Leaderboard github.com
geoffmiller/ratatat
React-based TUI library powered by a Rust diff engine — Ink-compatible API, 30× faster
AI provenance
0%
possible
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
50/100
poor
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
61/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/geoffmiller/ratatat
- Commit:
7215cd4bc7bea1e1bcbd0c813d7326f49b26e14b - Generated: 2026-11-13T23:58:17+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 65% | 100% |
| Code quality | 50 | poor | 90% | 100% |
| Security | 61 | weak | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 19.2%
-
Estimated AI-generated share: 0.0%
-
Stylometry index: 0.15 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 8). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-03 | 52,230 | 0% |
Evidence
- 2,041 lines of first-party code in ~2.7h (768 lines/hour, 11 commit session) (2eee41140e8e)
- 6,847 lines of first-party code in ~11.4h (598 lines/hour, 50 commit session) (18aead124f30)
- 1,127 lines of first-party code in ~2.0h (571 lines/hour, 7 commit session) (4b1ff623a52a)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is poor: test-to-source ratio 0.79, no CI test run detected; 19% of function code in complex or long functions; 16% duplicated lines. Weakest area: lint.
| Area | Score |
|---|---|
| Complexity (lizard) | 57 |
| Duplication | 38 |
| Code smells (Opengrep) | 22 |
| Tests and CI | 51 |
| Documentation | 65 |
| Type safety | 100 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 1,665; mean complexity 2.6, 90th percentile 5; 25 complex and 9 long functions
- Duplicated lines: 15.9% of 18,258 compared
- Tests: 20,999 test lines for 26,489 source lines (ratio 0.79); CI test commands: none detected; 14% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- requireNative in packages/core/index.cjs: complexity 165, 462 lines
- requireNative in packages/core/native.cjs: complexity 165, 462 lines
- applyFlexStyles in packages/ink/src/styles.ts: complexity 49, 124 lines
- handleData in packages/core/src/input.ts: complexity 45, 118 lines
- parseKeypress in packages/ink/src/parse-keypress.ts: complexity 44, 93 lines
Security
Security posture is weak: 114 known vulnerabilities in 25 dependencies. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 98 |
| Vulnerable dependencies (OSV) | 6 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 114 in 25 packages (critical 2, high 49, medium 52, low 11)
-
Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-w7jw-789q-3m8p: shell-quote@1.8.3 (npm) is affected by GHSA-w7jw-789q-3m8p |
package-lock.json |
| critical | osv/GHSA-23hp-3jrh-7fpw: tar@7.5.10 (npm) is affected by GHSA-23hp-3jrh-7fpw |
package-lock.json |
| high | osv/GHSA-qxc2-j82w-r537: @faker-js/faker@10.3.0 (npm) is affected by GHSA-qxc2-j82w-r537 |
package-lock.json |
| high | osv/GHSA-3jxr-9vmj-r5cp: brace-expansion@1.1.12 (npm) is affected by GHSA-3jxr-9vmj-r5cp |
package-lock.json |
| high | osv/GHSA-6j4f-fj2g-mc7p: brace-expansion@1.1.12 (npm) is affected by GHSA-6j4f-fj2g-mc7p |
package-lock.json |
| high | osv/GHSA-mh99-v99m-4gvg: brace-expansion@1.1.12 (npm) is affected by GHSA-mh99-v99m-4gvg |
package-lock.json |
| high | osv/GHSA-qhr7-859c-m2p7: brace-expansion@1.1.12 (npm) is affected by GHSA-qhr7-859c-m2p7 |
package-lock.json |
| high | osv/GHSA-rgw5-rvv9-x895: brace-expansion@1.1.12 (npm) is affected by GHSA-rgw5-rvv9-x895 |
package-lock.json |
| high | osv/GHSA-3jxr-9vmj-r5cp: brace-expansion@5.0.4 (npm) is affected by GHSA-3jxr-9vmj-r5cp |
package-lock.json |
| high | osv/GHSA-6j4f-fj2g-mc7p: brace-expansion@5.0.4 (npm) is affected by GHSA-6j4f-fj2g-mc7p |
package-lock.json |
| high | osv/GHSA-mh99-v99m-4gvg: brace-expansion@5.0.4 (npm) is affected by GHSA-mh99-v99m-4gvg |
package-lock.json |
| high | osv/GHSA-qhr7-859c-m2p7: brace-expansion@5.0.4 (npm) is affected by GHSA-qhr7-859c-m2p7 |
package-lock.json |
| high | osv/GHSA-rgw5-rvv9-x895: brace-expansion@5.0.4 (npm) is affected by GHSA-rgw5-rvv9-x895 |
package-lock.json |
| high | osv/GHSA-73wf-gq98-2v4g: browserslist@4.28.1 (npm) is affected by GHSA-73wf-gq98-2v4g |
package-lock.json |
| high | osv/GHSA-c83g-rgw3-j3cx: browserslist@4.28.1 (npm) is affected by GHSA-c83g-rgw3-j3cx |
package-lock.json |
| high | osv/GHSA-3xgq-45jj-v275: cross-spawn@5.1.0 (npm) is affected by GHSA-3xgq-45jj-v275 |
package-lock.json |
| high | osv/GHSA-532v-xpq5-8h95: electron@23.3.13 (npm) is affected by GHSA-532v-xpq5-8h95 |
package-lock.json |
| high | osv/GHSA-8337-3p73-46f4: electron@23.3.13 (npm) is affected by GHSA-8337-3p73-46f4 |
package-lock.json |
| high | osv/GHSA-9f4c-93c8-jc8g: electron@23.3.13 (npm) is affected by GHSA-9f4c-93c8-jc8g |
package-lock.json |
| high | osv/GHSA-9qh4-3jw8-366w: electron@23.3.13 (npm) is affected by GHSA-9qh4-3jw8-366w |
package-lock.json |
| high | osv/GHSA-9wfr-w7mm-pc7f: electron@23.3.13 (npm) is affected by GHSA-9wfr-w7mm-pc7f |
package-lock.json |
| high | osv/GHSA-gr2m-v5gq-v685: electron@23.3.13 (npm) is affected by GHSA-gr2m-v5gq-v685 |
package-lock.json |
| high | osv/GHSA-h7rp-cf8h-j98x: electron@23.3.13 (npm) is affected by GHSA-h7rp-cf8h-j98x |
package-lock.json |
| high | osv/GHSA-hq2x-r82h-9wj4: electron@23.3.13 (npm) is affected by GHSA-hq2x-r82h-9wj4 |
package-lock.json |
| high | osv/GHSA-j84w-jfhq-vhvj: electron@23.3.13 (npm) is affected by GHSA-j84w-jfhq-vhvj |
package-lock.json |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 26,489; test lines: 20,999
| Language | Lines |
|---|---|
| TypeScript | 42,873 |
| JavaScript | 3,770 |
| Rust | 845 |