ha/doozerd
A consistent distributed data store.
- Repository: https://github.com/ha/doozerd
- Commit:
8adec5411b39dbcc94c02b3669ee06379ec83ead - Generated: 2026-11-13T23:26:07+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 77 | adequate | 90% | 100% |
| Security | 69 | weak | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2011-02 | 4,725 | 0% |
| 2011-03 | 2,791 | 0% |
| 2011-04 | 1,256 | 0% |
| 2011-05 | 2,311 | 0% |
| 2011-06 | 804 | 0% |
| 2011-09 | 29 | 0% |
| 2011-12 | 251 | 0% |
| 2012-01 | 174 | 0% |
| 2012-02 | 35 | 0% |
| 2012-03 | 14 | 0% |
| 2013-03 | 60 | 0% |
| 2013-05 | 49 | 0% |
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 1.24, no CI test run detected; 6% of function code in complex or long functions; 3% duplicated lines. Weakest area: docs.
| Area | Score |
|---|---|
| Complexity (lizard) | 84 |
| Duplication | 81 |
| Code smells (Opengrep) | 82 |
| Tests and CI | 70 |
| Documentation | 65 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 179; mean complexity 3.1, 90th percentile 6; 2 complex and 0 long functions
- Duplicated lines: 3.5% of 2,086 compared
- Tests: 3,889 test lines for 3,139 source lines (ratio 1.24); CI test commands: none detected; 48% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
Security
Security posture is weak: 2 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 65 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
web/main.js:90 |
| high | opengrep/javascript.lang.security.detect-insecure-websocket: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low] |
web/main.js.go:5 |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used: Do not use math/rand. Use crypto/rand instead. [confidence medium] |
consensus/run.go:8 |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion: MinVersion is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web se [confidence high] |
doozerd.go:154 |
| medium | opengrep/javascript.express.security.audit.xss.mustache.var-in-script-tag: Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of [confidence low] |
web/main.html:26 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
web/web.go:13 |
| medium | opengrep/go.lang.security.audit.xss.no-io-writestring-to-responsewriter: Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low] |
web/web.go:36 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 3,139; test lines: 3,889
| Language | Lines |
|---|---|
| Go | 6,854 |
| JavaScript | 136 |
| Shell | 38 |