koding/kite
Micro-service framework in Go
- Repository: https://github.com/koding/kite
- Commit:
baa1a54919e3035417f7571dd46005e91afe8abe - Generated: 2026-11-13T23:25:48+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 80 | strong | 90% | 100% |
| Security | 55 | weak | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
Stylometry index: 0.08 per 1,000 lines (narrated steps 1, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2016-07 | 473 | 0% |
| 2016-08 | 578 | 0% |
| 2016-10 | 138 | 0% |
| 2016-11 | 19 | 0% |
| 2016-12 | 2 | 0% |
| 2017-01 | 118 | 0% |
| 2017-03 | 927 | 0% |
| 2017-06 | 17 | 0% |
| 2017-09 | 187 | 0% |
| 2017-11 | 169 | 0% |
| 2017-12 | 395 | 0% |
| 2018-06 | 31 | 0% |
Evidence
- step-by-step narration comment: // now we are ready (reverseproxy)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 0.25, CI runs tests; 3% of function code in complex or long functions; 2% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 92 |
| Duplication | 86 |
| Code smells (Opengrep) | 89 |
| Tests and CI | 77 |
| Documentation | 65 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 601; mean complexity 2.7, 90th percentile 6; 3 complex and 0 long functions
- Duplicated lines: 2.4% of 8,249 compared
- Tests: 3,118 test lines for 12,646 source lines (ratio 0.25); CI test commands: make test; 23% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- setCallback in dnode/unscrub.go: complexity 20, 67 lines
- ServeKite in method.go: complexity 19, 52 lines
- watchAndSendKiteEvents in kontrol/_watcher.go: complexity 17, 85 lines
Security
Security posture is weak: 1 possible secret(s) in the tree, 0 only in history; 3 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 62 |
| Static analysis (Opengrep) | 63 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 20 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | gitleaks/private-key: Possible private-key secret in the current tree |
testkeys/testkeys.go:23 |
| high | opengrep/go.lang.security.audit.dangerous-syscall-exec: Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
kitectl/command/run.go:86 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
kitectl/release.py:169 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
kitectl/release.py:175 |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
dnode/unscrub.go:94 |
| medium | opengrep/go.lang.security.potential-dos-via-decompression-bomb: Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. io.CopyN() can specify a size. [confidence low] |
kitectl/command/install.go:232 |
| medium | opengrep/python.lang.security.dangerous-globals-use: Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. [confidence low] |
kitectl/release.py:180 |
| medium | opengrep/python.lang.security.dangerous-globals-use: Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. [confidence low] |
kitectl/release.py:209 |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] |
kitectl/release.py:221 |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used: Do not use math/rand. Use crypto/rand instead. [confidence medium] |
kontrol/kites.go:4 |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used: Do not use math/rand. Use crypto/rand instead. [confidence medium] |
kontrol/kontrol.go:8 |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion: MinVersion is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web se [confidence high] |
kontrol/kontrol/main.go:76 |
| medium | opengrep/go.lang.security.audit.crypto.math-random-used: Do not use math/rand. Use crypto/rand instead. [confidence medium] |
kontrolclient.go:7 |
| medium | opengrep/go.lang.security.reverseproxy-director: ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director. [confidence medium] |
reverseproxy/reverseproxy.go:80 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
reverseproxy/reverseproxy.go:174 |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion: MinVersion is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web se [confidence high] |
reverseproxy/reverseproxy.go:220 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
reverseproxy/reverseproxy/main.go:52 |
| medium | opengrep/go.lang.security.audit.crypto.missing-ssl-minversion: MinVersion is missing from this TLS configuration. By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web se [confidence high] |
server.go:128 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
sockjsclient/sockjsclient.go:309 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
sockjsclient/sockjsclient.go:311 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
sockjsclient/sockjsclient.go:316 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
sockjsclient/sockjsclient.go:318 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
sockjsclient/sockjsclient.go:322 |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block: Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low] |
systeminfo/systeminfo_darwin.go:89 |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block: Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low] |
systeminfo/systeminfo_openbsd.go:36 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 12,646; test lines: 3,118
| Language | Lines |
|---|---|
| Go | 15,387 |
| Python | 231 |
| SQL | 133 |
| Shell | 13 |