Leaderboard github.com
ZiniuLu/Python-100-Days
出处：https://github.com/jackfrued/Python-100-Days.git
AI provenance
0%
none-detected
- Confidence
- 57%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
35/100
poor
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
68/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% none-detected
No AI attribution or AI-consistent velocity signals detected.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts0%
- Estimated AI-generated share0%
- AI tool configuration files0
- Work sessions at AI pace0
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)0.00
Lines added per month all AI-attributed share
- 2018-031,027 · 0% AI
- 2018-043,608 · 0% AI
- 2018-051,715 · 0% AI
- 2018-061,514 · 0% AI
Evidence by analyzer
Explicit AI attributionok
- attributed_commit_share
- 0.0%
- attributed_commits
- 0
- attributed_loc
- 0
- attributed_loc_share
- 0.0%
- commits
- 67
- effective_loc
- 7,864
- tools_detected
- 0
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok
- excluded_import_loc
- 0
- flagged_loc
- 0
- flagged_loc_share
- 0.0%
- flagged_units
- 0
- max_loc_per_hour
- 902
- measured_loc
- 7,864
- median_loc_per_hour
- 87.12
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 3,608
- pre_ai_era_bursts
- 1
- pre_ai_era_measured_loc
- 7,864
- work_units
- 23
Release velocityskipped
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0
- lines_scanned
- 7,867
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Code quality
35 poor
Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 19% duplicated lines. Weakest area: testing.
How the score is built
- Complexity100
- Duplication33
- Lint and smells4
- Tests and CI0
- Documentation40
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok
- complex_functions
- 0
- function_nloc
- 2,293
- functions
- 386
- long_functions
- 0
- many_param_functions
- 0
- mean_ccn
- 1.73
- p90_ccn
- 3
- risky_nloc_share
- 0.0%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: Day01-15/Day01/peppa_pig.py:112 and Day01-15/Day01/peppa_pig.py:134
- 6+ duplicated lines: Day01-15/Day02/variable1.py:13 and Day01-15/Day02/variable2.py:13
- 6+ duplicated lines: Day01-15/Day08/clock.py:32 and Day01-15/Day09/clock.py:19
- 6+ duplicated lines: Day01-15/Day08/student.py:37 and Day01-15/Day09/dependency.py:74
- 6+ duplicated lines: Day01-15/Day09/car1.py:48 and Day01-15/Day09/car2.py:41
- 6+ duplicated lines: Day01-15/Day11/ex1.py:3 and Day01-15/Day11/ex2.py:3
- 6+ duplicated lines: Day01-15/Day13/coroutine1.py:5 and Day01-15/Day13/coroutine2.py:5
- 6+ duplicated lines: Day01-15/Day13/multithread1.py:3 and Day01-15/Day13/multithread2.py:3
- 6+ duplicated lines: Day01-15/Day13/multithread2.py:6 and Day01-15/Day13/singlethread1.py:6
- 6+ duplicated lines: Day01-15/Day13/multithread2.py:28 and Day01-15/Day13/multithread3.py:37
- compared_lines
- 5,292
- duplicated_lines
- 988
- duplicated_share
- 18.7%
- files
- 226
Lintok
- category:best-practice
- 51
- category:correctness
- 5
- category:maintainability
- 1
- findings
- 57
- scanned_lines
- 7,860
- weighted_findings
- 101
Tests and CIok
- check:ci_present
- no
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- no
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 0
- cochange_commits
- 28
- cochange_share
- 0.0%
- source_lines
- 7,867
- test_lines
- 0
- test_ratio
- 0
Documentationok1 item
- README.md
README.md
- check:changelog
- no
- check:contributing
- no
- check:license
- no
- check:readme
- yes
- readme_lines
- 201
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 0
- escapes_per_kloc
- 0
Security
68 weak
Security posture is weak: 4 high-severity SAST findings. Weakest area: posture.
How the score is built
- Secrets100
- Static analysis (SAST)62
- Vulnerable dependenciesnot measured
- CI workflowsnot measured
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesskipped
no registry dependencies declared
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 18
- findings_high
- 4
- findings_low
- 4
- findings_medium
- 10
- parse_errors
- 0
- scanned_lines
- 7,860
- weighted_findings
- 10.56
Dependencies (osv-scanner)skipped
CI workflows (zizmor)skipped
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 1.5%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
26 high45 medium4 low
75 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
Day01-15/Day02/operator.py:32 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day07/marquee.py:19 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day08/clock.py:52 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day09/clock.py:39 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.correctness.list-modify-while-iterate |
Day01-15/Day10/ball.py:94 | It appears that `balls` is a list that is being modified while in a for loop. This will likely cause a runtime error or an infinite loop. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day11/ex3.py:27 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day11/file1.py:23 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/coroutine1.py:33 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/coroutine2.py:22 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/multiprocess1.py:23 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/multithread4.py:23 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/multithread5.py:26 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/multithread6.py:26 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/multithread6.py:43 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/singlethread2.py:18 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/test2.py:22 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day01-15/Day13/test3.py:49 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day66-75/code/coroutine01.py:17 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day66-75/code/coroutine02.py:20 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day66-75/code/coroutine02.py:31 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day66-75/code/generator02.py:13 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
Day66-75/code/main.py:126 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
Day01-15/Day13/multiprocess3.py:21 | Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args |
Day01-15/Day13/multiprocess3.py:21 | Detected subprocess function 'call' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
Day66-75/code/example01.py:77 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.unverified-ssl-context |
Day66-75/code/example05.py:76 | Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.correctness.baseclass-attribute-override |
Day01-15/Day09/multi.py:55 | Class Son inherits from both `Father` and `Monk` which both have a method named `$F`; one of these methods will be overwritten. | Lint |
| medium | opengrep/python.lang.correctness.baseclass-attribute-override |
Day01-15/Day09/multi.py:55 | Class Son inherits from both `Father` and `Musician` which both have a method named `$F`; one of these methods will be overwritten. | Lint |
| medium | opengrep/python.lang.correctness.baseclass-attribute-override |
Day01-15/Day09/multi.py:55 | Class Son inherits from both `Monk` and `Musician` which both have a method named `$F`; one of these methods will be overwritten. | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
Day01-15/Day11/csv1.py:16 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
Day01-15/Day11/csv2.py:39 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
Day01-15/Day11/ex3.py:16 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
Day01-15/Day11/file1.py:20 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
Day01-15/Day11/file1.py:27 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
Day01-15/Day11/file2.py:12 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
Day01-15/Day11/file3.py:24 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day01-15/Day14/mmdownloader.py:15 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day01-15/Day14/mmdownloader.py:15 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day01-15/Day14/mmdownloader.py:22 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day01-15/Day14/mmdownloader.py:22 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.lang.maintainability.code-after-unconditional-return |
Day41-55/car/search/models.py:13 | code after return statement will not be executed | Lint |
| medium | opengrep/python.lang.best-practice.pass-body-fn |
Day41-55/shop_origin/cart/views.py:15 | `pass` is the body of function add_to_cart. Consider removing this or raise NotImplementedError() if this is a TODO | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day66-75/code/example03.py:10 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/example03.py:10 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day66-75/code/example03.py:20 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/example03.py:20 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day66-75/code/example04.py:16 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/example04.py:16 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day66-75/code/example06.py:23 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/example06.py:23 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day66-75/code/example06.py:40 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/example06.py:40 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day66-75/code/example08.py:22 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/example08.py:22 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/example08.py:6 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day66-75/code/example12.py:21 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/example12.py:21 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day66-75/code/main.py:62 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/main.py:62 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.requests.best-practice.use-raise-for-status |
Day66-75/code/main_redis.py:67 | There's an HTTP request made with requests, but the raise_for_status() utility method isn't used. This can result in request errors going unnoticed and your code behaving in unexpected ways, such as if your authorization API returns a... | Lint |
| medium | opengrep/python.requests.best-practice.use-timeout |
Day66-75/code/main_redis.py:67 | Detected a 'requests' call without a timeout set. By default, 'requests' calls wait until the connection is closed. This means a 'requests' call without a timeout will hang the program if a response is never received. Consider setting a... | Lint |
| medium | opengrep/python.django.security.django-no-csrf-token |
Day21-30/form_and_table.html:98 | Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.django.security.audit.django-secure-set-cookie |
Day41-55/car/search/views.py:43 | Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
Day66-75/code/example01.py:28 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
Day66-75/code/example05.py:36 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-md5 |
Day66-75/code/example05.py:69 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.deserialization.avoid-pickle |
Day66-75/code/example05.py:71 | Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
Day66-75/code/example06.py:28 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.deserialization.avoid-pickle |
Day66-75/code/example06.py:42 | Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.deserialization.avoid-pickle |
Day66-75/code/main_redis.py:124 | Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
Day66-75/code/main_redis.py:136 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| low | opengrep/python.lang.security.use-defusedcsv |
Day01-15/Day11/csv2.py:40 | Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet... | Static analysis (opengrep) |
| low | opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http |
Day01-15/Day14/mmdownloader.py:23 | Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium] | Static analysis (opengrep) |
| low | opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http |
Day66-75/code/example03.py:10 | Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium] | Static analysis (opengrep) |
| low | opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http |
Day66-75/code/example03.py:20 | Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium] | Static analysis (opengrep) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 57 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | skipped | — | 0 | |
| Dependencies (osv-scanner) | Security | skipped | — | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | skipped | — | 0 | no registry dependencies declared |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 18 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 0 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | d4d159d1d6a7 | prov-5+qual-2+sec-2 | 0% | 35 | 68 |
| 2026-11-14 | d4d159d1d6a7 | prov-4+qual-2+sec-2 | 0% | 35 | 68 |
Full text report
- Repository: https://github.com/ZiniuLu/Python-100-Days
- Commit:
d4d159d1d6a7ad37da45a90ca4cdd2da6fef848c - Generated: 2026-11-14T14:52:02+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 57% | 100% |
| Code quality | 35 | poor | 90% | 100% |
| Security | 68 | weak | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2018-03 | 1,027 | 0% |
| 2018-04 | 3,608 | 0% |
| 2018-05 | 1,715 | 0% |
| 2018-06 | 1,514 | 0% |
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 0% of function code in complex or long functions; 19% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 100 |
| Duplication | 33 |
| Code smells (Opengrep) | 4 |
| Tests and CI | 0 |
| Documentation | 40 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 386; mean complexity 1.7, 90th percentile 3; 0 complex and 0 long functions
- Duplicated lines: 18.7% of 5,292 compared
- Tests: 0 test lines for 7,867 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
- Docs missing or thin: license, contributing, changelog
Security
Security posture is weak: 4 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 62 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
Day01-15/Day13/multiprocess3.py:21 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args: Detected subprocess function 'call' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium] |
Day01-15/Day13/multiprocess3.py:21 |
| high | opengrep/python.lang.security.unverified-ssl-context: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] |
Day66-75/code/example01.py:77 |
| high | opengrep/python.lang.security.unverified-ssl-context: Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead. [confidence medium] |
Day66-75/code/example05.py:76 |
| medium | opengrep/python.django.security.django-no-csrf-token: Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks. [confidence medium] |
Day21-30/form_and_table.html:98 |
| medium | opengrep/python.django.security.audit.django-secure-set-cookie: Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side [confidence low] |
Day41-55/car/search/views.py:43 |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low] |
Day66-75/code/example01.py:28 |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low] |
Day66-75/code/example05.py:36 |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-md5: Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] |
Day66-75/code/example05.py:69 |
| medium | opengrep/python.lang.security.deserialization.avoid-pickle: Avoid using pickle, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. [confidence low] |
Day66-75/code/example05.py:71 |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] |
Day66-75/code/example06.py:28 |
| medium | opengrep/python.lang.security.deserialization.avoid-pickle: Avoid using pickle, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. [confidence low] |
Day66-75/code/example06.py:42 |
| medium | opengrep/python.lang.security.deserialization.avoid-pickle: Avoid using pickle, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format. [confidence low] |
Day66-75/code/main_redis.py:124 |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] |
Day66-75/code/main_redis.py:136 |
| low | opengrep/python.lang.security.use-defusedcsv: Detected the generation of a CSV file using the built-in csv module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the [confidence low] |
Day01-15/Day11/csv2.py:40 |
| low | opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium] |
Day01-15/Day14/mmdownloader.py:23 |
| low | opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium] |
Day66-75/code/example03.py:10 |
| low | opengrep/python.lang.security.audit.insecure-transport.requests.request-with-http: Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead. [confidence medium] |
Day66-75/code/example03.py:20 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 7,867; test lines: 0
| Language | Lines |
|---|---|
| Python | 7,860 |
| SQL | 7 |