ezyang/scubaduck
- Repository: https://github.com/ezyang/scubaduck
- Commit:
00a2a565b7ebe537c883bffab7698b956f1738a2 - Generated: 2026-11-13T23:53:32+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 98 | explicit | 95% | 100% |
| Code quality | 60 | weak | 90% | 100% |
| Security | 50 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 98% of first-party code added; an estimated 98% including velocity signals.
- Explicitly attributed share (lower bound): 98.1%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 98.1%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 139 | 7,454 |
- AI tooling configured in repo: generic-agent
Current source lines last changed by AI-attributed commits: 2,658 of 2,673.
Too few lines in one group to compare finding densities.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-05 | 7,601 | 98% |
Evidence
- OpenAI Codex: PR branch 'codex/add-test-for-scubaduck_db-with-parquet-file' (9a90e2504b88)
- OpenAI Codex: PR branch 'codex/fix--unknown-column--samples--error' (4a407fe09e1f)
- OpenAI Codex: PR branch 'codex/run-and-fix-tests' (e08b86baa34c)
- OpenAI Codex: PR branch 'codex/filter-series-beyond-limit-on-server-side' (2451f864f3fe)
- OpenAI Codex: PR branch 'codex/suggest-correct-time-unit-for-errors' (b2bd0b9c4ad5)
- OpenAI Codex: PR branch 'codex/add-test-for-45deg-x-axis-labels-truncation' (6afebd641798)
- OpenAI Codex: PR branch 'codex/scroll-dropdown-to-current-selection' (079223c1ff52)
- OpenAI Codex: PR branch 'codex/fix-time-series-aggregation-bug' (80a8cedc3fc2)
- OpenAI Codex: PR branch 'codex/add-test-for-bytes-serialization-to-json' (e90ea2e7d928)
- OpenAI Codex: PR branch 'codex/fix-table-view-alignment-issue' (a8074f6ccca3)
- OpenAI Codex: PR branch 'codex/reset-view-settings-on-table-switch' (2ac2fc5088f2)
- OpenAI Codex: PR branch 'codex/add--samples--order-by-option' (9b4de028df02)
- OpenAI Codex: PR branch 'codex/update-table-view-to-hide-unnecessary-columns-for-count-aggr' (e97f6a8ce9da)
- OpenAI Codex: PR branch 'codex/refactor-tests-to-set-default-order-by' (0842e8310c2f)
- OpenAI Codex: PR branch 'codex/fix-avg-aggregate-for-boolean-column' (ec2e26312d14)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 1.08, CI runs tests; 39% of function code in complex or long functions; 2% duplicated lines. Weakest area: lint.
| Area | Score |
|---|---|
| Complexity (lizard) | 31 |
| Duplication | 89 |
| Code smells (Opengrep) | 13 |
| Tests and CI | 100 |
| Documentation | 40 |
| Type safety | 60 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 189; mean complexity 3.3, 90th percentile 7; 7 complex and 2 long functions
- Duplicated lines: 1.9% of 2,174 compared
- Tests: 2,876 test lines for 2,673 source lines (ratio 1.08); CI test commands: pytest; 80% of recent source commits also change tests
- Docs missing or thin: license, contributing, changelog
Most complex functions:
- _quote in scubaduck/server.py: complexity 33, 725 lines
- paramsToSearch in scubaduck/static/js/view_settings.js: complexity 32, 29 lines
- applyParams in scubaduck/static/js/view_settings.js: complexity 25, 53 lines
- parseSearch in scubaduck/static/js/view_settings.js: complexity 23, 29 lines
- showTimeSeries in scubaduck/static/js/timeseries_chart.js: complexity 19, 135 lines
Security
Security posture is poor: 18 known vulnerabilities in 7 dependencies; 20 high-severity SAST findings; 4 high-severity workflow issues. Weakest area: sast.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 6 |
| Vulnerable dependencies (OSV) | 53 |
| CI workflows (zizmor) | 40 |
| Posture (policy, updates, signing, lockfiles) | 20 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 18 in 7 packages (critical 1, high 6, medium 11, low 0)
-
Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-6q48-6c7w-9gw2: certifi@2025.4.26 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2 |
uv.lock |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
scubaduck/server.py:62 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
scubaduck/server.py:67 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
scubaduck/server.py:73 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
scubaduck/server.py:81 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
scubaduck/server.py:439 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
scubaduck/server.py:467 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
scubaduck/server.py:503 |
| high | opengrep/python.django.security.injection.tainted-sql-string: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence low] |
scubaduck/server.py:504 |
| high | opengrep/python.flask.security.injection.tainted-sql-string: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium] |
scubaduck/server.py:504 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
scubaduck/server.py:656 |
| high | opengrep/python.django.security.injection.tainted-sql-string: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence low] |
scubaduck/server.py:657 |
| high | opengrep/python.flask.security.injection.tainted-sql-string: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium] |
scubaduck/server.py:657 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scubaduck/static/js/table_view.js:173 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a view.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scubaduck/static/js/table_view.js:173 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scubaduck/static/js/view_settings.js:115 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a div.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scubaduck/static/js/view_settings.js:115 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scubaduck/static/js/view_settings.js:540 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a colSel.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scubaduck/static/js/view_settings.js:540 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scubaduck/static/js/view_settings.js:564 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a opSel.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
scubaduck/static/js/view_settings.js:564 |
| high | osv/GHSA-qccp-gfcp-xxvc: urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-141, GHSA-qccp-gfcp-xxvc |
uv.lock |
| high | osv/GHSA-2xpw-w6gg-jr37: urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-1994, GHSA-2xpw-w6gg-jr37 |
uv.lock |
| high | osv/GHSA-38jv-5279-wg99: urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-1996, GHSA-38jv-5279-wg99 |
uv.lock |
| high | osv/GHSA-gm62-xv2j-4w53: urllib3@2.4.0 (PyPI) is affected by PYSEC-2026-1998, GHSA-gm62-xv2j-4w53 |
uv.lock |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 2,673; test lines: 2,876
| Language | Lines |
|---|---|
| Python | 3,660 |
| JavaScript | 1,884 |
| Shell | 5 |