Leaderboard github.com
mrothroc/biosurface
Deterministically audits the claims in AI-assisted single-cell & Perturb-seq analyses — a claim is trusted only where independent verification surfaces converge, not on one engine's verdict. An application of https://michael.roth.rocks/research/trust-topology/
AI provenance
0%
possible
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
77/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
81/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% possible
Weak signals consistent with AI-assisted development.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts87%
- Estimated AI-generated share0%
- AI tool configuration files7
- Work sessions at AI pace11
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)0.00
Lines added per month all AI-attributed share
- 2026-0755,660 · 0% AI
Evidence by analyzer
Explicit AI attributionok
- attributed_commit_share
- 0.0%
- attributed_commits
- 0
- attributed_loc
- 0
- attributed_loc_share
- 0.0%
- commits
- 264
- effective_loc
- 55,660
- tools_detected
- 0
AI tool configurationok7 items
- CLAUDE.md (claude-code configuration)
- cmd/biosurface/CLAUDE.md (claude-code configuration)
- internal/CLAUDE.md (claude-code configuration)
- internal/extract/CLAUDE.md (claude-code configuration)
- internal/ingest/CLAUDE.md (claude-code configuration)
- internal/llm/CLAUDE.md (claude-code configuration)
- internal/rules/CLAUDE.md (claude-code configuration)
- artifacts
- 7
- earliest_adoption
- 2026-07-13
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok11 items
- 5,535 lines of first-party code in ~3.4h (1,605 lines/hour, 14 commit session)
- 5,825 lines of first-party code in ~4.2h (1,401 lines/hour, 11 commit session)
- 8,443 lines of first-party code in ~6.5h (1,309 lines/hour, 28 commit session)
- 4,544 lines of first-party code in ~4.5h (1,008 lines/hour, 19 commit session)
- 2,626 lines of first-party code in ~2.7h (967 lines/hour, 7 commit session)
- 3,230 lines of first-party code in ~3.6h (901 lines/hour, 17 commit session)
- 4,910 lines of first-party code in ~5.8h (847 lines/hour, 12 commit session)
- 2,330 lines of first-party code in ~3.0h (773 lines/hour, 8 commit session)
- 5,951 lines of first-party code in ~9.3h (639 lines/hour, 26 commit session)
- 3,753 lines of first-party code in ~6.0h (622 lines/hour, 8 commit session)
- 1,365 lines of first-party code in ~2.4h (568 lines/hour, 9 commit session)
- excluded_import_loc
- 0
- flagged_loc
- 48,512
- flagged_loc_share
- 87.2%
- flagged_units
- 11
- max_loc_per_hour
- 1,605.12
- measured_loc
- 55,660
- median_loc_per_hour
- 568.29
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 29
Release velocityskipped
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0
- lines_scanned
- 20,606
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Code quality
77 adequate
Code quality is adequate: test-to-source ratio 1.51, CI runs tests; 14% of function code in complex or long functions; 8% duplicated lines. Weakest area: type safety.
How the score is built
- Complexity65
- Duplication63
- Lint and smells86
- Tests and CI100
- Documentation65
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- ValidateSourceGroundedClaim in internal/domain/claimlint/source_grounding.go: complexity 37, 82 lines
- EnforceClaimAuthorPolicy in internal/config/policyguard/policyguard.go: complexity 36, 100 lines
- runClaimExtract in cmd/biosurface/claim_extract.go: complexity 29, 187 lines
- Run in internal/rules/robustness/gate.go: complexity 27, 62 lines
- main in scripts/dataprep/extract_de_replogle.py: complexity 27, 84 lines
- Run in internal/app/audit/service.go: complexity 26, 112 lines
- Validate in internal/config/policy.go: complexity 24, 40 lines
- LoadArtifacts in internal/ingest/bundle/bundle.go: complexity 24, 81 lines
- claimAdd in internal/adapters/mcp/handler.go: complexity 23, 84 lines
- manifestWrite in internal/adapters/mcp/manifest_write.go: complexity 23, 68 lines
- complex_functions
- 17
- function_nloc
- 11,916
- functions
- 807
- long_functions
- 5
- many_param_functions
- 2
- mean_ccn
- 3.75
- p90_ccn
- 9
- risky_nloc_share
- 14.1%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: cmd/biosurface/claim.go:4 and cmd/biosurface/claim_extract.go:5
- 6+ duplicated lines: cmd/biosurface/claim.go:41 and internal/adapters/mcp/handler.go:444
- 6+ duplicated lines: cmd/biosurface/claim.go:211 and cmd/biosurface/claim.go:343
- 6+ duplicated lines: cmd/biosurface/claim.go:419 and cmd/biosurface/main.go:116
- 6+ duplicated lines: cmd/biosurface/claim.go:426 and cmd/biosurface/serve.go:56
- 6+ duplicated lines: cmd/biosurface/claim_recommend.go:4 and cmd/biosurface/serve.go:4
- 6+ duplicated lines: cmd/biosurface/reaudit.go:35 and cmd/biosurface/reaudit.go:79
- 6+ duplicated lines: demo/live_loop.sh:154 and demo/live_loop.sh:181
- 6+ duplicated lines: internal/adapters/claimstore/local/convert.go:4 and internal/adapters/claimstore/remote/convert.go:4
- 6+ duplicated lines: internal/adapters/claimstore/local/local.go:90 and internal/adapters/claimstore/remote/remote.go:112
- compared_lines
- 14,990
- duplicated_lines
- 1,158
- duplicated_share
- 7.7%
- files
- 147
Lintok
- category:best-practice
- 3
- category:correctness
- 3
- findings
- 6
- scanned_lines
- 20,606
- weighted_findings
- 12
Tests and CIok3 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI runs tests (go test)
- CI runs linters (golangci-lint, go vet)
- check:ci_present
- yes
- check:ci_runs_lint
- yes
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 1
- cochange_commits
- 192
- cochange_share
- 90.1%
- source_lines
- 20,606
- test_lines
- 31,199
- test_ratio
- 1.51
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 269
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 0
- escapes_per_kloc
- 0
Security
81 adequate
Security posture is adequate: 1 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.
How the score is built
- Secrets100
- Static analysis (SAST)92
- Vulnerable dependencies100
- CI workflows63
- Security posture0
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesskipped
no registry dependencies declared
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 20
- findings_high
- 1
- findings_low
- 4
- findings_medium
- 15
- parse_errors
- 0
- scanned_lines
- 20,606
- weighted_findings
- 4.75
Dependencies (osv-scanner)ok
- penalty
- 0
- vulnerabilities
- 0
- vulnerable_packages
- 0
- vulns_critical
- 0
- vulns_high
- 0
- vulns_low
- 0
- vulns_medium
- 0
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 4
- findings_high
- 2
- findings_low
- 0
- findings_medium
- 2
- penalty
- 27.60
- workflows
- 1
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 0.0%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
6 high20 medium4 low
30 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/python.lang.best-practice.open-never-closed |
scripts/dataprep/compute_enrichment_replogle.py:157 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
scripts/dataprep/compute_enrichment_replogle.py:48 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
scripts/dataprep/compute_enrichment_replogle.py:75 | file object opened without corresponding close | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:15 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
internal/llm/codex/codex.go:205 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
cmd/biosurface/main.go:278 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/testutil/bundle.go:21 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
internal/testutil/bundle.go:42 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:10 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/ci.yml:14 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/go.lang.security.audit.xss.no-io-writestring-to-responsewriter |
internal/adapters/serve/assets.go:153 | Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.no-io-writestring-to-responsewriter |
internal/adapters/serve/assets.go:210 | Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.unsafe-template-type |
internal/adapters/serve/assets.go:55 | Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter |
internal/adapters/serve/claims.go:155 | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter |
internal/adapters/serve/claims.go:212 | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter |
internal/adapters/serve/claims.go:48 | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter |
internal/adapters/serve/claims.go:95 | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter |
internal/adapters/serve/manifest_write.go:62 | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter |
internal/adapters/serve/serve.go:268 | Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
internal/report/markdown/report.go:9 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.unsafe-template-type |
internal/report/viewer/viewer.go:230 | Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.unsafe-template-type |
internal/report/viewer/viewer.go:291 | Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
scripts/dataprep/extract_de_replogle.py:127 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
scripts/dataprep/extract_de_replogle.py:167 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected |
scripts/dataprep/extract_de_replogle.py:92 | Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control... | Static analysis (opengrep) |
| low | opengrep/python.lang.security.use-defusedcsv |
scripts/dataprep/compute_enrichment_replogle.py:161 | Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet... | Static analysis (opengrep) |
| low | opengrep/python.lang.security.use-defusedcsv |
scripts/dataprep/extract_concordance.py:40 | Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet... | Static analysis (opengrep) |
| low | opengrep/python.lang.security.use-defusedcsv |
scripts/dataprep/extract_de_replogle.py:117 | Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet... | Static analysis (opengrep) |
| low | opengrep/python.lang.security.use-defusedcsv |
scripts/dataprep/extract_de_replogle.py:189 | Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet... | Static analysis (opengrep) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 6 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 4 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | skipped | — | 0 | no registry dependencies declared |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 20 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 0 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 817f80e386fb | prov-5+qual-2+sec-2 | 0% | 77 | 81 |
| 2026-11-14 | 817f80e386fb | prov-4+qual-2+sec-2 | 0% | 77 | 81 |
Full text report
- Repository: https://github.com/mrothroc/biosurface
- Commit:
817f80e386fb14f81b5744e840a6ca464e50de38 - Generated: 2026-11-14T14:52:06+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 65% | 100% |
| Code quality | 77 | adequate | 90% | 100% |
| Security | 81 | adequate | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 87.2%
-
Estimated AI-generated share: 0.0%
-
AI tooling configured in repo: claude-code
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-07 | 55,660 | 0% |
Evidence
- CLAUDE.md (claude-code configuration) (CLAUDE.md)
- cmd/biosurface/CLAUDE.md (claude-code configuration) (cmd/biosurfa)
- internal/CLAUDE.md (claude-code configuration) (internal/CLA)
- internal/extract/CLAUDE.md (claude-code configuration) (internal/ext)
- internal/ingest/CLAUDE.md (claude-code configuration) (internal/ing)
- internal/llm/CLAUDE.md (claude-code configuration) (internal/llm)
- internal/rules/CLAUDE.md (claude-code configuration) (internal/rul)
- 5,535 lines of first-party code in ~3.4h (1,605 lines/hour, 14 commit session) (c87682240b06)
- 5,825 lines of first-party code in ~4.2h (1,401 lines/hour, 11 commit session) (c5c753f2c132)
- 8,443 lines of first-party code in ~6.5h (1,309 lines/hour, 28 commit session) (757b13eb217e)
- 4,544 lines of first-party code in ~4.5h (1,008 lines/hour, 19 commit session) (d2b2af3c7bf7)
- 2,626 lines of first-party code in ~2.7h (967 lines/hour, 7 commit session) (484cd7efc126)
- 3,230 lines of first-party code in ~3.6h (901 lines/hour, 17 commit session) (45911d483f39)
- 4,910 lines of first-party code in ~5.8h (847 lines/hour, 12 commit session) (d47ce4e4cee9)
- 2,330 lines of first-party code in ~3.0h (773 lines/hour, 8 commit session) (400f47a86756)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 1.51, CI runs tests; 14% of function code in complex or long functions; 8% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 65 |
| Duplication | 63 |
| Code smells (Opengrep) | 86 |
| Tests and CI | 100 |
| Documentation | 65 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 807; mean complexity 3.8, 90th percentile 9; 17 complex and 5 long functions
- Duplicated lines: 7.7% of 14,990 compared
- Tests: 31,199 test lines for 20,606 source lines (ratio 1.51); CI test commands: go test; 90% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- ValidateSourceGroundedClaim in internal/domain/claimlint/source_grounding.go: complexity 37, 82 lines
- EnforceClaimAuthorPolicy in internal/config/policyguard/policyguard.go: complexity 36, 100 lines
- runClaimExtract in cmd/biosurface/claim_extract.go: complexity 29, 187 lines
- Run in internal/rules/robustness/gate.go: complexity 27, 62 lines
- main in scripts/dataprep/extract_de_replogle.py: complexity 27, 84 lines
Security
Security posture is adequate: 1 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 92 |
| Vulnerable dependencies (OSV) | 100 |
| CI workflows (zizmor) | 63 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/llm/codex/codex.go:205 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:15 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:18 |
| medium | opengrep/go.lang.security.audit.xss.unsafe-template-type: Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use [confidence low] |
internal/adapters/serve/assets.go:55 |
| medium | opengrep/go.lang.security.audit.xss.no-io-writestring-to-responsewriter: Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low] |
internal/adapters/serve/assets.go:153 |
| medium | opengrep/go.lang.security.audit.xss.no-io-writestring-to-responsewriter: Detected 'io.WriteString()' writing directly to 'http.ResponseWriter'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package to render data to users. [confidence low] |
internal/adapters/serve/assets.go:210 |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter: Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low] |
internal/adapters/serve/claims.go:48 |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter: Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low] |
internal/adapters/serve/claims.go:95 |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter: Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low] |
internal/adapters/serve/claims.go:155 |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter: Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low] |
internal/adapters/serve/claims.go:212 |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter: Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low] |
internal/adapters/serve/manifest_write.go:62 |
| medium | opengrep/go.lang.security.audit.xss.no-direct-write-to-responsewriter: Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. [confidence low] |
internal/adapters/serve/serve.go:268 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
internal/report/markdown/report.go:9 |
| medium | opengrep/go.lang.security.audit.xss.unsafe-template-type: Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use [confidence low] |
internal/report/viewer/viewer.go:230 |
| medium | opengrep/go.lang.security.audit.xss.unsafe-template-type: Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use [confidence low] |
internal/report/viewer/viewer.go:291 |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low] |
scripts/dataprep/extract_de_replogle.py:92 |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low] |
scripts/dataprep/extract_de_replogle.py:127 |
| medium | opengrep/python.lang.security.audit.dynamic-urllib-use-detected: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low] |
scripts/dataprep/extract_de_replogle.py:167 |
| medium | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/ci.yml:14 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/ci.yml:10 |
| low | opengrep/python.lang.security.use-defusedcsv: Detected the generation of a CSV file using the built-in csv module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the [confidence low] |
scripts/dataprep/compute_enrichment_replogle.py:161 |
| low | opengrep/python.lang.security.use-defusedcsv: Detected the generation of a CSV file using the built-in csv module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the [confidence low] |
scripts/dataprep/extract_concordance.py:40 |
| low | opengrep/python.lang.security.use-defusedcsv: Detected the generation of a CSV file using the built-in csv module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the [confidence low] |
scripts/dataprep/extract_de_replogle.py:117 |
| low | opengrep/python.lang.security.use-defusedcsv: Detected the generation of a CSV file using the built-in csv module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the [confidence low] |
scripts/dataprep/extract_de_replogle.py:189 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 20,606; test lines: 31,199
| Language | Lines |
|---|---|
| Go | 50,662 |
| Python | 635 |
| JavaScript | 290 |
| Shell | 200 |
| Ruby | 18 |