RepoTrust

newptcai/repy

repy is a terminal epub format ebook reader inspired by epy

https://github.com/newptcai/repy · commit 0a3c3a2063af · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

unreviewed-ai-risk

RepoTrust ai badge RepoTrust quality badge RepoTrust security badge

Dispute this score or request a re-score Full report JSON

Scores

Unreviewed AI code risk: a large share of this code is explicitly AI-attributed, and its tests or review process are weak while quality or security scores are low.

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 41 explicit 95% 100%
Code quality 57 weak 90% 100%
Security 59 weak 85% 100%

AI provenance

Explicit AI attribution on 41% of first-party code added; an estimated 41% including velocity signals.

AI tool Attributed commits Lines added
Claude Code 124 17,579

Current source lines last changed by AI-attributed commits: 13,565 of 31,635.

Findings per 1,000 lines AI-attributed Other Ratio
Quality 0.0 0.0 n/a
Security 0.295 0.387 0.76x
Month Lines added Attributed to AI
2025-11 5,961 69%
2025-12 5,092 4%
2026-01 620 0%
2026-02 5,415 39%
2026-03 1,436 48%
2026-04 501 0%
2026-05 4,411 3%
2026-07 19,053 54%
2026-08 29 100%

Evidence

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.03, no CI test run detected; 26% of function code in complex or long functions; 6% duplicated lines. Weakest area: docs.

Area Score
Complexity (lizard) 46
Duplication 68
Code smells (Opengrep) 100
Tests and CI 41
Documentation 40
Type safety n/a
Process (Scorecard review/maintenance) n/a

Most complex functions:

Security

Security posture is weak: 37 known vulnerabilities in 15 dependencies; 7 high-severity workflow issues. Weakest area: posture.

Area Score
Secrets (gitleaks, tree + history) 100
Static analysis (Opengrep) 95
Vulnerable dependencies (OSV) 27
CI workflows (zizmor) 24
Posture (policy, updates, signing, lockfiles) 0
OpenSSF Scorecard n/a

Top findings

Severity Finding Location
critical osv/RUSTSEC-2026-0369: zip@3.0.0 (crates.io) is affected by RUSTSEC-2026-0369 Cargo.lock
critical osv/GHSA-m665-v7pm-7grj: zip@3.0.0 (crates.io) is affected by GHSA-m665-v7pm-7grj Cargo.lock
critical osv/RUSTSEC-2026-0369: zip@8.6.0 (crates.io) is affected by RUSTSEC-2026-0369 Cargo.lock
critical osv/GHSA-m665-v7pm-7grj: zip@8.6.0 (crates.io) is affected by GHSA-m665-v7pm-7grj Cargo.lock
high osv/RUSTSEC-2026-0414: pulldown-cmark@0.13.4 (crates.io) is affected by RUSTSEC-2026-0414 Cargo.lock
high osv/RUSTSEC-2026-0433: pulldown-cmark@0.13.4 (crates.io) is affected by RUSTSEC-2026-0433 Cargo.lock
high osv/RUSTSEC-2026-0340: quinn-proto@0.11.16 (crates.io) is affected by RUSTSEC-2026-0340 Cargo.lock
high osv/RUSTSEC-2026-0341: quinn-proto@0.11.16 (crates.io) is affected by RUSTSEC-2026-0341 Cargo.lock
high osv/RUSTSEC-2026-0367: zip@3.0.0 (crates.io) is affected by RUSTSEC-2026-0367 Cargo.lock
high osv/GHSA-q7v9-x93c-xqv3: zip@3.0.0 (crates.io) is affected by RUSTSEC-2026-0429, GHSA-q7v9-x93c-xqv3 Cargo.lock
high osv/RUSTSEC-2026-0367: zip@8.6.0 (crates.io) is affected by RUSTSEC-2026-0367 Cargo.lock
high osv/GHSA-q7v9-x93c-xqv3: zip@8.6.0 (crates.io) is affected by RUSTSEC-2026-0429, GHSA-q7v9-x93c-xqv3 Cargo.lock
high osv/GHSA-9hj8-73fh-9963: zip@8.6.0 (crates.io) is affected by GHSA-9hj8-73fh-9963 Cargo.lock
high osv/GHSA-hjqx-j4rw-g7xv: zip@8.6.0 (crates.io) is affected by GHSA-hjqx-j4rw-g7xv Cargo.lock
high zizmor/excessive-permissions: overly broad permissions [confidence high] .github/workflows/release.yml:9
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:34
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:43
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:74
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:86
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:91
high zizmor/unpinned-uses: unpinned action reference [confidence high] .github/workflows/release.yml:111
medium opengrep/rust.lang.security.insecure-hashes: Detected cryptographically insecure hashing function [confidence high] src/state.rs:915
medium opengrep/rust.lang.security.insecure-hashes: Detected cryptographically insecure hashing function [confidence high] src/sync.rs:62
medium opengrep/rust.lang.security.insecure-hashes: Detected cryptographically insecure hashing function [confidence high] src/sync.rs:162
medium osv/RUSTSEC-2025-0141: bincode@1.3.3 (crates.io) is affected by RUSTSEC-2025-0141 Cargo.lock

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Language Lines
Rust 32,549

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/newptcai/repy/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/newptcai/repy/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/newptcai/repy/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/newptcai/repy/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/newptcai/repy/security.svg)](https://repotrust.synapticcyber.com/r/github.com/newptcai/repy/)