ellie/lgtm

• Repository: https://github.com/ellie/lgtm
• Commit: b929ee6033f92b6af4ac38c0e033281ef540ceab
• Generated: 2026-11-13T23:56:59+00:00
• Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

AI provenance

Weak signals consistent with AI-assisted development.

• Explicitly attributed share (lower bound): 0.0%
• Unattributed share in AI-consistent velocity bursts: 57.8%
• Estimated AI-generated share: 0.0%

Evidence

• 2,822 lines of first-party code in ~1.1h (2,489 lines/hour, 2 commit session) (3a7e19ca5004)
• 6,528 lines of first-party code in ~3.7h (1,776 lines/hour, 11 commit session) (8594e56fedcd)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.00, no CI test run detected; 27% of function code in complex or long functions; 5% duplicated lines. Weakest area: testing.

• Functions: 446; mean complexity 4.0, 90th percentile 9; 16 complex and 15 long functions
• Duplicated lines: 5.4% of 11,558 compared
• Tests: 0 test lines for 14,833 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
• Docs missing or thin: contributing, changelog

Most complex functions:

• render in crates/app/src/main.rs: complexity 41, 333 lines
• parse_patch in crates/diff-core/src/lib.rs: complexity 29, 103 lines
• send_chat in crates/app/src/main.rs: complexity 27, 160 lines
• build_rows in crates/app/src/main.rs: complexity 27, 290 lines
• render_row in crates/app/src/main.rs: complexity 26, 321 lines

Security

Security posture is weak: 53 known vulnerabilities in 35 dependencies; 2 high-severity workflow issues. Weakest area: posture.

• Known vulnerabilities: 53 in 35 packages (critical 2, high 10, medium 5, low 2)

• Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles

Top findings

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

• binary-release-asset: release latest ships LGTM.dmg (18 downloads)
• readme-download-lure: links directly to a downloadable archive or installer

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

• Source lines: 14,833; test lines: 0