Leaderboard github.com
lincanbin/Carbon-Forum
A high performance open-source forum software written in PHP. Discussions Tags based with Quora/StackOverflow style.
AI provenance
0%
none-detected
- Confidence
- 65%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
44/100
poor
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
48/100
poor
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/lincanbin/Carbon-Forum
- Commit:
55d98f4e4a8c3442c61bfe0a5844c32f22145cd9 - Generated: 2026-11-13T23:36:41+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 44 | poor | 90% | 100% |
| Security | 48 | poor | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
Stylometry index: 0.07 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2016-10 | 19 | 0% |
| 2016-11 | 53 | 0% |
| 2016-12 | 1,241 | 0% |
| 2017-02 | 17 | 0% |
| 2017-03 | 702 | 0% |
| 2017-04 | 903 | 0% |
| 2017-05 | 9,265 | 0% |
| 2017-06 | 807 | 0% |
| 2017-07 | 752 | 0% |
| 2017-08 | 3 | 0% |
| 2017-12 | 1 | 0% |
| 2018-07 | 1 | 0% |
Evidence
- step-by-step narration comment: // Finally, go through the final list of matches and pull the all (static/edito)
- step-by-step narration comment: // finally, split all lines so that they wrap well (static/edito)
- step-by-step narration comment: // finally, process the links (static/edito)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 9% of function code in complex or long functions; 22% duplicated lines. Weakest area: process.
| Area | Score |
|---|---|
| Complexity (lizard) | 77 |
| Duplication | 26 |
| Code smells (Opengrep) | 79 |
| Tests and CI | 15 |
| Documentation | 65 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | 0 |
- Functions: 5,254; mean complexity 3.1, 90th percentile 7; 97 complex and 8 long functions
- Duplicated lines: 22.3% of 32,518 compared
- Tests: 0 test lines for 43,014 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- attr in static/editor/third-party/highcharts/highcharts.js: complexity 75, 6 lines
- setTickPositions in static/editor/third-party/highcharts/highcharts.js: complexity 64, 6 lines
- PhpAnalysis::_optimize_result in library/PHPAnalysis.class.php: complexity 59, 152 lines
- t in static/echarts/echarts.js: complexity 56, 1 lines
- attr in static/editor/third-party/highcharts/highcharts.js: complexity 56, 5 lines
Security
Security posture is poor: 109 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 22 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | 16 |
- Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
- OpenSSF Scorecard aggregate: 1.5/10 (published 2026-11-09)
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
Dockerfile:40 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
common.php:380 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
common.php:382 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/forgot.php:27 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/login.php:75 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/oauth.php:18 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/oauth.php:61 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/oauth.php:114 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/oauth.php:194 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/register.php:76 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/register.php:158 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/reset_password.php:39 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/reset_password.php:45 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/search.php:55 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/settings.php:72 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
controller/settings.php:78 |
| high | opengrep/php.lang.security.injection.tainted-sql-string: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium] |
controller/upload_list.php:15 |
| high | opengrep/php.lang.security.injection.tainted-sql-string: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium] |
controller/upload_list.php:19 |
| high | opengrep/php.lang.security.file-inclusion: Detected non-constant file inclusion. This can lead to local file inclusion (LFI) or remote file inclusion (RFI) if user input reaches this statement. LFI and RFI could lead to sensitive files being obtained by attackers. Instead, explicitly specify what to include. If that is not a viable solution, [confidence low] |
index.php:118 |
| high | opengrep/php.lang.security.injection.tainted-sql-string: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium] |
install/index.php:53 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
library/PDO.Log.class.php:13 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
library/PDO.class.php:214 |
| high | opengrep/php.lang.security.weak-crypto: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low] |
library/PDO.class.php:224 |
| high | opengrep/php.lang.security.injection.echoed-request: Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users. [confidence medium] |
library/PHPAnalysis.demo.php:105 |
| high | opengrep/php.lang.security.injection.echoed-request: Echoing user input risks cross-site scripting vulnerability. You should use htmlentities() when showing data to users. [confidence medium] |
library/PHPAnalysis.demo.php:122 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 43,014; test lines: 0
| Language | Lines |
|---|---|
| PHP | 22,738 |
| JavaScript | 19,772 |
| SQL | 495 |
| Shell | 9 |