dadlerj/tin
- Repository: https://github.com/dadlerj/tin
- Commit:
ee3f98f4ac74942b75859173ab88d5e6a22ae7d1 - Generated: 2026-11-13T23:57:25+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 53% | 100% |
| Code quality | 55 | weak | 90% | 100% |
| Security | 88 | strong | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 1 | 0 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 0 of 8,427.
Too few lines in one group to compare finding densities.
- Stylometry index: 0.77 per 1,000 lines (narrated steps 2, placeholders 0, assistant phrasing 0, emoji 9). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 9,525 | 0% |
| 2026-01 | 2,081 | 0% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (7d878284352f)
- .claude/commands/branches.md (claude-code configuration) (.claude/comm)
- .claude/commands/checkout.md (claude-code configuration) (.claude/comm)
- .claude/commands/commit.md (claude-code configuration) (.claude/comm)
- .claude/settings.json (claude-code configuration) (.claude/sett)
- CLAUDE.md (claude-code configuration) (CLAUDE.md)
- AGENTS.md (generic-agent configuration) (AGENTS.md)
- step-by-step narration comment: // First, try to find in PATH (internal/hoo)
- step-by-step narration comment: // First, try to find the path separator (internal/rem)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 0.30, no CI test run detected; 29% of function code in complex or long functions; 8% duplicated lines. Weakest area: testing.
| Area | Score |
|---|---|
| Complexity (lizard) | 42 |
| Duplication | 61 |
| Code smells (Opengrep) | 86 |
| Tests and CI | 41 |
| Documentation | 65 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 270; mean complexity 5.6, 90th percentile 13; 21 complex and 5 long functions
- Duplicated lines: 8.3% of 5,576 compared
- Tests: 2,531 test lines for 8,427 source lines (ratio 0.30); CI test commands: none detected; 14% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- summarizeToolCalls in internal/commands/thread.go: complexity 38, 135 lines
- Commit in internal/commands/commit.go: complexity 37, 120 lines
- Status in internal/commands/status.go: complexity 31, 101 lines
- parseAmpMarkdown in internal/commands/amp.go: complexity 27, 102 lines
- Pull in internal/remote/client.go: complexity 27, 104 lines
Security
Security posture is strong: 1 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 94 |
| Vulnerable dependencies (OSV) | 100 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 20 |
| OpenSSF Scorecard | n/a |
- Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/commands/amp.go:201 |
| medium | opengrep/go.lang.security.audit.net.use-tls: Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. [confidence medium] |
internal/web/server.go:39 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 8,427; test lines: 2,531
| Language | Lines |
|---|---|
| Go | 10,958 |