Polly is a .NET resilience and transient-fault-handling library that allows developers to express policies such as Retry, Circuit Breaker, Timeout, Bulkhead Isolation, and Fallback in a fluent and thread-safe manner. From version 6.0.1, Polly targets .NET Standard 1.1 and 2.0+.
This report summarizes scanner evidence for App-vNext/Polly, a C# project with 14,243 GitHub stars. SynthScan examined 123,074 lines of code across 930 source files, recording 689 pattern matches distributed across 4 syntactic categories. The legacy adjusted pattern signal is 5.7 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 685 finding(s).
Are imports declared and package/API names verified? 4 finding(s).
Are wrappers, guards, and repeated structures necessary? 0 finding(s).
Which changes need focused human review? 689 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 689 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cake.cs | 1 | #:sdk Cake.Sdk | COMMENT |
| LOW | test/Polly.Specs/Helpers/Constants.cs | 1 | namespace Polly.Specs.Helpers; | COMMENT |
| LOW | …Core.Tests/Simmy/Outcomes/ChaosOutcomeStrategyTests.cs | 261 | /// <summary> | COMMENT |
| LOW | …ting/RateLimiterResiliencePipelineBuilderExtensions.cs | 1 | using System.ComponentModel.DataAnnotations; | COMMENT |
| LOW | …c/Polly.RateLimiting/OnRateLimiterRejectedArguments.cs | 1 | using System.Threading.RateLimiting; | COMMENT |
| LOW | src/Polly.RateLimiting/RateLimiterRejectedException.cs | 41 | /// <summary> | COMMENT |
| LOW | src/Polly.RateLimiting/RateLimiterRejectedException.cs | 61 | /// Initializes a new instance of the <see cref="RateLimiterRejectedException"/> class. | COMMENT |
| LOW | src/Polly.RateLimiting/RateLimiterArguments.cs | 1 | namespace Polly.RateLimiting; | COMMENT |
| LOW | src/Polly.RateLimiting/RateLimiterStrategyOptions.cs | 1 | using System.ComponentModel.DataAnnotations; | COMMENT |
| LOW | src/Polly.RateLimiting/RateLimiterStrategyOptions.cs | 21 | /// will use a <see cref="ConcurrencyLimiter"/> created using <see cref="DefaultRateLimiterOptions"/>. | COMMENT |
| LOW | src/Polly.RateLimiting/RateLimiterStrategyOptions.cs | 41 | COMMENT | |
| LOW | …tensions/Registry/ConfigureBuilderContextExtensions.cs | 1 | using System.Diagnostics.CodeAnalysis; | COMMENT |
| LOW | src/Polly.Extensions/Telemetry/MeteringEnricher.cs | 1 | namespace Polly.Telemetry; | COMMENT |
| LOW | src/Polly.Extensions/Telemetry/TelemetryOptions.cs | 41 | /// The default value is an empty collection. | COMMENT |
| LOW | src/Polly.Extensions/Telemetry/TelemetryOptions.cs | 61 | COMMENT | |
| LOW | src/Polly.Extensions/Telemetry/EnrichmentContext.cs | 1 | namespace Polly.Telemetry; | COMMENT |
| LOW | …emetry/TelemetryResiliencePipelineBuilderExtensions.cs | 1 | using System.Diagnostics.CodeAnalysis; | COMMENT |
| LOW | …emetry/TelemetryResiliencePipelineBuilderExtensions.cs | 21 | /// By enabling telemetry, the resilience pipeline will log and meter all resilience events. | COMMENT |
| LOW | …ns/DependencyInjection/AddResiliencePipelineContext.cs | 21 | COMMENT | |
| LOW | …ns/DependencyInjection/AddResiliencePipelineContext.cs | 41 | /// <param name="name">The named options, if any.</param> | COMMENT |
| LOW | …ns/DependencyInjection/AddResiliencePipelineContext.cs | 61 | /// <para> | COMMENT |
| LOW | …ependencyInjection/PollyServiceCollectionExtensions.cs | 21 | /// <typeparam name="TKey">The type of the key used to identify the resilience pipeline.</typeparam> | COMMENT |
| LOW | …ependencyInjection/PollyServiceCollectionExtensions.cs | 41 | Guard.NotNull(configure); | COMMENT |
| LOW | …ependencyInjection/PollyServiceCollectionExtensions.cs | 81 | { | COMMENT |
| LOW | …ependencyInjection/PollyServiceCollectionExtensions.cs | 181 | { | COMMENT |
| LOW | …s/DependencyInjection/AddResiliencePipelinesContext.cs | 21 | COMMENT | |
| LOW | …red/DebuggerDisableUserUnhandledExceptionsAttribute.cs | 1 | #pragma warning disable | COMMENT |
| LOW | …c/LegacySupport/DynamicallyAccessedMembersAttribute.cs | 1 | // Licensed to the .NET Foundation under one or more agreements. | COMMENT |
| LOW | …c/LegacySupport/DynamicallyAccessedMembersAttribute.cs | 21 | /// of a program. | COMMENT |
| LOW | src/LegacySupport/CallerArgumentExpressionAttribute.cs | 21 | /// <summary> | COMMENT |
| LOW | src/LegacySupport/DynamicallyAccessedMemberTypes.cs | 1 | // Licensed to the .NET Foundation under one or more agreements. | COMMENT |
| LOW | src/LegacySupport/DynamicallyAccessedMemberTypes.cs | 21 | /// <summary> | COMMENT |
| LOW | src/LegacySupport/DynamicallyAccessedMemberTypes.cs | 41 | /// <summary> | COMMENT |
| LOW | src/LegacySupport/DynamicallyAccessedMemberTypes.cs | 61 | /// <summary> | COMMENT |
| LOW | src/LegacySupport/DynamicallyAccessedMemberTypes.cs | 81 | /// <summary> | COMMENT |
| LOW | src/LegacySupport/DynamicDependencyAttribute.cs | 1 | // Licensed to the .NET Foundation under one or more agreements. | COMMENT |
| LOW | src/LegacySupport/DynamicDependencyAttribute.cs | 21 | /// </remarks> | COMMENT |
| LOW | src/LegacySupport/DynamicDependencyAttribute.cs | 61 | /// <summary> | COMMENT |
| LOW | src/LegacySupport/DynamicDependencyAttribute.cs | 81 | { | COMMENT |
| LOW | src/LegacySupport/DynamicDependencyAttribute.cs | 101 | /// Either <see cref="MemberSignature"/> must be a valid string or <see cref="MemberTypes"/> | COMMENT |
| LOW | src/LegacySupport/DynamicDependencyAttribute.cs | 121 | /// </remarks> | COMMENT |
| LOW | src/LegacySupport/RequiresUnreferencedCodeAttribute.cs | 1 | // Licensed to the .NET Foundation under one or more agreements. | COMMENT |
| LOW | src/LegacySupport/RequiresUnreferencedCodeAttribute.cs | 21 | /// This allows tools to understand which methods are unsafe to call when removing unreferenced | COMMENT |
| LOW | src/LegacySupport/NullableAttributes.cs | 1 | // Copyright (c) Microsoft Corporation. All Rights Reserved. | COMMENT |
| LOW | …LegacySupport/UnconditionalSuppressMessageAttribute.cs | 1 | // Licensed to the .NET Foundation under one or more agreements. | COMMENT |
| LOW | …LegacySupport/UnconditionalSuppressMessageAttribute.cs | 41 | /// Gets the category identifying the classification of the attribute. | COMMENT |
| LOW | …LegacySupport/UnconditionalSuppressMessageAttribute.cs | 61 | /// <remarks> | COMMENT |
| LOW | …LegacySupport/UnconditionalSuppressMessageAttribute.cs | 81 | /// <remarks> | COMMENT |
| LOW | src/Polly.Core/ResiliencePipelineT.cs | 1 | using Polly.Utils.Pipeline; | COMMENT |
| LOW | src/Polly.Core/PredicateBuilder.TResult.cs | 1 | namespace Polly; | COMMENT |
| LOW | src/Polly.Core/PredicateBuilder.TResult.cs | 21 | /// </summary> | COMMENT |
| LOW | src/Polly.Core/PredicateBuilder.TResult.cs | 41 | /// an <see cref="Exception"/>, or at any level of nesting within an <see cref="AggregateException"/>. | COMMENT |
| LOW | src/Polly.Core/PredicateBuilder.TResult.cs | 101 | => Add(outcome => outcome.TryGetResult(out var result) && predicate(result!)); | COMMENT |
| LOW | src/Polly.Core/Outcome.cs | 1 | namespace Polly; | COMMENT |
| LOW | src/Polly.Core/Outcome.cs | 21 | /// <returns>A completed <see cref="ValueTask{TResult}"/> that produces <see cref="Outcome{TResult}"/>.</returns> | COMMENT |
| LOW | src/Polly.Core/ResiliencePipelineBuilder.TResult.cs | 1 | using System.ComponentModel.DataAnnotations; | COMMENT |
| LOW | src/Polly.Core/ResiliencePipeline.SyncT.cs | 1 | namespace Polly; | COMMENT |
| LOW | src/Polly.Core/DelayBackoffType.cs | 1 | namespace Polly; | COMMENT |
| LOW | src/Polly.Core/DelayBackoffType.cs | 21 | /// </summary> | COMMENT |
| LOW | src/Polly.Core/ResiliencePipelineT.Sync.cs | 1 | namespace Polly; | COMMENT |
| 615 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ateLimiting.Tests/RateLimiterRejectedExceptionTests.cs | 86 | var formatter = new System.Runtime.Serialization.Formatters.Binary.BinaryFormatter(); | CODE |
| CRITICAL | test/Polly.TestUtils/BinarySerializationUtil.cs | 19 | var formatter = new System.Runtime.Serialization.Formatters.Binary.BinaryFormatter(); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/skills/performance-benchmark/SKILL.md | 15 | ## Step 1: Write the Benchmark | COMMENT |
| LOW | .github/skills/performance-benchmark/SKILL.md | 60 | ## Step 2: Prepare the Baseline and Changed Code | COMMENT |
| LOW | .github/skills/performance-benchmark/SKILL.md | 73 | ## Step 3: Run the Benchmarks | COMMENT |
| LOW | .github/skills/performance-benchmark/SKILL.md | 87 | ## Step 4: Interpret and Report the Results | COMMENT |
| LOW | .github/skills/performance-benchmark/SKILL.md | 98 | ## Step 5: Clean Up | COMMENT |
| LOW | .github/skills/code-review/SKILL.md | 23 | ### Step 0: Load Relevant Instructions | COMMENT |
| LOW | .github/skills/code-review/SKILL.md | 33 | ### Step 1: Gather Code Context (No PR Narrative Yet) | COMMENT |
| LOW | .github/skills/code-review/SKILL.md | 45 | ### Step 2: Form an Independent Assessment | COMMENT |
| LOW | .github/skills/code-review/SKILL.md | 56 | ### Step 3: Incorporate PR Narrative and Reconcile | COMMENT |
| LOW | .github/skills/code-review/SKILL.md | 67 | ### Step 4: Detailed Analysis | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ly.Core.Tests/Hedging/Controller/TaskExecutionTests.cs | 296 | value.ShouldBe("dummy-value"); | CODE |
| LOW | …ly.Core.Tests/Hedging/Controller/TaskExecutionTests.cs | 302 | _primaryContext.Properties.Set(_myKey, "dummy-value"); | CODE |