sennabecool/nts-dial

A repository for nts-mini

https://github.com/sennabecool/nts-dial · commit af29dadd8994 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/sennabecool/nts-dial
Commit: af29dadd899445d7af391897ccd7b275a792d17c
Generated: 2026-11-13T23:55:20+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	20	explicit	75%	100%
Code quality	48	poor	90%	100%
Security	85	adequate	85%	100%

AI provenance

Explicit AI attribution on 20% of first-party code added; an estimated 20% including velocity signals.

Explicitly attributed share (lower bound): 20.3%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 20.3%

AI tool	Attributed commits	Lines added
OpenAI Codex	4	538

Current source lines last changed by AI-attributed commits: 516 of 2,545.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	0.0	0.0	n/a
Security	0.0	0.0	n/a

Month	Lines added	Attributed to AI
2026-08	2,650	20%

Evidence

OpenAI Codex: on merged branch (2b5bf53e9f) (a8fe5554ca32)
OpenAI Codex: on merged branch (3ca5a1d3ae) (80ff4440c2e7)
OpenAI Codex: on merged branch (6cc7cbf871) (4b717cccc8ca)
OpenAI Codex: on merged branch (80beb0d600) (09909846e3ed)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 27% of function code in complex or long functions; 8% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	45
Duplication	60
Code smells (Opengrep)	100
Tests and CI	15
Documentation	40
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 125; mean complexity 3.0, 90th percentile 6; 1 complex and 2 long functions
Duplicated lines: 8.4% of 1,793 compared
Tests: 0 test lines for 2,545 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: license, contributing, changelog

Most complex functions:

[body in NTS Dial/ContentView.swift: complexity 22, 240 lines](https://github.com/sennabecool/nts-dial/blob/af29dadd899445d7af391897ccd7b275a792d17c/NTS Dial/ContentView.swift#L471)
[body in NTS Dial/ContentView.swift: complexity 11, 244 lines](https://github.com/sennabecool/nts-dial/blob/af29dadd899445d7af391897ccd7b275a792d17c/NTS Dial/ContentView.swift#L181)

Security

Security posture is adequate: 1 high-severity workflow issues. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	100
Vulnerable dependencies (OSV)	n/a
CI workflows (zizmor)	82
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	n/a

Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates

Top findings

Severity	Finding	Location
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:25
low	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/release.yml:24
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:82
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:83
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:86
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:103
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:104
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:105
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:112
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:122
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:162
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:163
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:163
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:164
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:165
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:169
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:170
info	`zizmor/template-injection`: code injection via template expansion [confidence low]	.github/workflows/release.yml:176

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v1.2.1 ships NTS.Dial-1.2.1.dmg (131 downloads)
binary-release-asset: release v1.2 ships NTS.Dial-1.2.dmg (5 downloads)
binary-release-asset: release v1.1 ships NTS.Dial-1.1.dmg (32 downloads)
binary-release-asset: release v1.0 ships NTS.Dial.app.zip (4 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 2,545; test lines: 0

Language	Lines
Swift	2,374
Shell	171

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/sennabecool/nts-dial/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/sennabecool/nts-dial/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/sennabecool/nts-dial/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/sennabecool/nts-dial/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/sennabecool/nts-dial/security.svg)](https://repotrust.synapticcyber.com/r/github.com/sennabecool/nts-dial/)