☁️ Ultra-fast, secure & lightweight self-hosted cloud storage — your files, photos, calendars & contacts, all in one place. Built in Rust.
This report summarizes scanner evidence for AtalayaLabs/OxiCloud, a Rust project with 3,616 GitHub stars. SynthScan examined 492,111 lines of code across 1176 source files, recording 4074 pattern matches distributed across 16 syntactic categories. The legacy adjusted pattern signal is 14.9 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 2313 finding(s).
Are imports declared and package/API names verified? 35 finding(s).
Are wrappers, guards, and repeated structures necessary? 1769 finding(s).
Which changes need focused human review? 4074 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 4074 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 475 | # Round-4 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 526 | # Round-5 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 542 | # Round-29 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 553 | # Round-27 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 564 | # Round-26 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 590 | # Round-25 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 611 | # Round-24 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 626 | # Round-23 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 647 | # Round-22 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 663 | # Round-21 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 678 | # Round-20 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 694 | # Round-19 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 708 | # Round-18 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 721 | # Round-17 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 734 | # Round-16 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 745 | # Round-15 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 763 | # Round-14 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 781 | # Round-13 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 797 | # Round-12 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 822 | # Round-11 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 850 | # Round-10 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 869 | # Round-9 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 920 | # Round-8 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 930 | # Round-7 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 947 | # Round-6 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 976 | # Round-3 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 35 | # ── Server PID ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 43 | # ── Memory (KB) ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 49 | # ── CPU jiffies ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 52 | # ── Background monitor ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 253 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | bench.sh | 255 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | bench.sh | 264 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | bench.sh | 266 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 2 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 11 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 24 | # ── Colours ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 87 | # ── Auth ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 97 | # ── File gen ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 122 | # ── Inject large blob (bypass upload handler) ────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 156 | # ── Setup ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 174 | # ── Upload sizes (safe for the buffering handler) ─────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 195 | # ── Generate upload test files ────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 209 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 211 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 304 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 306 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 338 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 340 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 373 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 375 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 407 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 409 | # ============================================================================ | COMMENT |
| MEDIUM | build.rs | 32 | // ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | build.rs | 44 | // ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | build.rs | 69 | // ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | build.rs | 72 | // ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | frontend/static/workers/deltaWorker.js | 138 | // ── Shared pipeline state ───────────────────────────────────── | COMMENT |
| MEDIUM | frontend/static/workers/deltaWorker.js | 283 | // ── Negotiate stage ─────────────────────────────────────────── | COMMENT |
| MEDIUM | frontend/static/workers/deltaWorker.js | 332 | // ── Chunking stage (drives the other two) ──────────────────── | COMMENT |
| 1662 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 1 | [package] | COMMENT |
| LOW | Cargo.toml | 61 | # columns — AtalayaLabs/OxiCloud#689). MIT/Apache, pure-Rust tzdata. | COMMENT |
| LOW | Cargo.toml | 81 | # line-folding, escaped characters, parameter maps, and every standard | COMMENT |
| LOW | Cargo.toml | 121 | # client bundle lives in `frontend/` (`@serenity-kit/opaque`). Ciphersuite | COMMENT |
| LOW | Cargo.toml | 221 | plugins = ["dep:extism", "dep:file-rotate"] | COMMENT |
| LOW | Cargo.toml | 241 | # regenerated openapi.json; end-user release builds never do. Kept separate | COMMENT |
| LOW | Cargo.toml | 281 | # `#[async_trait]` method because the macro adds `#[must_use]` to a | COMMENT |
| LOW | Cargo.toml | 301 | path = "src/bin/generate-asyncapi.rs" | COMMENT |
| LOW | Cargo.toml | 341 | path = "src/bin/rt-hurl-helper.rs" | COMMENT |
| LOW | Cargo.toml | 601 | COMMENT | |
| LOW | Cargo.toml | 641 | # CTEs → 1 reused (Q6). Needs the dev Postgres up (reads DATABASE_URL from .env). | COMMENT |
| LOW | Cargo.toml | 661 | required-features = ["bench"] | COMMENT |
| LOW | Cargo.toml | 681 | # HashMap → direct VALUE=DATE scan; `UserDto::from` clone-every-field → move | COMMENT |
| LOW | Cargo.toml | 721 | # Round-17 battery ──────────────────────────────────────────────────────────── | COMMENT |
| LOW | Cargo.toml | 1061 | # info remains lands in external .dSYM bundles that the linker | COMMENT |
| LOW | bench.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | build.rs | 1 | //! build.rs — injects git build metadata into the binary and, under the | COMMENT |
| LOW | build.rs | 21 | // until something downstream hit the difference. The only workaround | COMMENT |
| LOW | build.rs | 61 | println!("cargo:warning=Or via the workspace shortcut: just fe-build"); | COMMENT |
| LOW | build.rs | 81 | // HEAD lives at that resolved path; branch refs + packed-refs are | COMMENT |
| LOW | build.rs | 141 | "GIT_BRANCH", // Jenkins | COMMENT |
| LOW | build.rs | 181 | COMMENT | |
| LOW | build.rs | 201 | // every checkout of the same tagged commit. It only changes when a | COMMENT |
| LOW | build.rs | 221 | "CIRCLE_SHA1", | COMMENT |
| LOW | build.rs | 241 | // the real build lost its version stamp. | COMMENT |
| LOW | build.rs | 321 | fn first_env(keys: &[&str]) -> Option<String> { | COMMENT |
| LOW | docker-compose.wopi.yml | 21 | COMMENT | |
| LOW | clippy.toml | 1 | # Clippy configuration overrides. Kept minimal — each entry documents | COMMENT |
| LOW | clippy.toml | 21 | # Revisit if: | COMMENT |
| LOW | docker-compose.yml | 21 | oxicloud: | COMMENT |
| LOW | entrypoint.sh | 1 | #!/bin/sh | COMMENT |
| LOW | tools/perf-audit/gc_manifest_batch.rs | 1 | //! Reproducible audit harness for `DedupService::garbage_collect_with_grace` | COMMENT |
| LOW | tools/perf-audit/admin_user_listing_e2e.rs | 1 | //! Component-faithful A/B for `GET /api/admin/users`. | COMMENT |
| LOW | frontend/svelte.config.js | 1 | import adapter from '@sveltejs/adapter-static'; | COMMENT |
| LOW | frontend/svelte.config.js | 81 | // The app registers the worker itself (see +layout.svelte): it needs the | COMMENT |
| LOW | frontend/vitest-setup.ts | 61 | // fail-open `console.debug` on stdout. Rather than pull in | COMMENT |
| LOW | frontend/vite.config.ts | 1 | import { sveltekit } from '@sveltejs/kit/vite'; | COMMENT |
| LOW | frontend/vite.config.ts | 21 | COMMENT | |
| LOW | frontend/static/sw.js | 1 | // Self-unregistering stub — replaces the legacy vanilla-frontend | COMMENT |
| LOW | frontend/src/hooks.client.ts | 21 | // Levels: 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'silent'. | COMMENT |
| LOW | frontend/src/hooks.client.ts | 141 | // Boot in parallel: translations and server-config discovery are | COMMENT |
| LOW | frontend/src/lib/message-bus/client.svelte.ts | 1 | // Message-bus WebSocket client — one connection per tab. | COMMENT |
| LOW | frontend/src/lib/message-bus/client.svelte.ts | 561 | // `#onTicketFailure`, which mirrors the WS-close reconnect path | COMMENT |
| LOW | frontend/src/lib/message-bus/client.svelte.ts | 581 | // visitor holds an ANONYMOUS session, and `/api/rt/ticket` is | COMMENT |
| LOW | frontend/src/lib/message-bus/client.svelte.ts | 621 | return; | COMMENT |
| LOW | frontend/src/lib/message-bus/client.svelte.ts | 701 | // `authz.denied` line. Left on the backoff path it turns a | COMMENT |
| LOW | frontend/src/lib/message-bus/error-codes.ts | 1 | // Named constants for JSON-RPC 2.0 error codes emitted on the message-bus | COMMENT |
| LOW | frontend/src/lib/composables/useJobTopic.svelte.ts | 1 | // Admin-job-dashboard sugar around `useTopic`. | COMMENT |
| LOW | frontend/src/lib/composables/useReconnect.svelte.ts | 1 | // Svelte 5 rune wrapper around `messageBus.onReconnect`. | COMMENT |
| LOW | frontend/src/lib/composables/useNotifications.svelte.ts | 201 | // (an already-known row can come back on a delta | COMMENT |
| LOW | frontend/src/lib/composables/useNotifications.svelte.ts | 341 | // catch-up returning the same row. | COMMENT |
| LOW | frontend/src/lib/stores/preferences.svelte.ts | 41 | * preserved on upload, matching Nextcloud / ownCloud / Seafile. | COMMENT |
| LOW | frontend/src/lib/stores/serverStatus.svelte.ts | 101 | // that DID stamp the header (any /api/* path within the | COMMENT |
| LOW | frontend/src/lib/utils/jobVerdict.ts | 81 | return lastSeverityCounts(job).anomaly ?? 0; | COMMENT |
| LOW | frontend/src/lib/utils/drivePolicies.ts | 221 | // | COMMENT |
| LOW | frontend/src/lib/components/DrivePoliciesModal.svelte | 121 | // the drive from its default. One edit would freeze every | COMMENT |
| LOW | frontend/src/lib/components/ShareDialog.test.ts | 241 | // | COMMENT |
| LOW | frontend/src/lib/components/round14.bench.test.ts | 1 | // Round-14 frontend micro-pack (benches/ROUND14.md §F1, §F2). | COMMENT |
| LOW | frontend/src/lib/components/round13.bench.test.ts | 1 | // Round-13 §V1 — grouped views are windowed (benches/ROUND13.md). | COMMENT |
| LOW | frontend/src/lib/components/AppShell.svelte | 201 | // ── Server-status realtime push ── | COMMENT |
| 2155 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 234 | # Performance benchmark harness (Phase 0). Exposes `bench_support` + thin public | COMMENT |
| MEDIUM | Cargo.toml | 271 | # Round-11 L1 harness only (bench_log_writer): the non-blocking writer was | COMMENT |
| MEDIUM | Cargo.toml | 354 | # Phase 0 perf harness — Task 0.2 (criterion latency + output-size bench). | COMMENT |
| MEDIUM | Cargo.toml | 361 | # Phase 0 perf harness — Task 0.3 (peak-RAM + saturated-throughput baseline). | COMMENT |
| MEDIUM | tools/perf-audit/run_gc_manifest_batch.sh | 19 | # avoiding localhost/SSL negotiation keeps the harness independent of host | COMMENT |
| MEDIUM | frontend/src/lib/i18n/i18n.bench.test.ts | 160 | // is more robust to noise than `mean`/`median` because the noise | COMMENT |
| MEDIUM | tests/common/cargo_build.sh | 2 | # Shared `cargo build` wrapper for the API harness. | COMMENT |
| MEDIUM | tests/common/cargo_build.sh | 8 | # the already-running server's log, which read as if the harness had | COMMENT |
| MEDIUM | tests/common/spawn-db.sh | 60 | # working empty container. So the harness provisions it, exactly as an | COMMENT |
| MEDIUM | tests/load/smoke.sh | 4 | # diff. Goal is harness liveness - does the server still boot and does k6 still | COMMENT |
| MEDIUM | tests/api/run.sh | 274 | # test harness itself reads via $OXICLOUD_* stays available; dotenvy won't | COMMENT |
| MEDIUM | tests/webdav/run.sh | 80 | # test harness itself reads via $OXICLOUD_* stays available; dotenvy won't | COMMENT |
| MEDIUM | tests/webdav/test_nextcloud_chunked_upload_propfind.sh | 87 | # and a plain grep is robust enough for the assertions we need. | COMMENT |
| MEDIUM | .cargo/audit.toml | 227 | # the `--cfg integration_tests` harness to spin up throwaway Postgres | COMMENT |
| MEDIUM | .cargo/audit.toml | 230 | # official Postgres images the test harness pulls. testcontainers 0.25.2 | COMMENT |
| MEDIUM | examples/bench_thumbnails_mem.rs | 204 | println!("# Thumbnail render harness — current working tree"); | CODE |
| MEDIUM | scripts/test-docker-publish-tags.sh | 184 | # the harness's defaults on other cases. | COMMENT |
| MEDIUM | scripts/compute-docker-tags.sh | 30 | # harness for diff-based assertions. | COMMENT |
| MEDIUM | scripts/compute-docker-tags.sh | 157 | # consumed by the test harness for equality checks. | COMMENT |
| MEDIUM | .github/workflows/load-smoke.yml | 3 | # PR-tier liveness check. Verifies the k6 load harness still builds and a | COMMENT |
| MEDIUM | src/bin/rt-hurl-helper.rs | 680 | // acked yet, but the check is robust to that ordering anyway. | COMMENT |
| MEDIUM | src/application/services/trash_service.rs | 139 | // Use empty MIME type to leverage extension fallback; one | COMMENT |
| MEDIUM | src/infrastructure/services/swappable_blob_backend.rs | 92 | // swap — recover the guard to keep the swap surface robust | COMMENT |
| MEDIUM | src/interfaces/api/handlers/webdav_handler.rs | 3879 | // but the helper still has to be robust to a path that | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | frontend/src/lib/stores/adminAdvisories.svelte.ts | 61 | export function setNotificationSinkMissing(value: boolean): void { | CODE |
| LOW | frontend/src/lib/stores/serverStatus.svelte.ts | 151 | export function refetchServerStatusConfig(): Promise<void> { | CODE |
| LOW | frontend/src/lib/components/AdminJobsPanel.svelte | 774 | async function onTriggerWithRepairConfirm(job: JobSummary) { | CODE |
| LOW | frontend/src/lib/api/transport.ts | 344 | export function setPasswordChangeRequiredHandler(fn: () => void): void { | CODE |
| LOW | frontend/src/lib/api/endpoints/folders.ts | 160 | export function getFolderAncestorsWithGrants(id: string): Promise<FolderAncestorsResponse> { | CODE |
| LOW | frontend/src/lib/api/endpoints/admin.ts | 735 | export async function previewDrivePolicyDefaults( | CODE |
| LOW | frontend/src/routes/admin/[[tab]]/+page.svelte | 1955 | async function searchManageOwnersCandidates(q: string) { | CODE |
| LOW | frontend/src/routes/photos/+page.svelte | 300 | async function resetAndReload() { | CODE |
| LOW | frontend/src/routes/photos/+page.svelte | 482 | async function onLightboxDeleteRequested(target: PhotoItem | FileItem): Promise<boolean> { | CODE |
| LOW⚡ | tests/caldav/test_report.py | 100 | def test_calendar_query_time_range_returns_events_in_window( | STRING |
| LOW | tests/caldav/test_report.py | 138 | def test_calendar_query_time_range_after_all_events_returns_empty( | CODE |
| LOW | tests/caldav/test_report.py | 162 | def test_calendar_query_time_range_before_all_events_returns_empty( | CODE |
| LOW | tests/caldav/test_report.py | 180 | def test_calendar_query_no_filter_returns_every_event( | CODE |
| LOW⚡ | tests/caldav/test_report.py | 204 | def test_calendar_multiget_by_href_returns_the_targeted_events( | CODE |
| LOW | tests/caldav/test_report.py | 240 | def test_calendar_multiget_unknown_href_is_silently_absent( | CODE |
| LOW⚡ | tests/caldav/test_ical_coverage.py | 93 | def test_description_with_escaped_chars_round_trips( | STRING |
| LOW | tests/caldav/test_ical_coverage.py | 124 | def test_location_survives_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 136 | def test_uid_and_dtstamp_are_preserved(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW⚡ | tests/caldav/test_ical_coverage.py | 160 | def test_attendee_survives_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 176 | def test_organizer_survives_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 189 | def test_categories_survive_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 202 | def test_status_and_transp_survive_round_trip( | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 221 | def test_valarm_survives_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 255 | def test_custom_x_property_survives_round_trip( | STRING |
| LOW⚡ | tests/caldav/test_recurring.py | 97 | def test_non_recurring_event_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW⚡ | tests/caldav/test_recurring.py | 126 | def test_recurring_master_plus_exception_preserves_master( | STRING |
| LOW | tests/caldav/test_recurring.py | 206 | def test_exception_only_put_does_not_wipe_master( | STRING |
| LOW⚡ | tests/caldav/test_recurring.py | 297 | def test_all_day_recurring_master_plus_exception( | STRING |
| LOW⚡ | tests/caldav/test_todo_tzid.py | 72 | def test_vtodo_round_trip_preserves_every_property( | CODE |
| LOW | tests/caldav/test_todo_tzid.py | 128 | def test_vtodo_minimal_body_accepted(fresh_calendar: caldav.Calendar) -> None: | STRING |
| LOW | tests/caldav/test_todo_tzid.py | 152 | def test_vtodo_time_range_search_uses_due_window( | STRING |
| LOW | tests/caldav/test_todo_tzid.py | 199 | def test_comp_filter_routing_event_search_excludes_todos( | STRING |
| LOW⚡ | tests/caldav/test_todo_tzid.py | 260 | def test_tzid_event_accepted_and_indexed_at_correct_utc_instant( | STRING |
| LOW | tests/caldav/test_todo_tzid.py | 317 | def test_vtimezone_block_round_trips_with_rrules( | STRING |
| LOW⚡ | tests/caldav/test_carddav.py | 103 | def test_vcard_basic_round_trip( | STRING |
| LOW | tests/caldav/test_carddav.py | 121 | def test_vcard_email_survives_round_trip( | CODE |
| LOW | tests/caldav/test_carddav.py | 140 | def test_vcard_delete_removes_it( | CODE |
| LOW | tests/caldav/test_carddav.py | 160 | def test_addressbook_shows_up_in_propfind( | CODE |
| LOW⚡ | tests/caldav/test_carddav.py | 202 | def test_vcard_org_and_title_survive_round_trip( | CODE |
| LOW | tests/caldav/test_carddav.py | 224 | def test_vcard_note_survives_round_trip( | CODE |
| LOW | tests/caldav/test_carddav.py | 241 | def test_vcard_tel_uri_form_survives_round_trip( | CODE |
| LOW | tests/caldav/test_carddav.py | 262 | def test_vcard_adr_survives_round_trip( | CODE |
| LOW | tests/caldav/test_collection_hrefs.py | 39 | def test_response_hrefs_preserve_the_uploaded_collection( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | frontend/static/locales/zh.json | 2057 | "placeholder": "输入命令或搜索...", | CODE |
| LOW | frontend/static/locales/nl.json | 2057 | "placeholder": "Typ een opdracht of zoek...", | CODE |
| LOW | frontend/static/locales/ja.json | 2057 | "placeholder": "コマンドを入力するか検索してください…", | CODE |
| LOW | frontend/static/locales/de.json | 2057 | "placeholder": "Geben Sie einen Befehl ein oder suchen Sie ...", | CODE |
| LOW | frontend/static/locales/ru.json | 2057 | "placeholder": "Введите команду или выполните поиск...", | CODE |
| LOW | frontend/static/locales/pl.json | 2057 | "placeholder": "Wpisz polecenie lub wyszukaj…", | CODE |
| LOW | frontend/static/locales/pt.json | 2057 | "placeholder": "Digite um comando ou pesquise…", | CODE |
| LOW | frontend/static/locales/en.json | 1888 | "placeholder": "Type a command or search…", | CODE |
| LOW | frontend/static/locales/it.json | 2057 | "placeholder": "Digita un comando o cerca...", | CODE |
| LOW | frontend/static/locales/fr.json | 2057 | "placeholder": "Tapez une commande ou recherchez…", | CODE |
| LOW | frontend/static/locales/hi.json | 2057 | "placeholder": "एक कमांड टाइप करें या खोजें...", | CODE |
| LOW | frontend/static/locales/ko.json | 1983 | "placeholder": "명령을 입력하거나 검색하세요…", | CODE |
| LOW | frontend/static/locales/zh-TW.json | 2057 | "placeholder": "輸入命令或搜尋...", | CODE |
| LOW | frontend/static/locales/fa.json | 2057 | "placeholder": "یک دستور تایپ کنید یا جستجو کنید…", | CODE |
| LOW | frontend/static/locales/es.json | 2057 | "placeholder": "Escribe un comando o busca…", | CODE |
| LOW | frontend/static/locales/ar.json | 2057 | "placeholder": "اكتب أمرًا أو ابحث...", | CODE |
| LOW | docs/config/oxicloud.example.toml | 83 | user = "oxicloud@example.org" | CODE |
| LOW | docs/public/oxicloud.example.toml | 83 | user = "oxicloud@example.org" | CODE |
| LOW | examples/bench_round11_micro.rs | 728 | email_home: "ada@example.org".into(), | CODE |
| LOW | src/common/config.rs | 4846 | "backup@example.org".to_string() | CODE |
| LOW | src/application/adapters/carddav_adapter_test.rs | 31 | full_name: Some("John Doe".to_string()), | CODE |
| LOW | src/application/adapters/carddav_adapter_test.rs | 53 | street: Some("123 Main St".to_string()), | CODE |
| LOW | src/application/adapters/carddav_adapter_test.rs | 61 | organization: Some("Acme Corp".to_string()), | CODE |
| LOW | src/application/adapters/carddav_adapter_test.rs | 603 | assert!(vcard.contains("123 Main St"), "Should have street"); | CODE |
| LOW | src/infrastructure/services/email_notification_sink.rs | 455 | let sink = sink(sender.clone(), &["ops@example.com", "ed@example.org"]); | CODE |
| LOW | src/infrastructure/services/email_notification_sink.rs | 462 | assert_eq!(sent[1].to, "ed@example.org"); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/api/rt_bus_check.sh | 7 | # This script orchestrates it against a live oxicloud server: bootstraps | COMMENT |
| MEDIUM | tests/api/rt_bus_check.sh | 2123 | # path, so orchestration waits for all subscribes to install BEFORE | COMMENT |
| MEDIUM | docs/DESIGN-SYSTEM.md | 83 | ## 4. CI guardrails (what keeps the score from regressing) | COMMENT |
| MEDIUM | docs/guide/trash.md | 11 | 5. **Trash on a read-only drive is paused** — see [Drives → Read-only](/guide/drives#policies-per-drive-guardrails). The | CODE |
| MEDIUM | docs/guide/drives.md | 73 | ## Policies — per-drive guardrails | COMMENT |
| MEDIUM | docs/plan/message-bus.md | 429 | ### 3. Replicator scaffolding (day-1) | COMMENT |
| MEDIUM | docs/plan/cache-optimization.md | 606 | ### What — with the pressure guardrails | COMMENT |
| MEDIUM | docs/plan/markdown-collab.md | 806 | ## Limits & guardrails | COMMENT |
| MEDIUM | src/application/services/collab_session_service.rs | 99 | /// guardrails table. Wired from `AppConfig::collab` in the DI layer | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/interfaces/api/handlers/config_handler.rs | 177 | opaque_mode: state.core.config.opaque.mode.as_str(), | CODE |
| CRITICAL | src/interfaces/api/handlers/admin_handler.rs | 1669 | state.core.config.webhook.url.as_deref(), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/application/services/delta_upload_service.rs | 236 | /// Step 1: which of these chunks must the caller upload? | COMMENT |
| LOW | src/application/services/delta_upload_service.rs | 256 | /// Step 2: store uploaded chunk frames. Hashes are computed | COMMENT |
| LOW⚡ | src/application/services/delta_upload_service.rs | 271 | /// Step 3: pin → verify → attach manifest → create/update the file row. | COMMENT |
| LOW | src/application/services/file_retrieval_service.rs | 594 | // NOTE: This method does NOT perform any authorization check. Callers | COMMENT |
| LOW⚡ | src/application/services/collab_session_service.rs | 1298 | // Step 2: drop the actor (best-effort). | COMMENT |
| LOW⚡ | src/application/services/collab_session_service.rs | 1300 | // Step 3: remove the DB row so the next attach re-seeds | COMMENT |
| LOW | src/application/services/collab_session_service.rs | 1285 | // Step 1: final flush if we have a live actor. | COMMENT |
| LOW | src/application/services/file_management_service.rs | 797 | // Step 1: Try trash (soft delete — file row stays, blob stays referenced) | COMMENT |
| LOW | src/application/services/file_management_service.rs | 823 | // Step 2: Permanent delete — trigger handles blob ref_count | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/application/services/delta_upload_service.rs | 236 | /// Step 1: which of these chunks must the caller upload? | COMMENT |
| LOW | src/application/services/delta_upload_service.rs | 256 | /// Step 2: store uploaded chunk frames. Hashes are computed | COMMENT |
| LOW⚡ | src/application/services/delta_upload_service.rs | 271 | /// Step 3: pin → verify → attach manifest → create/update the file row. | COMMENT |
| LOW⚡ | src/application/services/collab_session_service.rs | 1298 | // Step 2: drop the actor (best-effort). | COMMENT |
| LOW⚡ | src/application/services/collab_session_service.rs | 1300 | // Step 3: remove the DB row so the next attach re-seeds | COMMENT |
| LOW | src/application/services/collab_session_service.rs | 1285 | // Step 1: final flush if we have a live actor. | COMMENT |
| LOW | src/application/services/file_management_service.rs | 797 | // Step 1: Try trash (soft delete — file row stays, blob stays referenced) | COMMENT |
| LOW | src/application/services/file_management_service.rs | 823 | // Step 2: Permanent delete — trigger handles blob ref_count | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/caldav/conftest.py | 126 | except Exception: | CODE |
| HIGH | tests/caldav/conftest.py | 225 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/plan/plan-ReBAC-Permissions-Grants-Cascading.md | 574 | ### `GET /api/grants/outgoing` — grants I have created | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/caldav/conftest.py | 13 | CODE | |
| LOW | tests/caldav/test_report.py | 23 | CODE | |
| LOW | tests/caldav/test_ical_coverage.py | 24 | CODE | |
| LOW | tests/caldav/test_recurring.py | 27 | CODE | |
| LOW | tests/caldav/test_todo_tzid.py | 22 | CODE | |
| LOW | tests/caldav/test_carddav.py | 27 | CODE | |
| LOW | tests/caldav/test_collection_hrefs.py | 9 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/common/spawn-db.sh | 55 | # Create the blob container Azurite serves. | COMMENT |
| MEDIUM | tests/webdav/common.sh | 20 | # Create the first admin account if the server is freshly initialised. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/caldav/conftest.py | 126 | except Exception: | CODE |
| LOW | tests/caldav/conftest.py | 225 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/restore.sh | 21 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/caldav/test_collection_hrefs.py | 39 | CODE |