Leaderboard github.com
mailgun/godebug
DEPRECATED! https://github.com/derekparker/delve
AI provenance
0%
none-detected
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
69/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
78/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% none-detected
No AI attribution or AI-consistent velocity signals detected.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts0%
- Estimated AI-generated share0%
- AI tool configuration files0
- Work sessions at AI pace0
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)0.09
Lines added per month all AI-attributed share
- 2015-0123,542 · 0% AI
- 2015-022,676 · 0% AI
- 2015-031,393 · 0% AI
- 2015-042,902 · 0% AI
- 2015-0514,936 · 0% AI
- 2015-06193 · 0% AI
- 2015-07116,001 · 0% AI
- 2015-0853 · 0% AI
- 2015-092,600 · 0% AI
- 2017-060 · 0% AI
Evidence by analyzer
Explicit AI attributionok
- attributed_commit_share
- 0.0%
- attributed_commits
- 0
- attributed_loc
- 0
- attributed_loc_share
- 0.0%
- commits
- 208
- effective_loc
- 164,296
- tools_detected
- 0
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok
- excluded_import_loc
- 151,576
- flagged_loc
- 0
- flagged_loc_share
- 0.0%
- flagged_units
- 0
- max_loc_per_hour
- 621.47
- measured_loc
- 12,720
- median_loc_per_hour
- 55.25
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 2,600
- pre_ai_era_bursts
- 1
- pre_ai_era_measured_loc
- 12,720
- work_units
- 91
Release velocityskipped
Coding styleok4 items
- step-by-step narration comment: // Finally, check for illegal use of the ellipsis
- step-by-step narration comment: // First, all the (unaugmented) non-test packages and their
- step-by-step narration comment: // Then, each package P for which testing is desired is augmented by
- step-by-step narration comment: // First, try to scan a handle.
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 4
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 3
- files:placeholder
- 0
- index
- 0.09
- lines_scanned
- 46,628
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0.09
- per_kloc:placeholder
- 0
Code quality
69 adequate
Code quality is adequate: test-to-source ratio 2.44, CI runs tests; 38% of function code in complex or long functions; 9% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity32
- Duplication60
- Lint and smells99
- Tests and CI86
- Documentation65
- Type safetynot measured
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- builtin in Godeps/_workspace/src/golang.org/x/tools/go/types/builtins.go: complexity 123, 419 lines
- stmt in Godeps/_workspace/src/golang.org/x/tools/go/types/stmt.go: complexity 119, 408 lines
- exprInternal in Godeps/_workspace/src/golang.org/x/tools/go/types/expr.go: complexity 111, 381 lines
- checkStmt in Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go: complexity 106, 374 lines
- Prompt in Godeps/_workspace/src/github.com/peterh/liner/line.go: complexity 83, 298 lines
- yaml_parser_scan_flow_scalar in Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go: complexity 81, 210 lines
- main in testdata/single-file-tests/select-out.go: complexity 72, 263 lines
- checkBinaryExpr in Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go: complexity 71, 190 lines
- yaml_parser_fetch_next_token in Godeps/_workspace/src/gopkg.in/yaml.v2/scannerc.go: complexity 70, 100 lines
- Body in Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcompositelit_gen.go: complexity 65, 85 lines
- complex_functions
- 121
- function_nloc
- 30,367
- functions
- 2,003
- long_functions
- 32
- many_param_functions
- 0
- mean_ccn
- 4.65
- p90_ccn
- 10
- risky_nloc_share
- 38.0%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/ast.go:665 and Godeps/_workspace/src/github.com/0xfaded/eval/ast.go:675
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go:422 and Godeps/_workspace/src/github.com/0xfaded/eval/checkbinaryexpr.go:449
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkbuiltin.go:48 and Godeps/_workspace/src/github.com/0xfaded/eval/checkbuiltin.go:510
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go:272 and Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go:298
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkindexexpr.go:11 and Godeps/_workspace/src/github.com/0xfaded/eval/checksliceexpr.go:12
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go:358 and Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go:434
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/consttype.go:117 and Godeps/_workspace/src/github.com/0xfaded/eval/consttype.go:129
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/evalbinaryexpr.go:127 and Godeps/_workspace/src/github.com/0xfaded/eval/evalbinaryexpr.go:170
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/evalbuiltin.go:54 and Godeps/_workspace/src/github.com/0xfaded/eval/evalbuiltin.go:68
- 6+ duplicated lines: Godeps/_workspace/src/github.com/0xfaded/eval/evalunaryexpr.go:56 and Godeps/_workspace/src/github.com/0xfaded/eval/evalunaryexpr.go:71
- compared_lines
- 33,155
- duplicated_lines
- 2,825
- duplicated_share
- 8.5%
- files
- 224
Lintok
- category:correctness
- 3
- findings
- 3
- scanned_lines
- 46,628
- weighted_findings
- 1.50
Tests and CIok2 items
- CI config: .travis.yml
.travis.yml - CI runs tests (go test)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- no
- ci_files
- 1
- cochange_commits
- 165
- cochange_share
- 16.4%
- source_lines
- 46,628
- test_lines
- 113,836
- test_ratio
- 2.44
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 71
Type safetyskipped
Security
78 adequate
Security posture is adequate: 6 high-severity SAST findings. Weakest area: posture.
How the score is built
- Secrets100
- Static analysis (SAST)90
- Vulnerable dependenciesnot measured
- CI workflowsnot measured
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesskipped
no registry dependencies declared
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 42
- findings_high
- 6
- findings_low
- 0
- findings_medium
- 36
- parse_errors
- 0
- scanned_lines
- 46,628
- weighted_findings
- 13.50
Dependencies (osv-scanner)skipped
CI workflows (zizmor)skipped
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 0.0%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
6 high37 medium2 low
45 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/go.lang.security.audit.reflect-makefunc |
Godeps/_workspace/src/github.com/0xfaded/eval/evalfunclit.go:10 | 'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/common.go:73 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
Godeps/_workspace/src/golang.org/x/tools/go/gccgoimporter/gccgoinstallation.go:31 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
Godeps/_workspace/src/golang.org/x/tools/go/gccgoimporter/gccgoinstallation.go:59 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
Godeps/_workspace/src/golang.org/x/tools/go/loader/cgo.go:147 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
cmd.go:478 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
cmd.go:400 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go:229 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:51 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:63 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:74 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:81 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:83 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
Godeps/_workspace/src/github.com/0xfaded/eval/errors.go:1061 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name |
Godeps/_workspace/src/github.com/0xfaded/eval/panics.go:58 | If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkassignstmt_gen.go:5 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_gen.go:6 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_nonconst_gen.go:7 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_typed_gen.go:7 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbuiltin_gen.go:5 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcallexpr_const_conv_gen.go:6 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcallexpr_func_gen.go:6 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcompositelit_gen.go:6 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkstarexpr_gen.go:6 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_addr_gen.go:6 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_gen.go:6 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_typed_gen.go:6 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:155 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:157 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:167 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:174 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/input_windows.go:308 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/output.go:42 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:24 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:31 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:36 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:41 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:46 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/output_windows.go:52 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/unixmode.go:11 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
Godeps/_workspace/src/github.com/peterh/liner/unixmode.go:34 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
gen/gen.go:17 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
lib/debug.go:342 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| low | opengrep/go.lang.correctness.hardcoded-eq-true-or-false |
Godeps/_workspace/src/golang.org/x/tools/go/gcimporter/exportdata.go:26 | Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on... | Lint |
| low | opengrep/go.lang.correctness.hardcoded-eq-true-or-false |
Godeps/_workspace/src/golang.org/x/tools/go/loader/cgo.go:144 | Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on... | Lint |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 3 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | skipped | — | 0 | |
| Dependencies (osv-scanner) | Security | skipped | — | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | skipped | — | 0 | no registry dependencies declared |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 42 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 0 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | bfb01ae9c266 | prov-5+qual-2+sec-2 | 0% | 69 | 78 |
| 2026-11-14 | bfb01ae9c266 | prov-4+qual-2+sec-2 | 0% | 69 | 78 |
Full text report
- Repository: https://github.com/mailgun/godebug
- Commit:
bfb01ae9c26601793d8cf00f074489f7ad52288a - Generated: 2026-11-14T14:52:06+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 69 | adequate | 90% | 100% |
| Security | 78 | adequate | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
Stylometry index: 0.09 per 1,000 lines (narrated steps 4, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2015-01 | 23,542 | 0% |
| 2015-02 | 2,676 | 0% |
| 2015-03 | 1,393 | 0% |
| 2015-04 | 2,902 | 0% |
| 2015-05 | 14,936 | 0% |
| 2015-06 | 193 | 0% |
| 2015-07 | 116,001 | 0% |
| 2015-08 | 53 | 0% |
| 2015-09 | 2,600 | 0% |
Evidence
- step-by-step narration comment: // Finally, check for illegal use of the ellipsis (Godeps/_work)
- step-by-step narration comment: // First, all the (unaugmented) non-test packages and their (Godeps/_work)
- step-by-step narration comment: // Then, each package P for which testing is desired is augmented by (Godeps/_work)
- step-by-step narration comment: // First, try to scan a handle. (Godeps/_work)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 2.44, CI runs tests; 38% of function code in complex or long functions; 9% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 32 |
| Duplication | 60 |
| Code smells (Opengrep) | 99 |
| Tests and CI | 86 |
| Documentation | 65 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,003; mean complexity 4.7, 90th percentile 10; 121 complex and 32 long functions
- Duplicated lines: 8.5% of 33,155 compared
- Tests: 113,836 test lines for 46,628 source lines (ratio 2.44); CI test commands: go test; 16% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- builtin in Godeps/_workspace/src/golang.org/x/tools/go/types/builtins.go: complexity 123, 419 lines
- stmt in Godeps/_workspace/src/golang.org/x/tools/go/types/stmt.go: complexity 119, 408 lines
- exprInternal in Godeps/_workspace/src/golang.org/x/tools/go/types/expr.go: complexity 111, 381 lines
- checkStmt in Godeps/_workspace/src/github.com/0xfaded/eval/checkstmt.go: complexity 106, 374 lines
- Prompt in Godeps/_workspace/src/github.com/peterh/liner/line.go: complexity 83, 298 lines
Security
Security posture is adequate: 6 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 90 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/go.lang.security.audit.reflect-makefunc: 'reflect.MakeFunc' detected. This will sidestep protections that are normally afforded by Go's type system. Audit this call and be sure that user input cannot be used to affect the code generated by MakeFunc; otherwise, you will have a serious security vulnerability. [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/evalfunclit.go:10 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/common.go:73 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
Godeps/_workspace/src/golang.org/x/tools/go/gccgoimporter/gccgoinstallation.go:31 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
Godeps/_workspace/src/golang.org/x/tools/go/gccgoimporter/gccgoinstallation.go:59 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
Godeps/_workspace/src/golang.org/x/tools/go/loader/cgo.go:147 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
cmd.go:478 |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/checkcompositelit.go:229 |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:51 |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:63 |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:74 |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:81 |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/checkselectorexpr.go:83 |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/errors.go:1061 |
| medium | opengrep/go.lang.security.audit.unsafe-reflect-by-name: If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/panics.go:58 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkassignstmt_gen.go:5 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_gen.go:6 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_nonconst_gen.go:7 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbinaryexpr_typed_gen.go:7 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkbuiltin_gen.go:5 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcallexpr_const_conv_gen.go:6 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcallexpr_func_gen.go:6 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkcompositelit_gen.go:6 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkstarexpr_gen.go:6 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_addr_gen.go:6 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
Godeps/_workspace/src/github.com/0xfaded/eval/testgen/checkunaryexpr_gen.go:6 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 46,628; test lines: 113,836
| Language | Lines |
|---|---|
| Go | 160,464 |