Leaderboard github.com
mambucodev/votetracker
A school grade management application built with Python and PySide6 (Qt6).
AI provenance
34%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
66/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
68/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
34% explicit
Explicit AI attribution on 34% of first-party code added; an estimated 34% including velocity signals.
How the score is built
- Explicitly attributed share34%
- Unattributed share in AI-pace bursts30%
- Estimated AI-generated share34%
- AI tool configuration files3
- Work sessions at AI pace2
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.44
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 43 | 5,798 | 2026-01-16 | 2026-01-29 |
| Jules | 19 | 779 | 2026-09-25 | 2026-10-03 |
Lines added per month all AI-attributed share
- 2026-0114,444 · 40% AI
- 2026-02582 · 0% AI
- 2026-04364 · 0% AI
- 2026-094,132 · 17% AI
- 2026-1064 · 100% AI
Findings in AI-attributed lines vs the rest
From git blame: 4,851 lines trace to AI-attributed commits, 8,915 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 0.41 | 0.11 | 3.68× |
| Security | 0.21 | 0.11 | 1.84× |
Evidence by analyzer
Explicit AI attributionok27 items
- Claude Code: 43 attributed commits, 5,798 lines added
- Jules: 19 attributed commits, 779 lines added
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Jules: author google-labs-jules[bot]
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 40.5%
- attributed_commits
- 62
- attributed_loc
- 6,577
- attributed_loc_share
- 33.6%
- commits
- 153
- effective_loc
- 19,586
- tools_detected
- 2
AI tool configurationok3 items
- CLAUDE.md (claude-code configuration)
- AGENTS.md (generic-agent configuration)
- GEMINI.md (gemini configuration)
- artifacts
- 3
- earliest_adoption
- 2026-01-27
- tools_configured
- 3
- workflow_agents
- 0
Commit velocityok2 items
- 2,509 lines of first-party code in ~1.7h (1,473 lines/hour, 7 commit session)
- 3,417 lines of first-party code in ~4.5h (754 lines/hour, 5 commit session)
- excluded_import_loc
- 3,311
- flagged_loc
- 5,926
- flagged_loc_share
- 36.4%
- flagged_units
- 2
- max_loc_per_hour
- 1,472.99
- measured_loc
- 16,275
- median_loc_per_hour
- 331.59
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 21
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 30,057.40
- releases
- 12
Coding styleok5 items
- step-by-step narration comment: # Step 1: GET login page to establish session
- step-by-step narration comment: # Step 2: POST login credentials
- step-by-step narration comment: # Step 0: Load dashboard first (browser does this before FAMILY_VOTI)
- step-by-step narration comment: # Step 1: Load the grades page (uppercase Action parameter)
- step-by-step narration comment: # Step 2: Fetch grades for EACH term separately
- count:assistant_voice
- 0
- count:emoji_in_code
- 2
- count:narrated_steps
- 5
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 1
- files:narrated_steps
- 1
- files:placeholder
- 0
- index
- 0.44
- lines_scanned
- 13,766
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0.14
- per_kloc:narrated_steps
- 0.36
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 4,851
- blame_failures
- 0
- files_blamed
- 49
- other_lines
- 8,915
- quality:ai_findings
- 2
- quality:ai_per_kloc
- 0.41
- quality:other_findings
- 1
- quality:other_per_kloc
- 0.11
- quality:ratio
- 3.68
- security:ai_findings
- 1
- security:ai_per_kloc
- 0.21
- security:other_findings
- 1
- security:other_per_kloc
- 0.11
- security:ratio
- 1.84
Code quality
66 adequate
Code quality is adequate: test-to-source ratio 0.13, CI runs tests; 22% of function code in complex or long functions; 5% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity52
- Duplication73
- Lint and smells95
- Tests and CI63
- Documentation65
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- _import_from_provider in src/votetracker/pages/settings.py: complexity 32, 153 lines
- _import_from_classeviva in src/votetracker/pages/settings.py: complexity 27, 121 lines
- get_grades in src/votetracker/providers/axios_provider.py: complexity 27, 114 lines
- login in src/votetracker/providers/axios_provider.py: complexity 20, 61 lines
- find_best_match in src/votetracker/subject_matcher.py: complexity 20, 35 lines
- refresh in crates/votetracker-gtk/src/pages/dashboard.rs: complexity 19, 180 lines
- refresh in crates/votetracker-gtk/src/pages/report_card.rs: complexity 19, 95 lines
- refresh in src/votetracker/pages/dashboard.py: complexity 19, 61 lines
- refresh in src/votetracker/pages/statistics.py: complexity 19, 58 lines
- _convert_axios_grades in src/votetracker/providers/axios_provider.py: complexity 19, 66 lines
- complex_functions
- 14
- function_nloc
- 7,925
- functions
- 446
- long_functions
- 8
- many_param_functions
- 3
- mean_ccn
- 3.52
- p90_ccn
- 8
- risky_nloc_share
- 21.7%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: crates/votetracker-core/src/db.rs:278 and crates/votetracker-core/src/db.rs:328
- 6+ duplicated lines: crates/votetracker-core/src/models.rs:23 and crates/votetracker-core/src/models.rs:36
- 6+ duplicated lines: crates/votetracker-gtk/src/pages/dashboard.rs:13 and crates/votetracker-gtk/src/pages/subjects.rs:13
- 6+ duplicated lines: crates/votetracker-gtk/src/pages/dashboard.rs:71 and crates/votetracker-gtk/src/pages/dashboard.rs:90
- 6+ duplicated lines: crates/votetracker-gtk/src/pages/subjects.rs:11 and crates/votetracker-gtk/src/pages/votes.rs:13
- 6+ duplicated lines: src/votetracker/database.py:759 and src/votetracker/database.py:1192
- 6+ duplicated lines: src/votetracker/dialogs.py:91 and src/votetracker/dialogs.py:175
- 6+ duplicated lines: src/votetracker/pages/calendar.py:84 and src/votetracker/pages/statistics.py:313
- 6+ duplicated lines: src/votetracker/pages/calendar.py:130 and src/votetracker/pages/report_card.py:74
- 6+ duplicated lines: src/votetracker/pages/report_card.py:539 and src/votetracker/pages/votes.py:321
- compared_lines
- 10,494
- duplicated_lines
- 558
- duplicated_share
- 5.3%
- files
- 49
Lintok
- category:best-practice
- 2
- category:maintainability
- 1
- findings
- 3
- scanned_lines
- 13,766
- weighted_findings
- 3
Tests and CIok3 items
- CI config: .github/workflows/build.yml
.github/workflows/build.yml - CI config: .github/workflows/test.yml
.github/workflows/test.yml - CI runs tests (unittest)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- no
- ci_files
- 2
- cochange_commits
- 120
- cochange_share
- 4.2%
- source_lines
- 13,766
- test_lines
- 1,752
- test_ratio
- 0.13
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 148
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 28
- escapes_per_kloc
- 2.53
Security
68 weak
Security posture is weak: 3 known vulnerabilities in 3 dependencies; 1 high-severity SAST findings; 14 high-severity workflow issues. Weakest area: posture.
How the score is built
- Secrets97
- Static analysis (SAST)98
- Vulnerable dependencies86
- CI workflows4
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 15
- declared
- 15
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 1
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 1
- findings_high
- 1
- findings_low
- 0
- findings_medium
- 0
- parse_errors
- 0
- scanned_lines
- 13,766
- weighted_findings
- 0.75
Dependencies (osv-scanner)ok
- penalty
- 9
- vulnerabilities
- 3
- vulnerable_packages
- 3
- vulns_critical
- 0
- vulns_high
- 0
- vulns_low
- 0
- vulns_medium
- 1
- vulns_unknown
- 2
CI workflows (zizmor)ok
- findings
- 25
- findings_high
- 14
- findings_low
- 1
- findings_medium
- 10
- penalty
- 187.20
- workflows
- 2
Security postureok2 items
- crates/votetracker-core/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/votetracker-core/Cargo.toml - crates/votetracker-gtk/Cargo.toml has no lockfile alongside it (unpinned dependencies)
crates/votetracker-gtk/Cargo.toml
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 22.2%
- unpinned_manifests
- 2
Release downloadsok5 items
- release v2.9.0 ships VoteTracker-Windows.exe (3 downloads)
- release v2.8.2 ships VoteTracker-Windows.exe (4 downloads)
- release v2.8.1 ships VoteTracker-Windows.exe (1 downloads)
- release v2.8.0 ships VoteTracker-Windows.exe (4 downloads)
- release v2.7.1 ships VoteTracker-Windows.exe (1 downloads)
- binary_assets
- 10
- signals
- 1
- suspicious
- 0
Findings
15 high16 medium1 low1 info
33 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:35 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:42 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:49 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:64 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/build.yml:77 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test.yml:112 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test.yml:22 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test.yml:56 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test.yml:59 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test.yml:86 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/test.yml:89 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
scripts/build.py:76 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
src/votetracker/database.py:244 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.best-practice.logging-error-without-handling |
src/votetracker/database.py:402 | Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info. | Lint |
| medium | opengrep/python.lang.maintainability.useless-if-body |
src/votetracker/pages/settings.py:1671 | Useless if statement; both blocks have the same body | Lint |
| medium | zizmor/excessive-permissions |
.github/workflows/build.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/build.yml:10 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/build.yml:18 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test.yml:11 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test.yml:21 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test.yml:50 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test.yml:55 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/test.yml:80 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/test.yml:85 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | osv/RUSTSEC-2026-0386 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0386 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0459 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0459 | Dependencies (osv-scanner) |
| medium | osv/RUSTSEC-2026-0486 |
Cargo.lock | [email protected] (crates.io) is affected by RUSTSEC-2026-0486 | Dependencies (osv-scanner) |
| low | gitleaks/generic-api-key |
src/votetracker/classeviva.py:37 | Possible generic-api-key secret in the current tree | Secrets (gitleaks) |
| info | zizmor/superfluous-actions |
.github/workflows/build.yml:77 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-4 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 3 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 25 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 3 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 1 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 1 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 2097876e77b7 | prov-5+qual-2+sec-2 | 34% | 66 | 68 |
| 2026-11-14 | 2097876e77b7 | prov-4+qual-2+sec-2 | 34% | 66 | 68 |
Full text report
- Repository: https://github.com/mambucodev/votetracker
- Commit:
2097876e77b7637efdd19b5ed03020c48883c213 - Generated: 2026-11-14T14:52:06+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 34 | explicit | 95% | 100% |
| Code quality | 66 | adequate | 90% | 100% |
| Security | 68 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 34% of first-party code added; an estimated 34% including velocity signals.
- Explicitly attributed share (lower bound): 33.6%
- Unattributed share in AI-consistent velocity bursts: 30.3%
- Estimated AI-generated share: 33.6%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 43 | 5,798 |
| Jules | 19 | 779 |
- AI tooling configured in repo: claude-code, gemini, generic-agent
Current source lines last changed by AI-attributed commits: 4,851 of 13,766.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.412 | 0.112 | 3.68x |
| Security | 0.206 | 0.112 | 1.84x |
- Stylometry index: 0.44 per 1,000 lines (narrated steps 5, placeholders 0, assistant phrasing 0, emoji 2). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-01 | 14,444 | 40% |
| 2026-02 | 582 | 0% |
| 2026-04 | 364 | 0% |
| 2026-09 | 4,132 | 17% |
| 2026-10 | 64 | 100% |
Evidence
- Jules: author google-labs-jules[bot] (eea888ac50fa)
- Jules: author google-labs-jules[bot] (69879b4d94ec)
- Jules: author google-labs-jules[bot] (4d65bb01ed5e)
- Jules: author google-labs-jules[bot] (aff2703ff449)
- Jules: author google-labs-jules[bot] (5372e211e33c)
- Jules: author google-labs-jules[bot] (83ed6361353a)
- Jules: author google-labs-jules[bot] (8680a40a3c76)
- Jules: author google-labs-jules[bot] (79e7b3f5b4a5)
- Jules: author google-labs-jules[bot] (9f098bffb351)
- Jules: author google-labs-jules[bot] (3a474d39bee5)
- Jules: author google-labs-jules[bot] (6d5cda52a7ba)
- Jules: author google-labs-jules[bot] (cbdf62f1a4a1)
- Jules: author google-labs-jules[bot] (231f56594cd1)
- Jules: author google-labs-jules[bot] (80509bbabb55)
- Jules: author google-labs-jules[bot] (29de104e4cd8)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.13, CI runs tests; 22% of function code in complex or long functions; 5% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 52 |
| Duplication | 73 |
| Code smells (Opengrep) | 95 |
| Tests and CI | 63 |
| Documentation | 65 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 446; mean complexity 3.5, 90th percentile 8; 14 complex and 8 long functions
- Duplicated lines: 5.3% of 10,494 compared
- Tests: 1,752 test lines for 13,766 source lines (ratio 0.13); CI test commands: unittest; 4% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- _import_from_provider in src/votetracker/pages/settings.py: complexity 32, 153 lines
- _import_from_classeviva in src/votetracker/pages/settings.py: complexity 27, 121 lines
- get_grades in src/votetracker/providers/axios_provider.py: complexity 27, 114 lines
- login in src/votetracker/providers/axios_provider.py: complexity 20, 61 lines
- find_best_match in src/votetracker/subject_matcher.py: complexity 20, 35 lines
Security
Security posture is weak: 3 known vulnerabilities in 3 dependencies; 1 high-severity SAST findings; 14 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 98 |
| Vulnerable dependencies (OSV) | 86 |
| CI workflows (zizmor) | 4 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 3 in 3 packages (critical 0, high 0, medium 1, low 0)
-
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
scripts/build.py:76 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build.yml:18 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build.yml:21 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build.yml:35 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build.yml:42 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build.yml:49 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build.yml:64 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build.yml:77 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/test.yml:22 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/test.yml:25 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/test.yml:56 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/test.yml:59 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/test.yml:86 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/test.yml:89 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/test.yml:112 |
| medium | osv/RUSTSEC-2026-0459: [email protected] (crates.io) is affected by RUSTSEC-2026-0459 |
Cargo.lock |
| medium | osv/RUSTSEC-2026-0486: [email protected] (crates.io) is affected by RUSTSEC-2026-0486 |
Cargo.lock |
| medium | osv/RUSTSEC-2026-0386: [email protected] (crates.io) is affected by RUSTSEC-2026-0386 |
Cargo.lock |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/build.yml:18 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/build.yml:1 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/build.yml:10 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/test.yml:21 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/test.yml:55 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/test.yml:85 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/test.yml:1 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v2.9.0 ships VoteTracker-Windows.exe (3 downloads)
- binary-release-asset: release v2.8.2 ships VoteTracker-Windows.exe (4 downloads)
- binary-release-asset: release v2.8.1 ships VoteTracker-Windows.exe (1 downloads)
- binary-release-asset: release v2.8.0 ships VoteTracker-Windows.exe (4 downloads)
- binary-release-asset: release v2.7.1 ships VoteTracker-Windows.exe (1 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 13,766; test lines: 1,752
| Language | Lines |
|---|---|
| Python | 12,814 |
| Rust | 2,606 |
| Shell | 98 |