Leaderboard github.com
qax-os/goreporter
A Golang tool that does static analysis, unit testing, code review and generate code quality report.
AI provenance
0%
none-detected
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
54/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
72/100
adequate
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% none-detected
No AI attribution or AI-consistent velocity signals detected.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts0%
- Estimated AI-generated share0%
- AI tool configuration files0
- Work sessions at AI pace0
- Releases at AI pace0
- Coding-style index (1.0+ means possible)0.12
Lines added per month all AI-attributed share
- 2017-0370,964 · 0% AI
- 2017-0497,943 · 0% AI
- 2017-056,615 · 0% AI
- 2017-06564 · 0% AI
- 2017-0713,093 · 0% AI
- 2017-08211 · 0% AI
- 2017-091,255 · 0% AI
- 2017-103,037 · 0% AI
- 2017-115 · 0% AI
- 2017-123 · 0% AI
- 2018-0416 · 0% AI
- 2018-0548 · 0% AI
- 2018-095 · 0% AI
Evidence by analyzer
Explicit AI attributionok
- attributed_commit_share
- 0.0%
- attributed_commits
- 0
- attributed_loc
- 0
- attributed_loc_share
- 0.0%
- commits
- 209
- effective_loc
- 193,759
- tools_detected
- 0
AI tool configurationok
- artifacts
- 0
- tools_configured
- 0
- workflow_agents
- 0
Commit velocityok
- excluded_import_loc
- 64,922
- flagged_loc
- 0
- flagged_loc_share
- 0.0%
- flagged_units
- 0
- max_loc_per_hour
- 18,618.35
- measured_loc
- 128,837
- median_loc_per_hour
- 98.34
- pr_timed_units
- 2
- pre_ai_era_burst_loc
- 110,001
- pre_ai_era_bursts
- 5
- pre_ai_era_measured_loc
- 128,837
- work_units
- 94
Release velocityok
- flagged_releases
- 0
- max_loc_per_day
- 110,001.60
- releases
- 17
Coding styleok5 items
- step-by-step narration comment: // First, scan for the last comment that occurs before the "package" keyword.
- step-by-step narration comment: // Step 1. Number vertices by depth-first preorder.
- step-by-step narration comment: // Step 3. Implicitly define the immediate dominator of each node.
- step-by-step narration comment: // Step 2. Compute the semidominators of all nodes.
- step-by-step narration comment: // Step 4. Explicitly define the immediate dominator of each
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 5
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 2
- files:placeholder
- 0
- index
- 0.12
- lines_scanned
- 41,135
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0.12
- per_kloc:placeholder
- 0
Code quality
54 weak
Code quality is weak: test-to-source ratio 0.11, no CI test run detected; 22% of function code in complex or long functions; 18% duplicated lines. Weakest area: process.
How the score is built
- Complexity52
- Duplication35
- Lint and smells95
- Tests and CI51
- Documentation80
- Type safetynot measured
- Review process5
Evidence by analyzer
Complexity (lizard)ok10 items
- trans in linters/copycheck/syntax/golang/golang.go: complexity 89, 257 lines
- BuildGraph in linters/staticcheck/vrp/vrp.go: complexity 68, 214 lines
- checkInstr in linters/simpler/ssa/sanity.go: complexity 56, 101 lines
- anonymous__27 in linters/simplecode/simple/lint.go: complexity 50, 144 lines
- anonymous__29 in linters/simpler/lint.go: complexity 50, 144 lines
- expr0 in linters/simpler/ssa/builder.go: complexity 48, 204 lines
- fn in linters/simplecode/testdata/nil-len.go: complexity 47, 56 lines
- stmt in linters/simpler/ssa/builder.go: complexity 47, 147 lines
- fn in linters/simpler/testdata/nil-len.go: complexity 47, 56 lines
- Solve in linters/staticcheck/vrp/vrp.go: complexity 39, 130 lines
- complex_functions
- 74
- function_nloc
- 27,137
- functions
- 2,294
- long_functions
- 13
- many_param_functions
- 0
- mean_ccn
- 3.57
- p90_ccn
- 8
- risky_nloc_share
- 21.7%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: engine/config.go:1 and engine/processbar/processbar.go:1
- 6+ duplicated lines: engine/config.go:175 and engine/config.go:202
- 6+ duplicated lines: engine/report2html.go:8 and linters/gofmt/gofmt.go:8
- 6+ duplicated lines: engine/strategy_deadcode.go:52 and engine/strategy_gofmt.go:51
- 6+ duplicated lines: engine/strategy_deadcode.go:55 and engine/strategy_interfacer.go:55
- 6+ duplicated lines: engine/strategy_gofmt.go:44 and engine/strategy_golint.go:45
- 6+ duplicated lines: engine/strategy_golint.go:34 and engine/strategy_govet.go:38
- 6+ duplicated lines: engine/strategy_simplecode.go:34 and engine/strategy_spellcheck.go:35
- 6+ duplicated lines: engine/template.html.go:1147 and engine/template.html.go:1261
- 6+ duplicated lines: linters/aligncheck/aligncheck.go:1 and linters/structcheck/structcheck.go:2
- compared_lines
- 29,658
- duplicated_lines
- 5,209
- duplicated_share
- 17.6%
- files
- 349
Lintok
- category:correctness
- 12
- findings
- 12
- scanned_lines
- 43,363
- weighted_findings
- 9
Tests and CIok1 item
- CI config: .travis.yml
.travis.yml
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- no
- check:has_tests
- yes
- check:test_ratio
- no
- check:tests_cochange
- yes
- ci_files
- 1
- cochange_commits
- 126
- cochange_share
- 26.2%
- source_lines
- 43,363
- test_lines
- 4,941
- test_ratio
- 0.11
Documentationok3 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md
- check:changelog
- no
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 71
Type safetyskipped
Security
72 adequate
Security posture is adequate: 1 high-severity SAST findings. Weakest area: posture.
How the score is built
- Secrets100
- Static analysis (SAST)98
- Vulnerable dependenciesnot measured
- CI workflowsnot measured
- Security posture0
- OpenSSF Scorecard20
Evidence by analyzer
OpenSSF Scorecardok10 items
- Scorecard Code-Review: 1/10 (Found 4/21 approved changesets -- score normalized to 1)
- Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)
- Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)
- Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)
- Scorecard Pinned-Dependencies: 0/10 (dependency not pinned by hash detected -- score normalized to 0)
- Scorecard Security-Policy: 0/10 (security policy file not detected)
- Scorecard License: 10/10 (license file detected)
- Scorecard Fuzzing: 0/10 (project is not fuzzed)
- Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)
- Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)
- aggregate
- 2
- check:Binary-Artifacts
- yes
- check:Branch-Protection
- no
- check:CII-Best-Practices
- no
- check:Code-Review
- yes
- check:Fuzzing
- no
- check:License
- yes
- check:Maintained
- no
- check:Pinned-Dependencies
- no
- check:SAST
- no
- check:Security-Policy
- no
Package registriesskipped
no registry dependencies declared
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 7
- findings_high
- 1
- findings_low
- 0
- findings_medium
- 6
- parse_errors
- 0
- scanned_lines
- 43,363
- weighted_findings
- 2.60
Dependencies (osv-scanner)skipped
CI workflows (zizmor)skipped
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- no
- signed_commit_share
- 14.5%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
1 high14 medium4 low
19 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| high | opengrep/go.lang.security.audit.dangerous-exec-command |
engine/report2html.go:817 | Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute... | Static analysis (opengrep) |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
engine/report2html.go:764 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
engine/report2html.go:779 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
engine/reporter.go:170 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
linters/countcode/countcode.go:186 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
linters/countcode/countcode.go:190 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.permissions.incorrect-default-permission |
linters/depend/depend.go:127 | Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set... | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
linters/simplecode/lint/testutil/util.go:50 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.correctness.use-filepath-join |
linters/simpler/lint/testutil/util.go:71 | `path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators. | Lint |
| medium | opengrep/go.lang.security.audit.xss.unsafe-template-type |
engine/report2html.go:741 | Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block |
linters/aligncheck/aligncheck.go:117 | Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1 |
linters/copycheck/syntax/syntax.go:168 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
linters/simpler/ssa/testmain.go:25 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
linters/spellcheck/spellcheck.go:12 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| medium | opengrep/go.lang.security.audit.xss.import-text-template |
linters/staticcheck/lint.go:17 | When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does not... | Static analysis (opengrep) |
| low | opengrep/go.lang.correctness.hardcoded-eq-true-or-false |
linters/simpler/ssa/func.go:618 | Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on... | Lint |
| low | opengrep/go.lang.correctness.hardcoded-eq-true-or-false |
linters/simpler/ssa/testmain.go:157 | Detected useless if statement. 'if (True)' and 'if (False)' always result in the same behavior, and therefore is not necessary in the code. Remove the 'if (False)' expression completely or just the 'if (True)' comparison depending on... | Lint |
| low | opengrep/go.lang.correctness.eqeq-is-bad |
linters/spellcheck/spellcheck.go:185 | Detected useless comparison operation `outFlag == outFlag` or `outFlag != outFlag`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression... | Lint |
| low | opengrep/go.lang.correctness.eqeq-is-bad |
linters/spellcheck/spellcheck.go:204 | Detected useless comparison operation `workers == workers` or `workers != workers`. This will always return 'True' or 'False' and therefore is not necessary. Instead, remove this comparison operation or use another comparison expression... | Lint |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-4 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 12 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | skipped | — | 0 | |
| CI workflows (zizmor) | Security | skipped | — | 0 | |
| Dependencies (osv-scanner) | Security | skipped | — | 0 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | skipped | — | 0 | no registry dependencies declared |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 7 | |
| OpenSSF Scorecard | Security | ok | scorecard v5.6.0 | 0 | |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 0 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | df1b20f7c5d0 | prov-5+qual-2+sec-2 | 0% | 54 | 72 |
| 2026-11-14 | df1b20f7c5d0 | prov-4+qual-2+sec-2 | 0% | 54 | 72 |
Full text report
- Repository: https://github.com/qax-os/goreporter
- Commit:
df1b20f7c5d0f3538a3dc2cc04f68c59ba177fc5 - Generated: 2026-11-14T14:52:06+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 54 | weak | 90% | 100% |
| Security | 72 | adequate | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
Stylometry index: 0.12 per 1,000 lines (narrated steps 5, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2017-04 | 97,943 | 0% |
| 2017-05 | 6,615 | 0% |
| 2017-06 | 564 | 0% |
| 2017-07 | 13,093 | 0% |
| 2017-08 | 211 | 0% |
| 2017-09 | 1,255 | 0% |
| 2017-10 | 3,037 | 0% |
| 2017-11 | 5 | 0% |
| 2017-12 | 3 | 0% |
| 2018-04 | 16 | 0% |
| 2018-05 | 48 | 0% |
| 2018-09 | 5 | 0% |
Evidence
- step-by-step narration comment: // First, scan for the last comment that occurs before the "package" keyword. (linters/goli)
- step-by-step narration comment: // Step 1. Number vertices by depth-first preorder. (linters/simp)
- step-by-step narration comment: // Step 3. Implicitly define the immediate dominator of each node. (linters/simp)
- step-by-step narration comment: // Step 2. Compute the semidominators of all nodes. (linters/simp)
- step-by-step narration comment: // Step 4. Explicitly define the immediate dominator of each (linters/simp)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.11, no CI test run detected; 22% of function code in complex or long functions; 18% duplicated lines. Weakest area: process.
| Area | Score |
|---|---|
| Complexity (lizard) | 52 |
| Duplication | 35 |
| Code smells (Opengrep) | 95 |
| Tests and CI | 51 |
| Documentation | 80 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | 5 |
- Functions: 2,294; mean complexity 3.6, 90th percentile 8; 74 complex and 13 long functions
- Duplicated lines: 17.6% of 29,658 compared
- Tests: 4,941 test lines for 43,363 source lines (ratio 0.11); CI test commands: none detected; 26% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- trans in linters/copycheck/syntax/golang/golang.go: complexity 89, 257 lines
- BuildGraph in linters/staticcheck/vrp/vrp.go: complexity 68, 214 lines
- checkInstr in linters/simpler/ssa/sanity.go: complexity 56, 101 lines
- anonymous__27 in linters/simplecode/simple/lint.go: complexity 50, 144 lines
- anonymous__29 in linters/simpler/lint.go: complexity 50, 144 lines
Security
Security posture is adequate: 1 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 98 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | 20 |
- Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
- OpenSSF Scorecard aggregate: 2.0/10 (published 2026-10-19)
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
engine/report2html.go:817 |
| medium | opengrep/go.lang.security.audit.xss.unsafe-template-type: Semgrep could not determine that the argument to 'template.HTML()' is a constant. 'template.HTML()' and similar does not escape contents. Be absolutely sure there is no user-controlled data in this template. If user data can reach this template, you may have a XSS vulnerability. Instead, do not use [confidence low] |
engine/report2html.go:741 |
| medium | opengrep/go.lang.security.audit.use-of-unsafe-block: Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low] |
linters/aligncheck/aligncheck.go:117 |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] |
linters/copycheck/syntax/syntax.go:168 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
linters/simpler/ssa/testmain.go:25 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
linters/spellcheck/spellcheck.go:12 |
| medium | opengrep/go.lang.security.audit.xss.import-text-template: When working with web applications that involve rendering user-generated content, it's important to properly escape any HTML content to prevent Cross-Site Scripting (XSS) attacks. In Go, the text/template package does not automatically escape HTML content, which can leave your application vuln [confidence low] |
linters/staticcheck/lint.go:17 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 43,363; test lines: 4,941
| Language | Lines |
|---|---|
| Go | 48,290 |
| Shell | 14 |