gitlab-org/cli
A GitLab CLI tool bringing GitLab to your command line
- Repository: https://gitlab.com/gitlab-org/cli
- Commit:
71d2f9135352311e8914c04d6ee9707cf56afc8f - Generated: 2026-11-13T22:50:17+00:00
- Scorer 0.1.0, scoring prov-3+qual-1+sec-1, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 2 | explicit | 95% | 100% |
| Code quality | 81 | strong | 90% | 100% |
| Security | 63 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 2% of first-party code added; an estimated 2% including velocity signals.
- Explicitly attributed share (lower bound): 1.6%
- Unattributed share in AI-consistent velocity bursts: 5.0%
- Estimated AI-generated share: 1.6%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 80 | 5,686 |
- AI tooling configured in repo: claude-code, generic-agent
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 3,712 | 0% |
| 2026-01 | 13,378 | 0% |
| 2026-02 | 9,640 | 0% |
| 2026-03 | 11,753 | 0% |
| 2026-04 | 4,666 | 0% |
| 2026-05 | 16,542 | 0% |
| 2026-06 | 11,964 | 1% |
| 2026-07 | 9,953 | 1% |
| 2026-08 | 20,572 | 1% |
| 2026-09 | 23,792 | 2% |
| 2026-10 | 41,099 | 10% |
| 2026-11 | 28,138 | 3% |
Evidence
- Claude Code: PR description attribution (741820003f66)
- Claude Code: PR description attribution (e32ba4e5f331)
- Claude Code: PR description attribution (6f72f3f602e4)
- Claude Code: PR description attribution (9d225409e3f1)
- Claude Code: PR description attribution (c789a57e5f2f)
- Claude Code: PR description attribution (5f95db6afeb4)
- Claude Code: PR description attribution (948a7c1bca4a)
- Claude Code: PR description attribution (42fe3283e53c)
- Claude Code: PR description attribution (a09b525ea8dc)
- Claude Code: PR description attribution (1340f2d243fb)
- Claude Code: PR description attribution (e840eebd60f2)
- Claude Code: PR description attribution (58b05c328ada)
- Claude Code: PR description attribution (7daafce0a2b7)
- Claude Code: PR description attribution (6292eb1b2eeb)
- Claude Code: PR description attribution (3206215f2bce)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 1.39, CI runs tests; 15% of function code in complex or long functions; 12% duplicated lines. Weakest area: duplication.
| Area | Score |
|---|---|
| Complexity (lizard) | 63 |
| Duplication | 50 |
| Code smells (Opengrep) | 90 |
| Tests and CI | 100 |
| Documentation | 100 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 4,239; mean complexity 3.7, 90th percentile 8; 98 complex and 32 long functions
- Duplicated lines: 11.7% of 71,535 compared
- Tests: 145,525 test lines for 104,396 source lines (ratio 1.39); CI test commands: make test, make check; 92% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- loginRun in internal/commands/auth/login/login.go: complexity 122, 428 lines
- run in internal/commands/mr/create/mr_create.go: complexity 102, 366 lines
- run in internal/commands/project/fork/fork.go: complexity 79, 295 lines
- anonymous__0 in internal/commands/mr/update/mr_update.go: complexity 74, 260 lines
- createRun in internal/commands/release/create/create.go: complexity 68, 243 lines
Security
Security posture is weak: 0 possible secret(s) in the tree, 3 only in history; 5 known vulnerabilities in 2 dependencies; 18 high-severity SAST findings. Weakest area: secrets.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 17 |
| Static analysis (Opengrep) | 93 |
| Vulnerable dependencies (OSV) | 90 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 5 in 2 packages (critical 0, high 0, medium 2, low 2)
-
Posture checks passed: security policy, signed commits, lockfiles; missing: dependency updates
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:19 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
cmd/glab/main.go:138 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/browser/browser.go:46 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/cmdutils/executor.go:36 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/cmdutils/executor.go:45 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/cmdutils/executor.go:51 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/commands/cluster/agent/bootstrap/exec.go:41 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/commands/cluster/agent/bootstrap/exec.go:51 |
| high | opengrep/go.lang.security.audit.dangerous-syscall-exec: Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/commands/duo/cli/execute_unix.go:26 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/commands/duo/cli/execute_windows.go:18 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/commands/mcp/serve/server.go:639 |
| high | opengrep/go.lang.security.audit.dangerous-syscall-exec: Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/commands/orbit/execute_unix.go:18 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/commands/orbit/execute_windows.go:23 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/config/custom_headers.go:64 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/dependencyfirewall/gomodproxy/fetcher.go:68 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/git/git_runner.go:304 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/iostreams/iostreams.go:289 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/iostreams/iostreams.go:625 |
| medium | gitleaks/private-key: Possible private-key secret in history (commit c707d7d3f7); removed from the current tree but still retrievable |
.gitlab-ci.yml:55 |
| medium | gitleaks/private-key: Possible private-key secret in history (commit 7705e8aa64); removed from the current tree but still retrievable |
.github/workflows/go.yml:58 |
| medium | gitleaks/private-key: Possible private-key secret in history (commit 9255e4af53); removed from the current tree but still retrievable |
.travis.yml:28 |
| medium | opengrep/go.lang.security.potential-dos-via-decompression-bomb: Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. io.CopyN() can specify a size. [confidence low] |
internal/binarymgr/extract.go:80 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
internal/cmdutils/url_parser.go:167 |
| medium | opengrep/go.lang.security.shared-url-struct-mutation: Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low] |
internal/commands/api/http.go:31 |
| medium | opengrep/go.lang.security.audit.crypto.use-of-sha1: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] |
internal/commands/mr/mrutils/position.go:235 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v1.130.0 ships glab_1.130.0_linux_armv6.apk (0 downloads)
- binary-release-asset: release v1.130.0 ships glab_1.130.0_linux_s390x.tar.gz (0 downloads)
- binary-release-asset: release v1.130.0 ships glab_1.130.0_linux_amd64.deb (0 downloads)
- binary-release-asset: release v1.130.0 ships glab_1.130.0_Windows_arm64_installer.exe (0 downloads)
- binary-release-asset: release v1.130.0 ships glab_1.130.0_Windows_x86_64_installer.exe (0 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 104,396; test lines: 145,525
| Language | Lines |
|---|---|
| Go | 249,258 |
| Shell | 461 |
| JavaScript | 202 |