Leaderboard github.com
Kikobeats/reachable-url
Resolve a URL as fast as possible and report whether the destination is reachable over HTTP.
AI provenance
47%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
82/100
strong
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
69/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/Kikobeats/reachable-url
- Commit:
d8701702648844c83771b2655187bff830f9b779 - Generated: 2026-11-14T00:10:22+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 47 | explicit | 95% | 100% |
| Code quality | 82 | strong | 90% | 100% |
| Security | 69 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 47% of first-party code added; an estimated 47% including velocity signals.
- Explicitly attributed share (lower bound): 47.1%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 47.1%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 9 | 986 |
| Cursor agent | 6 | 478 |
Current source lines last changed by AI-attributed commits: 357 of 777.
Too few lines in one group to compare finding densities.
- Stylometry index: 9.00 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 18). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2022-03 | 37 | 0% |
| 2022-04 | 180 | 0% |
| 2022-09 | 67 | 0% |
| 2023-09 | 1 | 0% |
| 2024-02 | 11 | 0% |
| 2024-05 | 1 | 0% |
| 2024-06 | 43 | 0% |
| 2025-06 | 414 | 0% |
| 2026-08 | 556 | 99% |
| 2026-09 | 9 | 100% |
| 2026-10 | 255 | 100% |
| 2026-11 | 333 | 100% |
Evidence
- Cursor agent: trailer 'Co-authored-by: Cursor' (3964ec047850)
- Claude Code: trailer 'Co-Authored-By: Claude' (9a00d6d82785)
- Claude Code: trailer 'Co-authored-by: Claude' (3375a64829d3)
- Claude Code: trailer 'Co-authored-by: Claude' (3d5c76a46658)
- Cursor agent: trailer 'Co-authored-by: Cursor' (d10b66d6ab89)
- Claude Code: trailer 'Co-Authored-By: Claude' (96a5b1ee5ea3)
- Cursor agent: trailer 'Co-authored-by: Cursor Agent' (c71651aa84ae)
- Claude Code: trailer 'Co-Authored-By: Claude' (39e953501286)
- Claude Code: trailer 'Co-Authored-By: Claude' (7e0c676257c8)
- Claude Code: trailer 'Co-Authored-By: Claude' (d6f7a3c9d38f)
- Claude Code: trailer 'Co-Authored-By: Claude' (ed8670f0be32)
- Claude Code: trailer 'Co-Authored-By: Claude' (dfdb5c99dc6a)
- Cursor agent: trailer 'Co-authored-by: Cursor' (18105578e68f)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 1.34, CI runs tests; 0% of function code in complex or long functions; 0% duplicated lines. Weakest area: lint.
| Area | Score |
|---|---|
| Complexity (lizard) | 100 |
| Duplication | 100 |
| Code smells (Opengrep) | 47 |
| Tests and CI | 90 |
| Documentation | 85 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | 50 |
- Functions: 88; mean complexity 1.9, 90th percentile 4; 0 complex and 0 long functions
- Duplicated lines: 0.0% of 539 compared
- Tests: 1,042 test lines for 777 source lines (ratio 1.34); CI test commands: npm test; 68% of recent source commits also change tests
- Docs missing or thin: contributing
Security
Security posture is weak: 13 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 100 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | 6 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | 33 |
- Posture checks passed: dependency updates, signed commits; missing: security policy, lockfiles
- OpenSSF Scorecard aggregate: 4.1/10 (published 2026-11-09)
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:20 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:25 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:31 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:35 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/benchmark.yml:121 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/main.yml:17 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/main.yml:21 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/main.yml:25 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/main.yml:35 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pull_request.yml:21 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pull_request.yml:25 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pull_request.yml:29 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pull_request.yml:39 |
| medium | zizmor/dependabot-cooldown: insufficient cooldown in Dependabot updates [confidence high] |
.github/dependabot.yml:3 |
| medium | zizmor/dependabot-cooldown: insufficient cooldown in Dependabot updates [confidence high] |
.github/dependabot.yml:7 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/main.yml:13 |
| medium | zizmor/excessive-permissions: overly broad permissions [confidence medium] |
.github/workflows/pull_request.yml:17 |
| low | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/main.yml:16 |
| low | zizmor/artipacked: credential persistence through GitHub Actions artifacts [confidence low] |
.github/workflows/pull_request.yml:20 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 777; test lines: 1,042
| Language | Lines |
|---|---|
| JavaScript | 1,819 |