RepoTrust

pStrikeZ/Nyx-Refrain

Stream your Windows / Linux PC's system audio to HomePod and other AirPlay 2 speakers with low latency

https://github.com/pStrikeZ/Nyx-Refrain · commit c31fbd8d504a · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

RepoTrust ai badge RepoTrust quality badge RepoTrust security badge

Dispute this score or request a re-score Full report JSON

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 6 explicit 83% 100%
Code quality 67 adequate 90% 100%
Security 56 weak 85% 100%

AI provenance

Explicit AI attribution on 6% of first-party code added; an estimated 6% including velocity signals.

AI tool Attributed commits Lines added
Claude Code 28 2,055
OpenAI Codex 2 156

Current source lines last changed by AI-attributed commits: 1,766 of 32,089.

Findings per 1,000 lines AI-attributed Other Ratio
Quality 0.0 0.0 n/a
Security 6.795 5.837 1.16x
Month Lines added Attributed to AI
2026-09 28,821 0%
2026-10 5,607 37%
2026-11 156 100%

Evidence

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.05, CI runs tests; 32% of function code in complex or long functions; 4% duplicated lines. Weakest area: complexity.

Area Score
Complexity (lizard) 38
Duplication 81
Code smells (Opengrep) 100
Tests and CI 68
Documentation 65
Type safety 40
Process (Scorecard review/maintenance) n/a

Most complex functions:

Security

Security posture is weak: 11 known vulnerabilities in 8 dependencies; 22 high-severity workflow issues. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 60
Vulnerable dependencies (OSV) 67
CI workflows (zizmor) 2
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a

Top findings

Severity Finding Location
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:26
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:39
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:44
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:48
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:98
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:104
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:110
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:116
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:122
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:128
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:134
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:140
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:146
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:152
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:158
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/build.yml:172
high zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] .github/workflows/build.yml:44
high zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] .github/workflows/build.yml:48
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:24
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:27
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:34
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/ci.yml:38
medium osv/GHSA-wrw7-89jp-8q8g: [email protected] (crates.io) is affected by RUSTSEC-2024-0429, GHSA-wrw7-89jp-8q8g Cargo.lock
medium osv/RUSTSEC-2024-0370: [email protected] (crates.io) is affected by RUSTSEC-2024-0370 Cargo.lock
medium osv/RUSTSEC-2026-0486: [email protected] (crates.io) is affected by RUSTSEC-2026-0486 Cargo.lock

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Language Lines
Rust 32,560
Shell 709
Python 321
PowerShell 38

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/pStrikeZ/Nyx-Refrain/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/pStrikeZ/Nyx-Refrain/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/pStrikeZ/Nyx-Refrain/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/pStrikeZ/Nyx-Refrain/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/pStrikeZ/Nyx-Refrain/security.svg)](https://repotrust.synapticcyber.com/r/github.com/pStrikeZ/Nyx-Refrain/)