The best free and open-source automated time tracker. Cross-platform, extensible, privacy-focused.
This report summarizes scanner evidence for ActivityWatch/activitywatch, a Python project with 19,180 GitHub stars. SynthScan examined 16,790 lines of code across 86 source files, recording 208 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 15.8 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 176 finding(s).
Are imports declared and package/API names verified? 10 finding(s).
Are wrappers, guards, and repeated structures necessary? 160 finding(s).
Which changes need focused human review? 208 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 208 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/emit_research_category_preset.py | 194 | def _toml_table_string_values(text: str, table: str) -> list[str]: | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 54 | def test_valid_research_release(): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 92 | def test_invalid_release_or_manifest(mutation): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 110 | def test_wrong_edition_release_version_or_extension(replacement): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 158 | def test_initial_preparation_does_not_publish(tmp_path, remote): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 167 | def test_advance_preserves_history_and_unrelated_files(tmp_path, remote): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 181 | def test_replay_is_noop_and_conflicting_equal_version_rejected(tmp_path, remote): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 200 | def test_numeric_semver_order(tmp_path, remote): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 209 | def test_same_parent_race_and_retry_revalidates_order(tmp_path, remote, provision): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 226 | def test_deleted_parent_cannot_be_silently_recreated(tmp_path, remote): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 237 | def test_rewound_parent_is_rejected_even_when_push_would_fast_forward(tmp_path, remote): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 249 | def test_existing_pre_push_hook_is_preserved(tmp_path, remote): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 264 | def test_prepare_rejects_existing_workdir(tmp_path, remote): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 273 | def test_cli_validates_before_prepare(tmp_path, monkeypatch): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 299 | def test_receive_side_rejects_race_after_parent_was_advertised(tmp_path, remote): | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 320 | def test_cli_public_checks_and_explicit_publish_flag( | CODE |
| LOW | scripts/tests/test_publish_research_feed.py | 372 | def test_failed_public_signature_read_leaves_no_candidate( | CODE |
| LOW⚡ | scripts/tests/test_build_changelog.py | 163 | def test_shared_submodule_gets_a_single_section(bundle): | CODE |
| LOW⚡ | scripts/tests/test_build_changelog.py | 173 | def test_sections_are_flat_and_follow_repo_order(bundle): | CODE |
| LOW⚡ | scripts/tests/test_build_changelog.py | 182 | def test_parent_with_only_a_submodule_bump_is_dropped(bundle): | CODE |
| LOW⚡ | scripts/tests/test_build_changelog.py | 191 | def test_out_of_sync_parents_get_the_union_and_a_warning(bundle): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 205 | def test_parent_that_never_bumped_is_named_in_the_warning(bundle): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 218 | def test_union_keeps_commits_when_the_parents_started_apart(tmp_path): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 231 | def test_in_sync_parents_get_no_warning(bundle): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 239 | def test_parent_that_newly_vendors_a_repo_does_not_replay_its_history(tmp_path): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 268 | def test_unresolvable_pointers_are_reported_not_silently_dropped(tmp_path): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 287 | def test_newly_vendored_pin_keeps_the_commits_only_it_has(tmp_path): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 317 | def test_warning_survives_when_every_commit_is_filtered(tmp_path): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 333 | def test_adoption_alone_does_not_replay_history(tmp_path): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 361 | def test_new_submodule_hidden_commits_url_uses_commits_not_compare(tmp_path): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 386 | def test_uninitialized_submodule_does_not_derail_pin_collection(tmp_path): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 402 | def test_support_section_links_the_subscribe_page_without_claiming_gates(): | CODE |
| LOW | scripts/tests/test_build_changelog.py | 409 | def test_support_section_reaches_the_assembled_bundle_notes(bundle, tmp_path, monkeypatch): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 65 | def test_check_mode_writes_nothing(tmp_path: Path, target: str): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 81 | def test_missing_file_fails_closed(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 92 | def test_missing_token_fails_closed(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 109 | def test_ambiguous_token_fails_closed(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 121 | def test_nothing_written_when_one_site_fails(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 171 | def test_real_tree_check_passes_if_submodules_present(target: str): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 182 | def test_patched_python_profile_module_behaviour(tmp_path: Path, monkeypatch): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 214 | def test_macos_bundle_dir_is_distinct_from_standard(tmp_path: Path, target: str): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 273 | def test_windows_installer_is_a_separate_product(tmp_path: Path, target: str): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 309 | def test_windows_research_installers_do_not_collide_with_each_other(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 375 | def test_windows_installer_producer_matches_packaging_and_release(windows_installer_names): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 417 | def test_windows_setup_collection(tmp_path: Path, windows_installer_names): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 439 | def test_windows_setup_collection_refuses_invalid_inputs(tmp_path: Path, case: str): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 469 | def test_tauri_wix_upgrade_code_is_pinned_and_config_stays_valid_json(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 490 | def test_linux_deb_is_a_separate_package(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 500 | def test_linux_deb_installs_beside_a_standard_install(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 521 | def test_linux_desktop_entry_is_rebranded(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 531 | def test_appimage_desktop_and_icon_ids_agree(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 554 | def test_first_run_autostart_identity_is_distinct_on_every_platform(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_patch_research_edition_profile.py | 594 | def test_tauri_autostart_uses_distinct_app_name_for_research_build(tmp_path: Path): | CODE |
| LOW | scripts/tests/test_configure_tauri_release.py | 77 | def test_windows_drops_msi_for_non_numeric_prerelease(config): | CODE |
| LOW | scripts/tests/test_configure_tauri_release.py | 87 | def test_non_windows_keeps_all_targets_for_non_numeric_prerelease(config): | CODE |
| LOW⚡ | scripts/tests/test_configure_tauri_release.py | 99 | def test_windows_keeps_all_targets_for_msi_safe_version(config): | CODE |
| LOW⚡ | scripts/tests/test_configure_tauri_release.py | 108 | def test_standard_version_changes_without_changing_update_trust(config): | CODE |
| LOW⚡ | scripts/tests/test_configure_tauri_release.py | 118 | def test_research_release_replaces_endpoint_and_key(config): | CODE |
| LOW | scripts/tests/test_configure_tauri_release.py | 133 | def test_secretless_research_smoke_build_has_no_update_trust(config): | CODE |
| LOW | scripts/tests/test_configure_tauri_release.py | 142 | def test_release_missing_either_key_fails_without_modifying_config( | CODE |
| 78 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/screenshots.py | 74 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/screenshots.py | 76 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/screenshots.py | 205 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/screenshots.py | 207 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/screenshots.py | 829 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/screenshots.py | 831 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/screenshots.py | 1026 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/screenshots.py | 1028 | # ============================================================================= | COMMENT |
| MEDIUM | scripts/screenshots.py | 1275 | # ============================================================================= | STRING |
| MEDIUM | scripts/screenshots.py | 1277 | # ============================================================================= | STRING |
| MEDIUM | scripts/screenshots.py | 1294 | # ============================================================================= | STRING |
| MEDIUM | scripts/screenshots.py | 1296 | # ============================================================================= | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/emit_research_category_preset.py | 41 | import sys | COMMENT |
| LOW | scripts/patch_research_edition_config.py | 781 | COMMENT | |
| LOW | scripts/patch_research_edition_profile.py | 81 | # it upgrades over an existing install and its uninstaller removes both. Own | COMMENT |
| LOW | scripts/patch_research_edition_profile.py | 541 | "\n# create AppRun\n", | COMMENT |
| LOW | scripts/bump-submodules.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | scripts/bump-submodules.sh | 21 | # | COMMENT |
| LOW | scripts/chores/make-release.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/research_edition/geography-free-default.toml | 1 | # Geography-free default research preset | COMMENT |
| LOW | scripts/research_edition/geography-free-default.toml | 21 | # | COMMENT |
| LOW | scripts/research_edition/export_sanitize.rs | 1 | //! Research Edition `/api/0/export` sanitizer. | COMMENT |
| LOW | scripts/tests/integration_tests.py | 81 | COMMENT | |
| LOW | scripts/package/dmgbuild-settings.py | 41 | # Volume size | COMMENT |
| LOW | scripts/package/host-abi-gate.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/package/abi-gate.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/package/build_app_tauri.sh | 201 | if echo "$sign_output" | grep -q "bundle format is ambiguous"; then | COMMENT |
| LOW | .github/workflows/release.yml | 1 | name: Release | COMMENT |
| LOW | .github/workflows/release.yml | 321 | tips='echo "$(git rev-parse HEAD) $displaypath"' | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/screenshots.py | 1168 | except Exception: | CODE |
| HIGH | scripts/screenshots.py | 1173 | except Exception: | CODE |
| HIGH | scripts/tests/query_parity/servers.py | 100 | except requests.RequestException: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/screenshots.py | 1043 | if (n.offsetParent !== null) return false; | CODE |
| HIGH | scripts/screenshots.py | 1058 | if (/error|failed|exception/i.test(t)) out.push(t.slice(0, 300)); | CODE |
| HIGH | scripts/screenshots.py | 1238 | page.evaluate("() => document.activeElement && document.activeElement.blur()") | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/screenshots.py | 527 | CODE | |
| LOW | scripts/screenshots.py | 564 | CODE | |
| LOW | scripts/screenshots.py | 641 | CODE | |
| LOW | scripts/screenshots.py | 886 | CODE | |
| LOW | scripts/screenshots.py | 1180 | CODE | |
| LOW | scripts/screenshots.py | 1323 | CODE | |
| LOW | scripts/logcrawler.py | 22 | CODE | |
| LOW | scripts/build_changelog.py | 470 | CODE | |
| LOW | scripts/build_changelog.py | 718 | CODE | |
| LOW | scripts/tests/query_parity/conftest.py | 114 | CODE | |
| LOW | scripts/tests/query_parity/attribute.py | 59 | CODE | |
| LOW | scripts/tests/query_parity/test_query_parity.py | 24 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/patch_research_edition_export.py | 390 | print(f"Error: {error}", file=sys.stderr) | CODE |
| LOW | scripts/screenshots.py | 1168 | except Exception: | STRING |
| LOW | scripts/screenshots.py | 1173 | except Exception: | STRING |
| MEDIUM | scripts/patch_research_edition_config.py | 807 | print(f"Error: {CONFIG_FILE} not found", file=sys.stderr) | CODE |
| MEDIUM | scripts/patch_research_edition_config.py | 813 | print(f"Error: {error} in {CONFIG_FILE}", file=sys.stderr) | CODE |
| LOW | scripts/build_changelog.py | 854 | except Exception as e: | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/check_tauri_server.py | 4 | CODE | |
| LOW | scripts/patch_research_edition_export.py | 39 | CODE | |
| LOW | scripts/screenshots.py | 33 | CODE | |
| LOW | scripts/patch_research_edition_profile.py | 62 | CODE | |
| LOW | scripts/tests/test_emit_research_category_preset.py | 1 | CODE | |
| LOW | scripts/tests/query_parity/servers.py | 40 | CODE | |
| LOW | scripts/package/dmgbuild-settings.py | 2 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/package/build_app_tauri.sh | 161 | # Step 1: Sign all Mach-O binary files (dylibs, .so files, standalone executables). | COMMENT |
| LOW | scripts/package/build_app_tauri.sh | 186 | # Step 2: Sign bundle directories (.framework, .bundle, .plugin) after their contents. | COMMENT |
| LOW | scripts/package/build_app_tauri.sh | 269 | # Step 3: Sign the top-level .app bundle last. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/package/build_app_tauri.sh | 161 | # Step 1: Sign all Mach-O binary files (dylibs, .so files, standalone executables). | COMMENT |
| LOW | scripts/package/build_app_tauri.sh | 186 | # Step 2: Sign bundle directories (.framework, .bundle, .plugin) after their contents. | COMMENT |
| LOW | scripts/package/build_app_tauri.sh | 269 | # Step 3: Sign the top-level .app bundle last. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/chores/make-release.sh | 7 | # Create an annotated tag | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | scripts/tests/test_publish_research_feed.py | 142 | # Isolate test repositories from any enclosing harness Git invocation. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/package/dmgbuild-settings.py | 79 | # Set these to True to force inclusion of icon/list view settings (otherwise | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/build_changelog.py | 43 | logger = logging.getLogger(__name__) | CODE |