Leaderboard github.com
jonwiggins/cqlite
Lightweight SQLite implementation in Rust
AI provenance
62%
explicit
- Confidence
- 76%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
64/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
75/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
62% explicit
Explicit AI attribution on 62% of first-party code added; an estimated 62% including velocity signals.
How the score is built
- Explicitly attributed share62%
- Unattributed share in AI-pace bursts31%
- Estimated AI-generated share62%
- AI tool configuration files1
- Work sessions at AI pace3
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)0.10
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 7 | 15,119 | 2026-02-21 | 2026-02-21 |
Lines added per month all AI-attributed share
- 2026-0224,199 · 62% AI
Findings in AI-attributed lines vs the rest
From git blame: 13,970 lines trace to AI-attributed commits, 6,619 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.00 | 0.00 | — |
| Security | 0.21 | 0.00 | — |
Evidence by analyzer
Explicit AI attributionok8 items
- Claude Code: 7 attributed commits, 15,119 lines added
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 29.2%
- attributed_commits
- 7
- attributed_loc
- 15,119
- attributed_loc_share
- 62.5%
- commits
- 24
- effective_loc
- 24,199
- tools_detected
- 1
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2026-02-09
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok3 items
- 4,779 lines of first-party code in ~2.8h (1,691 lines/hour, 5 commit session)
- 1,317 lines of first-party code in ~1.0h (1,385 lines/hour, 1 commit session)
- 5,207 lines of first-party code in ~4.7h (1,101 lines/hour, 7 commit session)
- excluded_import_loc
- 11,267
- flagged_loc
- 11,303
- flagged_loc_share
- 87.4%
- flagged_units
- 3
- max_loc_per_hour
- 1,691.18
- measured_loc
- 12,932
- median_loc_per_hour
- 1,101.10
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 6
Release velocityskipped
Coding styleok2 items
- step-by-step narration comment: // First, determine serial types and encode values.
- step-by-step narration comment: // First, resolve what each result column maps to.
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 2
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 2
- files:placeholder
- 0
- index
- 0.10
- lines_scanned
- 20,589
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0.10
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 13,970
- blame_failures
- 0
- files_blamed
- 18
- other_lines
- 6,619
- quality:ai_findings
- 0
- quality:ai_per_kloc
- 0
- quality:other_findings
- 0
- quality:other_per_kloc
- 0
- security:ai_findings
- 3
- security:ai_per_kloc
- 0.21
- security:other_findings
- 0
- security:other_per_kloc
- 0
Code quality
64 weak
Code quality is weak: test-to-source ratio 0.10, CI runs tests; 41% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity29
- Duplication62
- Lint and smells100
- Tests and CI80
- Documentation40
- Type safetynot measured
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- call_scalar in src/functions.rs: complexity 148, 437 lines
- execute_select_with_ctes in src/vm.rs: complexity 131, 600 lines
- fmt in src/tokenizer.rs: complexity 122, 126 lines
- eval_expr in src/vm.rs: complexity 116, 257 lines
- lookup_keyword in src/tokenizer.rs: complexity 94, 98 lines
- execute_insert in src/planner.rs: complexity 66, 220 lines
- eval_aggregate_function in src/vm.rs: complexity 64, 212 lines
- parse_primary in src/parser.rs: complexity 52, 138 lines
- parse_create_table in src/parser.rs: complexity 49, 83 lines
- parse_comparison in src/parser.rs: complexity 49, 128 lines
- complex_functions
- 52
- function_nloc
- 15,678
- functions
- 701
- long_functions
- 24
- many_param_functions
- 1
- mean_ccn
- 5.57
- p90_ccn
- 12
- risky_nloc_share
- 41.4%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: src/ast.rs:451 and src/planner.rs:2890
- 6+ duplicated lines: src/btree.rs:310 and src/btree.rs:368
- 6+ duplicated lines: src/btree.rs:1627 and src/schema.rs:177
- 6+ duplicated lines: src/format.rs:216 and src/format.rs:229
- 6+ duplicated lines: src/journal.rs:53 and src/journal.rs:286
- 6+ duplicated lines: src/parser.rs:131 and src/parser.rs:533
- 6+ duplicated lines: src/planner.rs:413 and src/planner.rs:698
- 6+ duplicated lines: src/planner.rs:1971 and src/vm.rs:1924
- 6+ duplicated lines: src/planner.rs:2831 and src/schema.rs:413
- 6+ duplicated lines: src/tokenizer.rs:551 and src/tokenizer.rs:839
- compared_lines
- 15,069
- duplicated_lines
- 1,207
- duplicated_share
- 8.0%
- files
- 18
Lintok
- findings
- 0
- scanned_lines
- 20,589
- weighted_findings
- 0
Tests and CIok3 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI runs tests (go test, cargo test)
- CI runs linters (clippy, rustfmt, cargo fmt)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 1
- cochange_commits
- 18
- cochange_share
- 33.3%
- source_lines
- 20,589
- test_lines
- 2,121
- test_ratio
- 0.10
Documentationok1 item
- README.md
README.md
- check:changelog
- no
- check:contributing
- no
- check:license
- no
- check:readme
- yes
- readme_lines
- 104
Type safetyskipped
Security
75 adequate
Security posture is adequate: 2 known vulnerabilities in 2 dependencies; 5 high-severity workflow issues. Weakest area: posture.
How the score is built
- Secrets100
- Static analysis (SAST)99
- Vulnerable dependencies90
- CI workflows30
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 2
- declared
- 2
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 3
- findings_high
- 0
- findings_low
- 3
- findings_medium
- 0
- parse_errors
- 0
- scanned_lines
- 20,589
- weighted_findings
- 0.75
Dependencies (osv-scanner)ok
- penalty
- 6
- vulnerabilities
- 2
- vulnerable_packages
- 2
- vulns_critical
- 0
- vulns_high
- 0
- vulns_low
- 0
- vulns_medium
- 0
- vulns_unknown
- 2
CI workflows (zizmor)ok
- findings
- 12
- findings_high
- 5
- findings_low
- 0
- findings_medium
- 7
- penalty
- 73.20
- workflows
- 1
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 0.0%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
5 high9 medium3 low
17 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:17 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:27 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:43 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:44 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:13 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:17 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:21 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:25 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:36 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:43 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | osv/RUSTSEC-2026-0190 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0190 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0486 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0486 | Dependencies (osv-scanner) |
| low | opengrep/rust.lang.security.args |
src/main.rs:30 | args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied... | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
src/main.rs:549 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
| low | opengrep/rust.lang.security.unsafe-usage |
src/main.rs:564 | Detected 'unsafe' usage, please audit for secure usage [confidence high] | Static analysis (opengrep) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 0 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 12 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 2 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 3 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 0 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 18d2647c741b | prov-5+qual-2+sec-2 | 62% | 64 | 75 |
| 2026-11-14 | 18d2647c741b | prov-4+qual-2+sec-2 | 62% | 64 | 75 |
Full text report
- Repository: https://github.com/jonwiggins/cqlite
- Commit:
18d2647c741ba7823e693f4787eaa1e26224b1dc - Generated: 2026-11-14T14:52:05+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 62 | explicit | 76% | 100% |
| Code quality | 64 | weak | 90% | 100% |
| Security | 75 | adequate | 85% | 100% |
AI provenance
Explicit AI attribution on 62% of first-party code added; an estimated 62% including velocity signals.
- Explicitly attributed share (lower bound): 62.5%
- Unattributed share in AI-consistent velocity bursts: 30.8%
- Estimated AI-generated share: 62.5%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 7 | 15,119 |
- AI tooling configured in repo: claude-code
Current source lines last changed by AI-attributed commits: 13,970 of 20,589.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.0 | 0.0 | n/a |
| Security | 0.215 | 0.0 | n/a |
- Stylometry index: 0.10 per 1,000 lines (narrated steps 2, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-02 | 24,199 | 62% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (c6c6d4b0a294)
- Claude Code: trailer 'Co-Authored-By: Claude' (748884c61bfe)
- Claude Code: trailer 'Co-Authored-By: Claude' (c39dbb666397)
- Claude Code: trailer 'Co-Authored-By: Claude' (9dc8bce9249b)
- Claude Code: trailer 'Co-Authored-By: Claude' (3d9f857188c8)
- Claude Code: trailer 'Co-Authored-By: Claude' (88ee95a7a264)
- Claude Code: trailer 'Co-Authored-By: Claude' (cd01c0bdf5c5)
- 4,779 lines of first-party code in ~2.8h (1,691 lines/hour, 5 commit session) (8470049eaf1d)
- CLAUDE.md (claude-code configuration) (CLAUDE.md)
- 1,317 lines of first-party code in ~1.0h (1,385 lines/hour, 1 commit session) (2d1e7ea61737)
- 5,207 lines of first-party code in ~4.7h (1,101 lines/hour, 7 commit session) (e6a035864014)
- step-by-step narration comment: // First, determine serial types and encode values. (src/record.r)
- step-by-step narration comment: // First, resolve what each result column maps to. (src/vm.rs:16)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.10, CI runs tests; 41% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 29 |
| Duplication | 62 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 80 |
| Documentation | 40 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 701; mean complexity 5.6, 90th percentile 12; 52 complex and 24 long functions
- Duplicated lines: 8.0% of 15,069 compared
- Tests: 2,121 test lines for 20,589 source lines (ratio 0.10); CI test commands: go test, cargo test; 33% of recent source commits also change tests
- Docs missing or thin: license, contributing, changelog
Most complex functions:
- call_scalar in src/functions.rs: complexity 148, 437 lines
- execute_select_with_ctes in src/vm.rs: complexity 131, 600 lines
- fmt in src/tokenizer.rs: complexity 122, 126 lines
- eval_expr in src/vm.rs: complexity 116, 257 lines
- lookup_keyword in src/tokenizer.rs: complexity 94, 98 lines
Security
Security posture is adequate: 2 known vulnerabilities in 2 dependencies; 5 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 99 |
| Vulnerable dependencies (OSV) | 90 |
| CI workflows (zizmor) | 30 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 2 in 2 packages (critical 0, high 0, medium 0, low 0)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:17 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:25 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:27 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:43 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:44 |
| medium | osv/RUSTSEC-2026-0190: [email protected] (crates.io) is affected by RUSTSEC-2026-0190 |
Cargo.lock |
| medium | osv/RUSTSEC-2026-0486: [email protected] (crates.io) is affected by RUSTSEC-2026-0486 |
Cargo.lock |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/ci.yml:17 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/ci.yml:25 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/ci.yml:43 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/ci.yml:1 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/ci.yml:13 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/ci.yml:21 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/ci.yml:36 |
| low | opengrep/rust.lang.security.args: args should not be used for security operations. From the docs: "The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes." [confidence high] |
src/main.rs:30 |
| low | opengrep/rust.lang.security.unsafe-usage: Detected 'unsafe' usage, please audit for secure usage [confidence high] |
src/main.rs:549 |
| low | opengrep/rust.lang.security.unsafe-usage: Detected 'unsafe' usage, please audit for secure usage [confidence high] |
src/main.rs:564 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 20,589; test lines: 2,121
| Language | Lines |
|---|---|
| Rust | 22,691 |
| Shell | 19 |