fedorananin/serverus
SSH/SFTP/FTP/S3 connection manager for macOS/Windows/Linux — terminal, dual-pane file manager and tunnels in one window, behind a single encrypted vault unlocked with Touch ID or Windows Hello.
- Repository: https://github.com/fedorananin/serverus
- Commit:
bd63ae972529dd35d4c70178b5ba8c868dceceb5 - Generated: 2026-11-13T23:48:38+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 5 | explicit | 92% | 100% |
| Code quality | 85 | strong | 90% | 100% |
| Security | 50 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 5% of first-party code added; an estimated 5% including velocity signals.
- Explicitly attributed share (lower bound): 5.4%
- Unattributed share in AI-consistent velocity bursts: 13.4%
- Estimated AI-generated share: 5.4%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 12 | 3,123 |
| Claude Code | 7 | 1,029 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 623 of 45,901.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 1.038 | 0.0x |
| Security | 1.605 | 0.618 | 2.6x |
- Stylometry index: 0.27 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 25). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-07 | 58,018 | 7% |
| 2026-08 | 1,918 | 0% |
| 2026-09 | 13,796 | 2% |
| 2026-10 | 3,617 | 0% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (28032c50af04)
- Claude Code: trailer 'Co-Authored-By: Claude' (40af17b139f7)
- Claude Code: trailer 'Co-Authored-By: Claude' (e5a4fc732d62)
- Claude Code: trailer 'Co-Authored-By: Claude' (5fb78e948923)
- Claude Code: trailer 'Co-Authored-By: Claude' (af7f2ab5d8d9)
- Claude Code: trailer 'Co-Authored-By: Claude' (28e6bf94e42b)
- Claude Code: trailer 'Co-Authored-By: Claude' (e515a5330a62)
- OpenAI Codex: on merged branch (3e36c1f650) (3abdb25d5ae9)
- OpenAI Codex: on merged branch (301a8a6d38) (011c2e53750a)
- OpenAI Codex: on merged branch (8d28e43d01) (746b0b2a228b)
- OpenAI Codex: on merged branch (46101373b5) (7d69c16cfc9c)
- OpenAI Codex: on merged branch (1347400ddc) (35961f91851e)
- OpenAI Codex: on merged branch (ed1e25e040) (d747a2c957b7)
- OpenAI Codex: on merged branch (3d1b353be5) (d5c87539483c)
- OpenAI Codex: on merged branch (60ffc77a6b) (906558364ca1)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 0.40, CI runs tests; 8% of function code in complex or long functions; 4% duplicated lines. Weakest area: docs.
| Area | Score |
|---|---|
| Complexity (lizard) | 79 |
| Duplication | 78 |
| Code smells (Opengrep) | 91 |
| Tests and CI | 95 |
| Documentation | 65 |
| Type safety | 100 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,199; mean complexity 2.6, 90th percentile 6; 23 complex and 6 long functions
- Duplicated lines: 4.0% of 33,149 compared
- Tests: 18,488 test lines for 45,901 source lines (ratio 0.40); CI test commands: npm run test, go test, cargo test; 65% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- run_single in src-tauri/src/transfer/single_transfer.rs: complexity 59, 211 lines
- visit in e2e-scenarios/src/scenario-input-gate.ts: complexity 37, 60 lines
- copy_recursive_inner in src-tauri/src/commands/local_copy.rs: complexity 27, 101 lines
- enqueue_download_inner in src-tauri/src/transfer/enqueue_download.rs: complexity 26, 146 lines
- compare_subtree in src-tauri/src/session/compare.rs: complexity 23, 76 lines
Security
Security posture is poor: 137 known vulnerabilities in 48 dependencies; 1 high-severity SAST findings; 18 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 94 |
| Vulnerable dependencies (OSV) | 2 |
| CI workflows (zizmor) | 4 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 137 in 48 packages (critical 1, high 38, medium 59, low 20)
-
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/RUSTSEC-2026-0482: [email protected] (crates.io) is affected by RUSTSEC-2026-0482 |
Cargo.lock |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: process.platform === 'win32'}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
scripts/with-signing-env.mjs:38 |
| high | osv/GHSA-47hw-gvq5-r2gm: [email protected] (crates.io) is affected by RUSTSEC-2026-0492, GHSA-47hw-gvq5-r2gm |
Cargo.lock |
| high | osv/GHSA-vp5q-ff62-jwqv: [email protected] (crates.io) is affected by RUSTSEC-2026-0495, GHSA-vp5q-ff62-jwqv |
Cargo.lock |
| high | osv/GHSA-82j2-j2ch-gfr8: [email protected] (crates.io) is affected by RUSTSEC-2026-0104, GHSA-82j2-j2ch-gfr8 |
Cargo.lock |
| high | osv/GHSA-c475-qrg2-pj4r: [email protected] (npm) is affected by GHSA-c475-qrg2-pj4r |
package-lock.json |
| high | osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p |
package-lock.json |
| high | osv/GHSA-mh99-v99m-4gvg: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg |
package-lock.json |
| high | osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 |
package-lock.json |
| high | osv/GHSA-rgw5-rvv9-x895: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 |
package-lock.json |
| high | osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p |
package-lock.json |
| high | osv/GHSA-mh99-v99m-4gvg: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg |
package-lock.json |
| high | osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 |
package-lock.json |
| high | osv/GHSA-rgw5-rvv9-x895: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 |
package-lock.json |
| high | osv/GHSA-ggr8-5vv4-36mx: [email protected] (npm) is affected by GHSA-ggr8-5vv4-36mx |
package-lock.json |
| high | osv/GHSA-j22f-vq7h-c4qm: [email protected] (npm) is affected by GHSA-j22f-vq7h-c4qm |
package-lock.json |
| high | osv/GHSA-mcm9-63f2-9j32: [email protected] (npm) is affected by GHSA-mcm9-63f2-9j32 |
package-lock.json |
| high | osv/GHSA-r9w8-h9r3-54w4: [email protected] (npm) is affected by GHSA-r9w8-h9r3-54w4 |
package-lock.json |
| high | osv/GHSA-x5rw-q4pp-hg5g: [email protected] (npm) is affected by GHSA-x5rw-q4pp-hg5g |
package-lock.json |
| high | osv/GHSA-7pqw-9j4j-h8q3: [email protected] (npm) is affected by GHSA-7pqw-9j4j-h8q3 |
package-lock.json |
| high | osv/GHSA-jmr9-qjv8-65gv: [email protected] (npm) is affected by GHSA-jmr9-qjv8-65gv |
package-lock.json |
| high | osv/GHSA-8r6m-32jq-jx6q: [email protected] (npm) is affected by GHSA-8r6m-32jq-jx6q |
package-lock.json |
| high | osv/GHSA-mwp4-54f8-5fhr: [email protected] (npm) is affected by GHSA-mwp4-54f8-5fhr |
package-lock.json |
| high | osv/GHSA-2883-xcg3-v3hh: [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh |
package-lock.json |
| high | osv/GHSA-5p4m-2wfm-xmqj: [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj |
package-lock.json |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v1.8.0 ships Serverus-1.8.0-1.aarch64.rpm (1 downloads)
- binary-release-asset: release v1.8.0 ships Serverus-1.8.0-1.x86_64.rpm (1 downloads)
- binary-release-asset: release v1.8.0 ships Serverus_1.8.0_aarch64.AppImage (1 downloads)
- binary-release-asset: release v1.8.0 ships Serverus_1.8.0_aarch64.dmg (13 downloads)
- binary-release-asset: release v1.8.0 ships Serverus_1.8.0_amd64.AppImage (3 downloads)
- readme-download-lure: gives an archive password
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 45,901; test lines: 18,488
| Language | Lines |
|---|---|
| Rust | 40,258 |
| TypeScript | 14,992 |
| Svelte | 8,036 |
| JavaScript | 1,103 |