Leaderboard github.com
nizos/tdd-guard
Automated TDD enforcement for Claude Code
AI provenance
63%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
92/100
strong
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
69/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
- Repository: https://github.com/nizos/tdd-guard
- Commit:
ffb7026c8f7e335e2914461fce9ec3f897a87125 - Generated: 2026-11-14T00:12:27+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 63 | explicit | 95% | 100% |
| Code quality | 92 | strong | 90% | 100% |
| Security | 69 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 63% of first-party code added; an estimated 63% including velocity signals.
- Explicitly attributed share (lower bound): 63.2%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 63.2%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 573 | 30,622 |
- AI tooling configured in repo: claude-code
Current source lines last changed by AI-attributed commits: 4,747 of 10,556.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 1.053 | 0.172 | 6.12x |
| Security | 1.264 | 0.172 | 7.35x |
- Stylometry index: 0.66 per 1,000 lines (narrated steps 0, placeholders 0, assistant phrasing 0, emoji 14). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-07 | 21,279 | 87% |
| 2025-08 | 11,616 | 65% |
| 2025-09 | 1,568 | 98% |
| 2025-10 | 24 | 100% |
| 2025-11 | 948 | 2% |
| 2026-01 | 6 | 50% |
| 2026-03 | 1,332 | 40% |
| 2026-04 | 5,740 | 25% |
| 2026-05 | 2,387 | 4% |
| 2026-06 | 941 | 100% |
| 2026-07 | 2,613 | 0% |
| 2026-08 | 14 | 100% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (ffb7026c8f7e)
- Claude Code: trailer 'Co-Authored-By: Claude' (54be0ac5a4f3)
- Claude Code: trailer 'Co-Authored-By: Claude' (108992dcf7d7)
- Claude Code: trailer 'Co-Authored-By: Claude' (7245912d8a36)
- Claude Code: trailer 'Co-Authored-By: Claude' (2579ec1823fa)
- Claude Code: trailer 'Co-Authored-By: Claude' (fa4fa79551c2)
- Claude Code: trailer 'Co-Authored-By: Claude' (ccd71b49b11b)
- Claude Code: trailer 'Co-Authored-By: Claude' (7fbf5e2a201e)
- Claude Code: trailer 'Co-Authored-By: Claude' (e15a6babcb20)
- Claude Code: trailer 'Co-Authored-By: Claude' (50be6111c23d)
- Claude Code: trailer 'Co-Authored-By: Claude' (a76cad280c95)
- Claude Code: trailer 'Co-Authored-By: Claude' (b8aa41c04fbd)
- Claude Code: trailer 'Co-Authored-By: Claude' (effe3b080a4a)
- Claude Code: trailer 'Co-Authored-By: Claude' (812e8e7c2f33)
- Claude Code: trailer 'Co-Authored-By: Claude' (14793c688de4)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 2.26, CI runs tests; 2% of function code in complex or long functions; 3% duplicated lines. Weakest area: docs.
| Area | Score |
|---|---|
| Complexity (lizard) | 94 |
| Duplication | 82 |
| Code smells (Opengrep) | 93 |
| Tests and CI | 100 |
| Documentation | 80 |
| Type safety | 98 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 617; mean complexity 2.5, 90th percentile 5; 2 complex and 0 long functions
- Duplicated lines: 3.4% of 6,863 compared
- Tests: 23,868 test lines for 10,556 source lines (ratio 2.26); CI test commands: pytest, npm run test, ./gradlew check, rspec; 80% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- parse_error_buffer in reporters/rust/src/error_parser.rs: complexity 18, 59 lines
- processHookData in src/hooks/processHookData.ts: complexity 16, 57 lines
Security
Security posture is weak: 7 known vulnerabilities in 3 dependencies; 27 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 90 |
| Vulnerable dependencies (OSV) | 86 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 20 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 7 in 3 packages (critical 0, high 0, medium 5, low 1)
-
Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:19 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:22 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:28 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:52 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:55 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:61 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:85 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:88 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:104 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:107 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:113 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:123 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:144 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:147 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:153 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:159 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:164 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:169 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:174 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:208 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/ci.yml:214 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/security.yml:27 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/security.yml:30 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/security.yml:36 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/security.yml:39 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 10,556; test lines: 23,868
| Language | Lines |
|---|---|
| TypeScript | 18,757 |
| Ruby | 3,143 |
| Go | 3,035 |
| Java | 2,856 |
| C# | 2,102 |
| Rust | 1,448 |
| PHP | 1,327 |
| Python | 1,006 |
| Shell | 313 |
| JavaScript | 272 |