
Review process90

Evidence by analyzer

Complexity (lizard)ok8 items

complex_functions: 7
function_nloc: 17,630
functions: 2,613
long_functions: 2
many_param_functions: 2
mean_ccn: 1.87
p90_ccn: 4
risky_nloc_share: 2.9%

Duplication (jscpd)ok10 items

compared_lines: 36,378
duplicated_lines: 3,604
duplicated_share: 9.9%
files: 456

Lintok

findings: 0
scanned_lines: 55,055
weighted_findings: 0

Tests and CIok

check:ci_present: no
check:ci_runs_lint: no
check:ci_runs_tests: no
check:has_tests: yes
check:test_ratio: yes
check:tests_cochange: yes
ci_files: 0
cochange_commits: 203
cochange_share: 35.0%
source_lines: 55,055
test_lines: 57,807
test_ratio: 1.05

Documentationok4 items

README.md README.md
LICENSE.txt LICENSE.txt
CONTRIBUTING.md CONTRIBUTING.md
CHANGES.md CHANGES.md

check:changelog: yes
check:contributing: yes
check:license: yes
check:readme: yes
readme_lines: 224

Type safetyok

check:low_escape_density: yes
check:strict_config: no
escapes: 0
escapes_per_kloc: 0

Security

68 weak

Security posture is weak: 0 possible secret(s) in the tree, 1 only in history. Weakest area: posture.

How the score is built

Secrets79
Static analysis (SAST)100
Vulnerable dependenciesnot measured
CI workflowsnot measured
Security posture20
OpenSSF Scorecard23

Evidence by analyzer

OpenSSF Scorecardok8 items

aggregate: 5
check:Binary-Artifacts: yes
check:CII-Best-Practices: no
check:Code-Review: yes
check:Fuzzing: no
check:License: yes
check:Maintained: yes
check:SAST: no
check:Security-Policy: no

Package registriesskipped

no registry dependencies declared

Secrets (gitleaks)ok

secrets_current: 0
secrets_history: 1
secrets_low_confidence: 2
secrets_nonprod: 0

Static analysis (opengrep)ok

findings: 0
findings_high: 0
findings_low: 0
findings_medium: 0
parse_errors: 13
scanned_lines: 55,055
weighted_findings: 0

Dependencies (osv-scanner)skipped

CI workflows (zizmor)skipped

Security postureok1 item

kotlinx-coroutines-test/npm/package.json has no lockfile alongside it (unpinned dependencies) kotlinx-coroutines-test/npm/package.json

check:dependency_updates: no
check:lockfiles: no
check:security_policy: no
check:signed_commits: yes
signed_commit_share: 88.5%
unpinned_manifests: 1

Release downloadsok

binary_assets: 0
signals: 0
suspicious: 0

Findings

1 medium2 low

Severity	Rule	Location	Message	Tool
medium	`gitleaks/jwt`	buildSrc/gradle.properties:5	Possible jwt secret in history (commit 8da6f38ad4); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	binary-compatibility-validator/src/main/kotlin/kotlinx/coroutines/experimental/tools/asmUtils.kt:130	Possible generic-api-key secret in history (commit 74bcc923bb); removed from the current tree but still retrievable	Secrets (gitleaks)
low	`gitleaks/generic-api-key`	example-frontend-js/main.bundle.js.map:1	Possible generic-api-key secret in history (commit 6738825058); removed from the current tree but still retrievable	Secrets (gitleaks)

Tools and coverage

Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.

Analyzer	Pillar	Status	Version	Findings	Note
AI tool configuration	AI provenance	ok	`signatures-v1`	0
Explicit AI attribution	AI provenance	ok	`signatures-v1`	0
Release velocity	AI provenance	ok	`prov-5`	0
Coding style	AI provenance	ok	`—`	0
Commit velocity	AI provenance	ok	`prov-5`	0
Complexity (lizard)	Code quality	ok	`lizard 1.25.1`	0
Documentation	Code quality	ok	`—`	0
Duplication (jscpd)	Code quality	ok	`repotrust-dup-w6`	0
Lint	Code quality	ok	`opengrep 1.33.1; rules f1d2b562b414`	0
Tests and CI	Code quality	ok	`—`	0
Type safety	Code quality	ok	`—`	0
CI workflows (zizmor)	Security	skipped	`—`	0
Dependencies (osv-scanner)	Security	skipped	`—`	0
Release downloads	Security	ok	`—`	0
Security posture	Security	ok	`—`	0
Package registries	Security	skipped	`—`	0	no registry dependencies declared
Static analysis (opengrep)	Security	ok	`opengrep 1.33.1; rules f1d2b562b414`	0
OpenSSF Scorecard	Security	ok	`scorecard v5.6.0`	0
Secrets (gitleaks)	Security	ok	`gitleaks 8.30.1`	3

Score history

Scored	Commit	Scoring	AI provenance	Quality	Security
2026-11-14	`ead082131ceb`	`prov-5+qual-2+sec-2`	0%	76	68

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/Kotlin/kotlinx.coroutines/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/Kotlin/kotlinx.coroutines/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/Kotlin/kotlinx.coroutines/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/Kotlin/kotlinx.coroutines/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/Kotlin/kotlinx.coroutines/security.svg)](https://repotrust.synapticcyber.com/r/github.com/Kotlin/kotlinx.coroutines/)

Full text report

Repository: https://github.com/Kotlin/kotlinx.coroutines
Commit: ead082131ceb45b8e4fda027c74471103c1cd09f
Generated: 2026-11-14T16:03:39+00:00
Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	possible	65%	100%
Code quality	76	adequate	90%	100%
Security	68	weak	85%	100%

AI provenance

Weak signals consistent with AI-assisted development.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
AI tooling configured in repo: claude-code, generic-agent
Stylometry index: 0.40 per 1,000 lines (narrated steps 20, placeholders 0, assistant phrasing 1, emoji 0). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2025-09	19	0%
2025-10	186	0%
2025-11	698	0%
2025-12	129	0%
2026-02	7	0%
2026-03	1,363	0%
2026-04	3,377	0%
2026-05	12	0%
2026-06	269	0%
2026-07	17	0%
2026-08	5	0%
2026-10	2	0%

Evidence

CLAUDE.md (claude-code configuration) (CLAUDE.md)
AGENTS.md (generic-agent configuration) (AGENTS.md)
step-by-step narration comment: * Then, true means that warnings should be treated as errors, false means that they should not. (buildSrc/src)
step-by-step narration comment: // First, try the fast-fast error path for Guava ListenableFutures. This will save allocating an (integration/)
step-by-step narration comment: // Finally, if this isn't done yet, attach a Listener that will complete the Deferred. (integration/)
step-by-step narration comment: // Step 1: Create nodes and install them as completion handlers, they may fire! (kotlinx-coro)
step-by-step narration comment: // Step 2: Set disposer to each node (kotlinx-coro)
step-by-step narration comment: // Step 3: Now we can check if continuation is complete (kotlinx-coro)
step-by-step narration comment: * Finally, an exception is considered to have been propagated (kotlinx-coro)
step-by-step narration comment: // First, try to add a child along the cancellation handlers (kotlinx-coro)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 1.05, no CI test run detected; 3% of function code in complex or long functions; 10% duplicated lines. Weakest area: type safety.

Area	Score
Complexity (lizard)	92
Duplication	55
Code smells (Opengrep)	100
Tests and CI	55
Documentation	100
Type safety	40
Process (Scorecard review/maintenance)	90

Functions: 2,613; mean complexity 1.9, 90th percentile 4; 7 complex and 2 long functions
Duplicated lines: 9.9% of 36,378 compared
Tests: 57,807 test lines for 55,055 source lines (ratio 1.05); CI test commands: none detected; 35% of recent source commits also change tests
Docs missing or thin: none

Most complex functions:

Security

Security posture is weak: 0 possible secret(s) in the tree, 1 only in history. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	79
Static analysis (Opengrep)	100
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	23

Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles
OpenSSF Scorecard aggregate: 5.0/10 (published 2026-11-09)

Top findings

Severity	Finding	Location
medium	`gitleaks/jwt`: Possible jwt secret in history (commit 8da6f38ad4); removed from the current tree but still retrievable	buildSrc/gradle.properties:5
low	`gitleaks/generic-api-key`: Possible generic-api-key secret in history (commit 6738825058); removed from the current tree but still retrievable	example-frontend-js/main.bundle.js.map:1
low	`gitleaks/generic-api-key`: Possible generic-api-key secret in history (commit 74bcc923bb); removed from the current tree but still retrievable	binary-compatibility-validator/src/main/kotlin/kotlinx/coroutines/experimental/tools/asmUtils.kt:130

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 55,055; test lines: 57,807

Language	Lines
Kotlin	111,620
Java	1,071
Shell	96
Python	75