voltrb/volt
A Ruby web framework where your Ruby runs on both server and client
- Repository: https://github.com/voltrb/volt
- Commit:
f942b92385adbc894ee4a37903ee6a9c1a65e9a4 - Generated: 2026-11-13T23:29:00+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 80 | strong | 90% | 100% |
| Security | 64 | weak | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
Stylometry index: 0.21 per 1,000 lines (narrated steps 4, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2014-12 | 1,842 | 0% |
| 2015-01 | 1,471 | 0% |
| 2015-02 | 1,429 | 0% |
| 2015-03 | 2,468 | 0% |
| 2015-04 | 4,717 | 0% |
| 2015-05 | 7,309 | 0% |
| 2015-06 | 2,899 | 0% |
| 2015-07 | 1,812 | 0% |
| 2015-08 | 1,818 | 0% |
| 2015-09 | 660 | 0% |
| 2015-10 | 3,486 | 0% |
| 2015-11 | 178 | 0% |
Evidence
- step-by-step narration comment: # First, select all of the non-ArrayModel values (lib/volt/mod)
- step-by-step narration comment: # first, then failing those proxies the context. (lib/volt/pag)
- step-by-step narration comment: # Next, split the url and walk the sections (lib/volt/rou)
- step-by-step narration comment: # Now we have successfully incremented, so no more readers will be able to increment (lib/volt/uti)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 0.46, no CI test run detected; 0% of function code in complex or long functions; 1% duplicated lines. Weakest area: process.
| Area | Score |
|---|---|
| Complexity (lizard) | 99 |
| Duplication | 95 |
| Code smells (Opengrep) | 100 |
| Tests and CI | 68 |
| Documentation | 100 |
| Type safety | n/a |
| Process (Scorecard review/maintenance) | 0 |
- Functions: 1,320; mean complexity 2.0, 90th percentile 4; 1 complex and 0 long functions
- Duplicated lines: 0.8% of 12,077 compared
- Tests: 8,679 test lines for 18,696 source lines (ratio 0.46); CI test commands: none detected; 35% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
Security
Security posture is weak: no high-impact findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 97 |
| Static analysis (Opengrep) | 74 |
| Vulnerable dependencies (OSV) | n/a |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | 25 |
- Posture checks passed: none; missing: security policy, dependency updates, signed commits, lockfiles
- OpenSSF Scorecard aggregate: 2.0/10 (published 2026-10-26)
Top findings
| Severity | Finding | Location |
|---|---|---|
| medium | opengrep/javascript.lang.security.audit.unsafe-dynamic-method: Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low] |
app/volt/assets/js/volt_js_polyfills.js:53 |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration: The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] |
app/volt/assets/js/volt_js_polyfills.js:87 |
| medium | opengrep/javascript.browser.security.wildcard-postmessage-configuration: The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium] |
app/volt/assets/js/volt_js_polyfills.js:115 |
| medium | opengrep/ruby.rails.security.audit.xss.manual-template-creation: Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'. [confidence low] |
lib/volt/cli/base_index_renderer.rb:15 |
| medium | opengrep/ruby.lang.security.dangerous-exec: Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence medium] |
lib/volt/cli/bundle.rb:22 |
| medium | opengrep/ruby.lang.security.dangerous-exec: Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence medium] |
lib/volt/cli/bundle.rb:24 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/controllers/model_controller.rb:94 |
| medium | opengrep/ruby.rails.security.audit.xss.avoid-html-safe: 'html_safe()' does not make the supplied string safe. 'html_safe()' bypasses HTML escaping. If external data can reach here, this exposes your application to cross-site scripting (XSS) attacks. Ensure no external data reaches here. [confidence low] |
lib/volt/controllers/model_controller.rb:240 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:21 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:23 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:25 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:27 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:28 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:39 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:42 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:44 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:46 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:50 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:90 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:92 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:106 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:141 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:145 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:145 |
| medium | opengrep/ruby.lang.security.dangerous-subshell: Detected non-static command inside .... If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low] |
lib/volt/page/bindings/attribute_binding.rb:151 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 18,696; test lines: 8,679
| Language | Lines |
|---|---|
| Ruby | 26,970 |
| JavaScript | 405 |