Leaderboard github.com
duguyue100/midnight-captain
Inspired by Midnight Commander, tailored to my taste.
AI provenance
0%
possible
- Confidence
- 49%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
78/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
67/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/duguyue100/midnight-captain
- Commit:
400875060ada16cce0545160da1b0532fc66dbb3 - Generated: 2026-11-13T23:53:45+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 49% | 100% |
| Code quality | 78 | adequate | 90% | 100% |
| Security | 67 | weak | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
AI tooling configured in repo: generic-agent
-
Stylometry index: 0.09 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 1). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-04 | 8,440 | 0% |
Evidence
- AGENTS.md (generic-agent configuration) (AGENTS.md)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.42, CI runs tests; 20% of function code in complex or long functions; 3% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 56 |
| Duplication | 85 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 83 |
| Documentation | 65 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 233; mean complexity 3.9, 90th percentile 9; 7 complex and 2 long functions
- Duplicated lines: 2.7% of 3,799 compared
- Tests: 2,244 test lines for 5,378 source lines (ratio 0.42); CI test commands: go test; 18% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- Update in internal/app/update.go: complexity 48, 174 lines
- nerdIcon in internal/ui/pane/view.go: complexity 41, 90 lines
- formatKind in internal/ui/pane/view.go: complexity 36, 80 lines
- handleGlobalKey in internal/app/update.go: complexity 29, 129 lines
- handleKey in internal/ui/pane/update.go: complexity 25, 73 lines
Security
Security posture is weak: 18 known vulnerabilities in 2 dependencies; 2 high-severity SAST findings; 10 high-severity workflow issues. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 91 |
| Vulnerable dependencies (OSV) | 74 |
| CI workflows (zizmor) | 14 |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 18 in 2 packages (critical 7, high 2, medium 4, low 0)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-jppx-rxg9-jmrx: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx |
go.mod |
| critical | osv/GHSA-f5wc-c3c7-36mc: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc |
go.mod |
| critical | osv/GHSA-vgwf-h737-ff37: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37 |
go.mod |
| critical | osv/GHSA-89gr-r52h-f8rx: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx |
go.mod |
| critical | osv/GHSA-rm3j-f69w-wqmq: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq |
go.mod |
| critical | osv/GHSA-5cgq-3rg8-m6cv: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv |
go.mod |
| critical | osv/GHSA-x527-x647-q7gg: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg |
go.mod |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/app/update.go:628 |
| high | opengrep/go.lang.security.audit.dangerous-exec-command: Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
internal/app/update.go:672 |
| high | osv/GHSA-q4h4-gmj2-qvw2: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2 |
go.mod |
| high | osv/GHSA-w879-237q-wc7r: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r |
go.mod |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build.yml:16 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/build.yml:19 |
| high | zizmor/excessive-permissions: overly broad permissions [confidence high] |
.github/workflows/release.yml:9 |
| high | zizmor/template-injection: code injection via template expansion [confidence high] |
.github/workflows/release.yml:82 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:29 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:32 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:50 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:63 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:66 |
| high | zizmor/cache-poisoning: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] |
.github/workflows/release.yml:32 |
| medium | osv/GHSA-45gg-vh54-h5m9: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9 |
go.mod |
| medium | osv/GHSA-78mq-xcr3-xm33: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33 |
go.mod |
| medium | osv/GHSA-qpw4-5x99-6vjp: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp |
go.mod |
| medium | osv/GHSA-9m57-25v3-79x9: golang.org/x/crypto@0.50.0 (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9 |
go.mod |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 5,378; test lines: 2,244
| Language | Lines |
|---|---|
| Go | 7,469 |
| Shell | 153 |