{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:27:25.343621Z","repo":{"ref":{"host":"github.com","owner":"wendux","name":"DSBridge-Android"},"default_branch":"master","clone_url":"https://github.com/wendux/DSBridge-Android.git","html_url":"https://github.com/wendux/DSBridge-Android","description":":earth_americas: A modern cross-platform JavaScript bridge, through which you can invoke each other's functions synchronously or asynchronously between JavaScript and native.","stars":3881,"forks":646,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":902,"primary_language":"Java","license_spdx":null,"created_at":"2017-01-02T11:58:53Z","pushed_at":"2020-09-11T06:36:58Z","security_policy_url":null,"distribution":{"owner_created_at":"2016-07-12T03:33:28Z","owner_type":"User","release_assets":[]}},"commit_sha":"22b19ffaf1538a4352f16134606d417aaab42dbc","profile":{"lines_by_language":{"Java":1615,"JavaScript":275,"TypeScript":38},"files_by_category":{"config":22,"source":16,"other":13,"binary":6,"docs":3,"test":2},"source_lines":1885,"test_lines":43},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":51.7,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":100.0,"duplication":39.2,"lint":67.2,"testing":36.8,"docs":40.0,"type_safety":40.0,"process":5.0},"summary":"Code quality is weak: test-to-source ratio 0.02, no CI test run detected; 0% of function code in complex or long functions; 16% duplicated lines. Weakest area: process."},"security":{"score":69.4,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":89.5,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":22.5},"summary":"Security posture is weak: no high-impact findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":1.5,"check:Code-Review":1.0,"check:Maintained":0.0,"check:Binary-Artifacts":9.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:License":0.0,"check:Fuzzing":0.0,"check:SAST":0.0,"check:Branch-Protection":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Code-Review: 1/10 (Found 3/24 approved changesets -- score normalized to 1)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/wendux/DSBridge-Android","weight":0.9},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/wendux/DSBridge-Android","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 9/10 (binaries present in source code)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/wendux/DSBridge-Android","weight":0.1},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/wendux/DSBridge-Android","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/wendux/DSBridge-Android","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 0/10 (license file not detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/wendux/DSBridge-Android","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/wendux/DSBridge-Android","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/wendux/DSBridge-Android","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/wendux/DSBridge-Android","weight":1.0}],"data":{"date":"2026-11-02","commit":"22b19ffaf1538a4352f16134606d417aaab42dbc","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":121.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":3286.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2017-01":{"loc":772,"attributed_loc":0},"2017-02":{"loc":5,"attributed_loc":0},"2017-03":{"loc":1,"attributed_loc":0},"2017-05":{"loc":66,"attributed_loc":0},"2017-06":{"loc":28,"attributed_loc":0},"2017-08":{"loc":8,"attributed_loc":0},"2017-10":{"loc":361,"attributed_loc":0},"2017-11":{"loc":4,"attributed_loc":0},"2017-12":{"loc":0,"attributed_loc":0},"2018-01":{"loc":870,"attributed_loc":0},"2018-02":{"loc":648,"attributed_loc":0},"2018-03":{"loc":67,"attributed_loc":0},"2018-04":{"loc":171,"attributed_loc":0},"2018-05":{"loc":25,"attributed_loc":0},"2018-06":{"loc":234,"attributed_loc":0},"2018-07":{"loc":13,"attributed_loc":0},"2018-09":{"loc":4,"attributed_loc":0},"2018-12":{"loc":0,"attributed_loc":0},"2019-01":{"loc":9,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":40.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":3286.0,"pre_ai_era_burst_loc":0.0,"measured_loc":3286.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":188.40937114673244,"median_loc_per_hour":52.080366357069146,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":0.0,"flagged_releases":0.0,"max_loc_per_day":0.0},"findings":[],"evidence":[],"data":{"releases":[]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":1885.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":1.0,"findings_high":0.0,"findings_medium":1.0,"findings_low":0.0,"weighted_findings":0.6,"scanned_lines":1885.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"app/src/main/AndroidManifest.xml","line":13,"fingerprint":"java.android.security.exported_activity:app/src/main/AndroidManifest.xml:13"}],"evidence":[],"data":{"rulesets":["java","javascript","typescript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0496,"unpinned_manifests":1.0},"findings":[],"evidence":[{"kind":"posture","description":"dsbridge/npm/package.json has no lockfile alongside it (unpinned dependencies)","ref":"dsbridge/npm/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":158.0,"function_nloc":1436.0,"mean_ccn":2.32,"p90_ccn":5.0,"complex_functions":0.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":1180.0,"duplicated_lines":184.0,"duplicated_share":0.1559,"files":16.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: app/src/main/assets/dsbridge.js:1 and dsbridge/npm/index.js:1","ref":"app/src/main/assets/dsbridge.js","url":"https://github.com/wendux/DSBridge-Android/blob/22b19ffaf1538a4352f16134606d417aaab42dbc/app/src/main/assets/dsbridge.js#L1","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":3.0,"weighted_findings":3.0,"scanned_lines":1885.0,"category:best-practice":3.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.javascript-prompt","severity":"medium","message":"found prompt() call; should this be in production code?","path":"app/src/main/assets/dsbridge.js","line":21,"fingerprint":"javascript.lang.best-practice.javascript-prompt:app/src/main/assets/dsbridge.js:21"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-prompt","severity":"medium","message":"found prompt() call; should this be in production code?","path":"dsbridge/npm/index.js","line":21,"fingerprint":"javascript.lang.best-practice.javascript-prompt:dsbridge/npm/index.js:21"},{"rule_id":"opengrep/javascript.lang.best-practice.javascript-alert","severity":"medium","message":"found alert() call; should this be in production code?","path":"dsbridge/npm/test.ts","line":3,"fingerprint":"javascript.lang.best-practice.javascript-alert:dsbridge/npm/test.ts:3"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.0456,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0667,"test_lines":43.0,"source_lines":1885.0,"test_ratio":0.0228,"ci_files":1.0,"cochange_share":0.0167,"cochange_commits":60.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":347.0},"findings":[],"evidence":[{"kind":"docs","description":"readme.md","ref":"readme.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":3.0,"escapes_per_kloc":3.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}