Leaderboard github.com
ggirelli/folia-web
Folia: Multi-modality Rust Static Website Generator
AI provenance
100%
explicit
- Confidence
- 92%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
82/100
strong
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
77/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
100% explicit
Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.
How the score is built
- Explicitly attributed share100%
- Unattributed share in AI-pace bursts0%
- Estimated AI-generated share100%
- AI tool configuration files1
- Work sessions at AI pace6
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.12
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 89 | 41,371 | 2026-10-25 | 2026-11-12 |
Lines added per month all AI-attributed share
- 2026-1010,748 · 100% AI
- 2026-1130,623 · 100% AI
Findings in AI-attributed lines vs the rest
From git blame: 38,160 lines trace to AI-attributed commits, 0 to others. Too few lines in one group for a fair comparison. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.47 | — | — |
| Security | 0.63 | — | — |
Evidence by analyzer
Explicit AI attributionok26 items
- Claude Code: 89 attributed commits, 41,371 lines added
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: message 'Generated with [Claude Code'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: trailer 'Co-authored-by: Claude'
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: PR description attribution
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 100.0%
- attributed_commits
- 89
- attributed_loc
- 41,371
- attributed_loc_share
- 100.0%
- commits
- 89
- effective_loc
- 41,371
- tools_detected
- 1
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2026-10-25
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok6 items
- 7,868 lines of first-party code in ~4.4h (1,796 lines/hour, 5 commit session)
- 1,204 lines of first-party code in ~0.8h (1,545 lines/hour, 1 commit session)
- 5,356 lines of first-party code in ~4.0h (1,339 lines/hour, 1 commit session)
- 3,293 lines of first-party code in ~4.0h (823 lines/hour, 1 commit session)
- 1,684 lines of first-party code in ~2.5h (662 lines/hour, 3 commit session)
- 2,256 lines of first-party code in ~3.9h (576 lines/hour, 1 commit session)
- excluded_import_loc
- 0
- flagged_loc
- 21,661
- flagged_loc_share
- 52.4%
- flagged_units
- 6
- max_loc_per_hour
- 1,796.35
- measured_loc
- 41,371
- median_loc_per_hour
- 476.98
- pr_timed_units
- 48
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 61
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 1,759.60
- releases
- 1
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 9
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 3
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0.12
- lines_scanned
- 38,160
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.24
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 38,160
- blame_failures
- 0
- files_blamed
- 130
- other_lines
- 0
- quality:ai_findings
- 18
- quality:ai_per_kloc
- 0.47
- quality:other_findings
- 0
- security:ai_findings
- 24
- security:ai_per_kloc
- 0.63
- security:other_findings
- 0
Code quality
82 strong
Code quality is strong: test-to-source ratio 0.03, CI runs tests; 7% of function code in complex or long functions; 2% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity82
- Duplication91
- Lint and smells93
- Tests and CI73
- Documentation100
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- report in parity/accept.py: complexity 33, 115 lines
- build_page in crates/pages/src/lib.rs: complexity 30, 100 lines
- check in crates/parity/src/document/ledger.rs: complexity 27, 93 lines
- markdown in parity/accept.py: complexity 26, 110 lines
- quote_at in crates/core/src/content/markdown/typography.rs: complexity 23, 53 lines
- run in crates/parity/src/markdown/mod.rs: complexity 23, 65 lines
- content_type in crates/folia/src/serve/files.rs: complexity 22, 30 lines
- entry in crates/parity/src/coverage.rs: complexity 22, 92 lines
- build_entry in crates/micro/src/entry.rs: complexity 20, 106 lines
- decided_class in crates/parity/src/coverage.rs: complexity 20, 88 lines
- complex_functions
- 21
- function_nloc
- 24,518
- functions
- 1,511
- long_functions
- 6
- many_param_functions
- 2
- mean_ccn
- 2.79
- p90_ccn
- 7
- risky_nloc_share
- 6.8%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: crates/core/src/content/git.rs:118 and crates/parity/src/routes.rs:466
- 6+ duplicated lines: crates/core/src/content/git.rs:120 and crates/folia/src/build/tests.rs:68
- 6+ duplicated lines: crates/folia/src/build/tests.rs:66 and crates/parity/src/builds/tests.rs:63
- 6+ duplicated lines: crates/folia/src/build/tests.rs:150 and crates/folia/src/discover/tests.rs:47
- 6+ duplicated lines: crates/folia/src/build/tests.rs:513 and crates/folia/src/build/tests.rs:668
- 6+ duplicated lines: crates/folia/src/discover/tests.rs:13 and crates/folia/src/render/tests.rs:12
- 6+ duplicated lines: crates/folia/src/discover/tests.rs:14 and crates/parity/src/liquid/tests.rs:129
- 6+ duplicated lines: crates/folia/src/feed/tests.rs:23 and crates/folia/src/search/tests.rs:17
- 6+ duplicated lines: crates/folia/src/feed/tests.rs:162 and crates/folia/src/feed/tests.rs:220
- 6+ duplicated lines: crates/folia/src/main.rs:42 and crates/folia/src/main.rs:80
- compared_lines
- 28,617
- duplicated_lines
- 432
- duplicated_share
- 1.5%
- files
- 130
Lintok
- category:correctness
- 16
- category:maintainability
- 2
- findings
- 18
- scanned_lines
- 38,160
- weighted_findings
- 11.25
Tests and CIok5 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/docs.yml
.github/workflows/docs.yml - CI config: .github/workflows/release.yml
.github/workflows/release.yml - CI runs tests (go test, cargo test, just test)
- CI runs linters (clippy, rustfmt)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 3
- cochange_commits
- 63
- cochange_share
- 15.9%
- source_lines
- 38,160
- test_lines
- 1,301
- test_ratio
- 0.03
Documentationok4 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md - CHANGELOG.md
CHANGELOG.md
- check:changelog
- yes
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 66
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 0
- escapes_per_kloc
- 0
Security
77 adequate
Security posture is adequate: 1 known vulnerabilities in 1 dependencies; 21 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets100
- Static analysis (SAST)94
- Vulnerable dependencies95
- CI workflows1
- Security posture60
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 21
- declared
- 21
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 24
- findings_high
- 0
- findings_low
- 23
- findings_medium
- 1
- parse_errors
- 4
- scanned_lines
- 38,160
- weighted_findings
- 6.35
Dependencies (osv-scanner)ok
- penalty
- 3
- vulnerabilities
- 1
- vulnerable_packages
- 1
- vulns_critical
- 0
- vulns_high
- 0
- vulns_low
- 0
- vulns_medium
- 0
- vulns_unknown
- 1
CI workflows (zizmor)ok
- findings
- 27
- findings_high
- 21
- findings_low
- 0
- findings_medium
- 6
- penalty
- 262
- workflows
- 3
Security postureok8 items
- Dependency updates: .github/dependabot.yml
.github/dependabot.yml - crates/blog/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/blog/Cargo.toml - crates/core/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/core/Cargo.toml - crates/folia/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/folia/Cargo.toml - crates/garden/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/garden/Cargo.toml - crates/micro/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/micro/Cargo.toml - crates/pages/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/pages/Cargo.toml - crates/parity/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/parity/Cargo.toml
- check:dependency_updates
- yes
- check:lockfiles
- no
- check:security_policy
- no
- check:signed_commits
- yes
- signed_commit_share
- 100.0%
- unpinned_manifests
- 7
Release downloadsok2 items
- release v0.2.0 ships folia-v0.2.0-x86_64-unknown-linux-gnu.tar.gz (7 downloads)
- release v0.1.0 ships folia-v0.1.0-x86_64-unknown-linux-gnu.tar.gz (15 downloads)
- binary_assets
- 2
- signals
- 1
- suspicious
- 0
Findings
21 high17 medium32 low
70 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:26 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:27 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:30 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:31 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:45 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:46 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:47 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:54 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:61 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:62 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:63 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:66 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:76 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:77 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:81 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs.yml:28 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs.yml:29 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs.yml:32 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docs.yml:48 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
parity/accept.py:386 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
parity/accept.py:446 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
parity/accept.py:537 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
parity/accept.py:816 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
parity/accept.py:826 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
parity/accept.py:845 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
parity/accept.py:849 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
parity/accept.py:856 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
parity/accept.py:895 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | zizmor/dependabot-cooldown |
.github/dependabot.yml:6 | insufficient cooldown in Dependabot updates [confidence high] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:26 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:45 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:54 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:61 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:76 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | osv/RUSTSEC-2025-0141 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2025-0141 | Dependencies (osv-scanner) |
| medium | opengrep/ruby.lang.security.dangerous-exec |
parity/jekyll/folia_dump.rb:195 | Detected non-static command inside Open3.capture2. Audit the input to 'Open3.capture2'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/accept-negative.sh:346 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/baseline.sh:118 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/baseline.sh:137 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/baseline.sh:138 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/baseline.sh:264 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/baseline.sh:288 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/baseline.sh:292 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/baseline.sh:83 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command |
scripts/check-file-length.sh:16 | Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may... | Lint |
| low | opengrep/rust.lang.security.temp-dir |
crates/core/src/content/git.rs:107 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/core/src/content/git.rs:187 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/folia/src/config.rs:382 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/folia/src/config.rs:404 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/folia/src/discover/tests.rs:12 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/folia/src/output/tests.rs:8 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/folia/src/render/tests.rs:11 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/folia/src/sass.rs:96 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/folia/src/sass/tests.rs:12 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/folia/src/serve/files.rs:157 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/folia/src/serve/http.rs:153 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/baseline.rs:123 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/builds.rs:211 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/builds/tests.rs:31 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/coverage/tests.rs:526 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/document/ledger/tests.rs:60 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/document/ledger/tests.rs:821 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/document/tests.rs:279 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/links/register/tests.rs:31 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/links/tests.rs:134 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/liquid/tests.rs:127 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/routes.rs:447 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.temp-dir |
crates/parity/src/warnings/tests.rs:191 | temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary... | Static analysis (opengrep) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-4 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 18 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 27 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 1 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 24 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 0 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 7f2f7a1486b1 | prov-5+qual-2+sec-2 | 100% | 82 | 77 |
| 2026-11-14 | 7f2f7a1486b1 | prov-4+qual-2+sec-2 | 100% | 82 | 77 |
Full text report
- Repository: https://github.com/ggirelli/folia-web
- Commit:
7f2f7a1486b140b110c16ee819c845fbcc4b5ffc - Generated: 2026-11-14T14:52:04+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 100 | explicit | 92% | 100% |
| Code quality | 82 | strong | 90% | 100% |
| Security | 77 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.
- Explicitly attributed share (lower bound): 100.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 100.0%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 89 | 41,371 |
- AI tooling configured in repo: claude-code
Current source lines last changed by AI-attributed commits: 38,160 of 38,160.
Too few lines in one group to compare finding densities.
- Stylometry index: 0.12 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 9). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-10 | 10,748 | 100% |
| 2026-11 | 30,623 | 100% |
Evidence
- Claude Code: trailer 'Co-authored-by: Claude' (7f2f7a1486b1)
- Claude Code: trailer 'Co-authored-by: Claude' (a1d83c7c283e)
- Claude Code: message 'Generated with [Claude Code' (d7b722d990df)
- Claude Code: trailer 'Co-authored-by: Claude' (0c740dc72725)
- Claude Code: message 'Generated with [Claude Code' (c216d038bf27)
- Claude Code: message 'Generated with [Claude Code' (c541b2b74b02)
- Claude Code: trailer 'Co-authored-by: Claude' (d9964b5bce7d)
- Claude Code: trailer 'Co-authored-by: Claude' (83b5119561ea)
- Claude Code: trailer 'Co-authored-by: Claude' (b9d0d880904a)
- Claude Code: trailer 'Co-authored-by: Claude' (c341e54d5b49)
- Claude Code: trailer 'Co-authored-by: Claude' (0d2561b95314)
- Claude Code: trailer 'Co-authored-by: Claude' (5e47da9fce39)
- Claude Code: PR description attribution (b49e35fc6c97)
- Claude Code: PR description attribution (04cc9d1c940f)
- Claude Code: PR description attribution (6ced507fd3c1)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 0.03, CI runs tests; 7% of function code in complex or long functions; 2% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 82 |
| Duplication | 91 |
| Code smells (Opengrep) | 93 |
| Tests and CI | 73 |
| Documentation | 100 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 1,511; mean complexity 2.8, 90th percentile 7; 21 complex and 6 long functions
- Duplicated lines: 1.5% of 28,617 compared
- Tests: 1,301 test lines for 38,160 source lines (ratio 0.03); CI test commands: go test, cargo test, just test; 16% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- report in parity/accept.py: complexity 33, 115 lines
- build_page in crates/pages/src/lib.rs: complexity 30, 100 lines
- check in crates/parity/src/document/ledger.rs: complexity 27, 93 lines
- markdown in parity/accept.py: complexity 26, 110 lines
- quote_at in crates/core/src/content/markdown/typography.rs: complexity 23, 53 lines
Security
Security posture is adequate: 1 known vulnerabilities in 1 dependencies; 21 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 94 |
| Vulnerable dependencies (OSV) | 95 |
| CI workflows (zizmor) | 1 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 1 in 1 packages (critical 0, high 0, medium 0, low 0)
-
Posture checks passed: dependency updates, signed commits; missing: security policy, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:26 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:27 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:30 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:31 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:45 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:46 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:47 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:54 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:55 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:61 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:62 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:63 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:66 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:76 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:77 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:81 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/docs.yml:25 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/docs.yml:28 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/docs.yml:29 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/docs.yml:32 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/docs.yml:48 |
| medium | opengrep/ruby.lang.security.dangerous-exec: Detected non-static command inside Open3.capture2. Audit the input to 'Open3.capture2'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence medium] |
parity/jekyll/folia_dump.rb:195 |
| medium | osv/RUSTSEC-2025-0141: [email protected] (crates.io) is affected by RUSTSEC-2025-0141 |
Cargo.lock |
| medium | zizmor/dependabot-cooldown: insufficient cooldown in Dependabot updates [confidence high] |
.github/dependabot.yml:6 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/ci.yml:26 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.2.0 ships folia-v0.2.0-x86_64-unknown-linux-gnu.tar.gz (7 downloads)
- binary-release-asset: release v0.1.0 ships folia-v0.1.0-x86_64-unknown-linux-gnu.tar.gz (15 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 38,160; test lines: 1,301
| Language | Lines |
|---|---|
| Rust | 35,340 |
| Shell | 2,375 |
| Python | 1,417 |
| Ruby | 294 |
| JavaScript | 35 |