☁️ Ultra-fast, secure & lightweight self-hosted cloud storage — your files, photos, calendars & contacts, all in one place. Built in Rust.
This report presents the forensic synthetic code analysis of AtalayaLabs/OxiCloud, a Rust project with 3,455 GitHub stars. SynthScan v2.0 examined 335,130 lines of code across 996 source files, recording 2575 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 16.0 places this repository in the Moderate AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2575 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 299 | # Round-4 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 350 | # Round-5 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 366 | # Round-29 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 377 | # Round-27 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 388 | # Round-26 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 414 | # Round-25 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 435 | # Round-24 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 450 | # Round-23 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 471 | # Round-22 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 487 | # Round-21 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 502 | # Round-20 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 518 | # Round-19 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 532 | # Round-18 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 545 | # Round-17 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 558 | # Round-16 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 569 | # Round-15 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 587 | # Round-14 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 605 | # Round-13 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 621 | # Round-12 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 646 | # Round-11 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 674 | # Round-10 battery ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 693 | # Round-9 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 744 | # Round-8 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 754 | # Round-7 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 771 | # Round-6 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | Cargo.toml | 800 | # Round-3 battery ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 35 | # ── Server PID ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 43 | # ── Memory (KB) ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 49 | # ── CPU jiffies ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 52 | # ── Background monitor ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | bench.sh | 253 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | bench.sh | 255 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | bench.sh | 264 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | bench.sh | 266 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 2 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 11 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 24 | # ── Colours ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 87 | # ── Auth ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 97 | # ── File gen ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 122 | # ── Inject large blob (bypass upload handler) ────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 156 | # ── Setup ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 174 | # ── Upload sizes (safe for the buffering handler) ─────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 195 | # ── Generate upload test files ────────────────────────────────────────────── | COMMENT |
| MEDIUM | bench.sh | 209 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 211 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 304 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 306 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 338 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 340 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 373 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 375 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 407 | # ============================================================================ | COMMENT |
| MEDIUM | bench.sh | 409 | # ============================================================================ | COMMENT |
| MEDIUM | build.rs | 15 | // ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | build.rs | 18 | // ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | frontend/static/workers/deltaWorker.js | 83 | // ── Shared pipeline state ───────────────────────────────────── | COMMENT |
| MEDIUM | frontend/static/workers/deltaWorker.js | 198 | // ── Negotiate stage ─────────────────────────────────────────── | COMMENT |
| MEDIUM | frontend/static/workers/deltaWorker.js | 239 | // ── Chunking stage (drives the other two) ──────────────────── | COMMENT |
| MEDIUM | frontend/static/workers/deltaWorker.js | 285 | // ── Drain: negotiations → uploads → commit ─────────────── | COMMENT |
| MEDIUM | frontend/src/lib/stores/preferences.svelte.ts | 80 | // ── Typed accessors ────────────────────────────────────────── | COMMENT |
| 1341 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 21 | tracing = "0.1.44" | COMMENT |
| LOW | Cargo.toml | 121 | ndarray = { version = "0.17.2", optional = true } | COMMENT |
| LOW | Cargo.toml | 461 | COMMENT | |
| LOW | Cargo.toml | 501 | COMMENT | |
| LOW | Cargo.toml | 521 | # the per-request `format!("{u}:{p}")` String), WOPI validate/generate prebuilt | COMMENT |
| LOW | Cargo.toml | 881 | # actually need on a long-running server) while dropping the rest of | COMMENT |
| LOW | bench.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | TODO-STORAGE-BACKENDS.prompt.md | 81 | pub backend_type: String, | COMMENT |
| LOW | docker-compose.wopi.yml | 21 | COMMENT | |
| LOW | docker-compose.yml | 21 | oxicloud: | COMMENT |
| LOW | entrypoint.sh | 1 | #!/bin/sh | COMMENT |
| LOW | tools/perf-audit/gc_manifest_batch.rs | 1 | //! Reproducible audit harness for `DedupService::garbage_collect_with_grace` | COMMENT |
| LOW | tools/perf-audit/admin_user_listing_e2e.rs | 1 | //! Component-faithful A/B for `GET /api/admin/users`. | COMMENT |
| LOW | frontend/svelte.config.js | 1 | import adapter from '@sveltejs/adapter-static'; | COMMENT |
| LOW | frontend/vite.config.ts | 1 | import { sveltekit } from '@sveltejs/kit/vite'; | COMMENT |
| LOW | frontend/static/sw.js | 1 | // Self-unregistering stub — replaces the legacy vanilla-frontend | COMMENT |
| LOW | frontend/src/lib/stores/preferences.svelte.ts | 41 | * preserved on upload, matching Nextcloud / ownCloud / Seafile. | COMMENT |
| LOW | frontend/src/lib/components/round14.bench.test.ts | 1 | // Round-14 frontend micro-pack (benches/ROUND14.md §F1, §F2). | COMMENT |
| LOW | frontend/src/lib/components/round13.bench.test.ts | 1 | // Round-13 §V1 — grouped views are windowed (benches/ROUND13.md). | COMMENT |
| LOW | frontend/src/lib/components/AppShell.svelte | 341 | // Stale-response guard (same family as the search page): the debounce | COMMENT |
| LOW | frontend/src/lib/components/ResourceList.svelte | 481 | // even if the user's global preference is on. | COMMENT |
| LOW | frontend/src/lib/components/ResourceList.svelte | 621 | const a = order.indexOf(anchorId); | COMMENT |
| LOW | frontend/src/lib/components/ResourceList.svelte | 701 | } | COMMENT |
| LOW | frontend/src/lib/components/ResourceList.svelte | 721 | e.preventDefault(); | COMMENT |
| LOW | frontend/src/lib/components/ResourceList.svelte | 841 | for (const id of nextSelection) if (!selected.has(id)) selected.add(id); | COMMENT |
| LOW | frontend/src/lib/components/ResourceList.svelte | 981 | // * `enableSystemDrop = true`: the page has an upload code path | COMMENT |
| LOW | frontend/src/lib/components/QuotaEditor.svelte | 1 | <script lang="ts"> | COMMENT |
| LOW | frontend/src/lib/components/FolderBreadcrumb.svelte | 161 | // facing surface for a public-link session. | COMMENT |
| LOW | frontend/src/lib/components/AdminJobsPanel.svelte | 461 | } | COMMENT |
| LOW | frontend/src/lib/components/round18.bench.test.ts | 1 | // Round-18 frontend micro-pack (benches/ROUND18.md §F1). | COMMENT |
| LOW | frontend/src/routes/config/drive/[uuid]/+page.svelte | 181 | // Drive policies are OxiCloud-admin-only for mutation (§8), but | COMMENT |
| LOW | frontend/src/routes/favorites/+page.svelte | 41 | COMMENT | |
| LOW | frontend/src/routes/shared-with-me/+page.svelte | 41 | let error = $state<string | null>(null); | COMMENT |
| LOW | frontend/src/routes/admin/[[tab]]/+page.svelte | 441 | // Migration | COMMENT |
| LOW | frontend/src/routes/admin/[[tab]]/+page.svelte | 521 | // The old target-name picker state was retired — the entries | COMMENT |
| LOW | frontend/src/routes/admin/[[tab]]/+page.svelte | 1061 | // Owner user record for each PERSONAL drive, keyed by drive id. | COMMENT |
| LOW | frontend/src/routes/admin/[[tab]]/+page.svelte | 1361 | } | COMMENT |
| LOW | frontend/src/routes/trash/+page.svelte | 41 | // timer to permanent deletion without ever being visible for | COMMENT |
| LOW | frontend/src/routes/search/+page.svelte | 41 | // "Everywhere" — so they can toggle back to "This folder" without | COMMENT |
| LOW | frontend/src/routes/search/+page.svelte | 61 | // query time / result count into the title string because ResourceList | COMMENT |
| LOW | frontend/src/routes/search/+page.svelte | 101 | // Sort dimension + direction are surfaced through ResourceList's | COMMENT |
| LOW | frontend/src/routes/search/+page.svelte | 121 | // stdlib `URLSearchParams`, and we don't need reactivity here. | COMMENT |
| LOW | frontend/src/routes/search/+page.svelte | 641 | onreload={() => { | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 61 | const fileViewer = lazyComponent(() => import('$lib/components/FileViewer.svelte')); | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 101 | let listing = $state<FolderListing>({ folders: [], files: [] }); | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 121 | // at the top of the list. The swimlane clears on next folder nav. | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 141 | // — same UX as macOS Finder. | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 281 | // on the new folder — must clear or the first append would | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 301 | // load. `/files/A/B/C` still resolves (router matches `[...path]`) | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 1201 | COMMENT | |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 1241 | // modifier key) picks the effective operation and the OS | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 1621 | // (the previous `$state` + two `$effect` mirror was fragile — a | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 1661 | // GROUP_BYS toolbar emits, so <ResourceList>'s onreload gets the | COMMENT |
| LOW | frontend/src/routes/files/[...path]/+page.svelte | 1781 | const onDown = (e: MouseEvent) => { | COMMENT |
| LOW | frontend/src/routes/photos/+page.svelte | 81 | }).format(d); | COMMENT |
| LOW | frontend/src/routes/login/+page.svelte | 81 | // magic-link path. When the password is empty (and the server offers | COMMENT |
| LOW | frontend/src/routes/login/+page.svelte | 101 | // `bind:this` on the first input of each mode's form so the effect | COMMENT |
| LOW | wasm/oxicloud-plugin-hello/src/lib.rs | 1 | //! Example OxiCloud plugin — ABI v0 (M0 walking skeleton). | COMMENT |
| LOW | wasm/oxicloud-hash/src/lib.rs | 1 | //! BLAKE3 for the OxiCloud web frontend. | COMMENT |
| LOW | wasm/oxicloud-hash/src/lib.rs | 61 | /// One-shot convenience for small buffers. | COMMENT |
| 1038 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 142 | # Performance benchmark harness (Phase 0). Exposes `bench_support` + thin public | COMMENT |
| MEDIUM | Cargo.toml | 154 | # Round-11 L1 harness only (bench_log_writer): the non-blocking writer was | COMMENT |
| MEDIUM | Cargo.toml | 178 | # Phase 0 perf harness — Task 0.2 (criterion latency + output-size bench). | COMMENT |
| MEDIUM | Cargo.toml | 185 | # Phase 0 perf harness — Task 0.3 (peak-RAM + saturated-throughput baseline). | COMMENT |
| MEDIUM | tools/perf-audit/run_gc_manifest_batch.sh | 19 | # avoiding localhost/SSL negotiation keeps the harness independent of host | COMMENT |
| MEDIUM | frontend/src/lib/i18n/i18n.bench.test.ts | 160 | // is more robust to noise than `mean`/`median` because the noise | COMMENT |
| MEDIUM | tests/load/smoke.sh | 4 | # diff. Goal is harness liveness - does the server still boot and does k6 still | COMMENT |
| MEDIUM | tests/api/run.sh | 117 | # test harness itself reads via $OXICLOUD_* stays available; dotenvy won't | COMMENT |
| MEDIUM | tests/webdav/run.sh | 80 | # test harness itself reads via $OXICLOUD_* stays available; dotenvy won't | COMMENT |
| MEDIUM | tests/webdav/test_nextcloud_chunked_upload_propfind.sh | 87 | # and a plain grep is robust enough for the assertions we need. | COMMENT |
| MEDIUM | .cargo/audit.toml | 63 | # the `--cfg integration_tests` harness to spin up throwaway Postgres | COMMENT |
| MEDIUM | .cargo/audit.toml | 66 | # official Postgres images the test harness pulls. testcontainers 0.25.2 | COMMENT |
| MEDIUM | examples/bench_thumbnails_mem.rs | 204 | println!("# Thumbnail render harness — current working tree"); | CODE |
| MEDIUM | .github/workflows/load-smoke.yml | 3 | # PR-tier liveness check. Verifies the k6 load harness still builds and a | COMMENT |
| MEDIUM | src/application/services/trash_service.rs | 118 | // Use empty MIME type to leverage extension fallback; one | COMMENT |
| MEDIUM | src/infrastructure/services/swappable_blob_backend.rs | 92 | // swap — recover the guard to keep the swap surface robust | COMMENT |
| MEDIUM | src/interfaces/api/handlers/webdav_handler.rs | 3766 | // but the helper still has to be robust to a path that | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | frontend/src/routes/admin/[[tab]]/+page.svelte | 1198 | async function searchManageOwnersCandidates(q: string) { | CODE |
| LOW⚡ | tests/caldav/test_report.py | 100 | def test_calendar_query_time_range_returns_events_in_window( | STRING |
| LOW | tests/caldav/test_report.py | 138 | def test_calendar_query_time_range_after_all_events_returns_empty( | CODE |
| LOW | tests/caldav/test_report.py | 162 | def test_calendar_query_time_range_before_all_events_returns_empty( | CODE |
| LOW | tests/caldav/test_report.py | 180 | def test_calendar_query_no_filter_returns_every_event( | CODE |
| LOW⚡ | tests/caldav/test_report.py | 204 | def test_calendar_multiget_by_href_returns_the_targeted_events( | CODE |
| LOW | tests/caldav/test_report.py | 240 | def test_calendar_multiget_unknown_href_is_silently_absent( | CODE |
| LOW⚡ | tests/caldav/test_ical_coverage.py | 93 | def test_description_with_escaped_chars_round_trips( | STRING |
| LOW | tests/caldav/test_ical_coverage.py | 124 | def test_location_survives_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 136 | def test_uid_and_dtstamp_are_preserved(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW⚡ | tests/caldav/test_ical_coverage.py | 160 | def test_attendee_survives_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 176 | def test_organizer_survives_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 189 | def test_categories_survive_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 202 | def test_status_and_transp_survive_round_trip( | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 221 | def test_valarm_survives_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW | tests/caldav/test_ical_coverage.py | 255 | def test_custom_x_property_survives_round_trip( | STRING |
| LOW⚡ | tests/caldav/test_recurring.py | 97 | def test_non_recurring_event_round_trip(fresh_calendar: caldav.Calendar) -> None: | CODE |
| LOW⚡ | tests/caldav/test_recurring.py | 126 | def test_recurring_master_plus_exception_preserves_master( | STRING |
| LOW | tests/caldav/test_recurring.py | 206 | def test_exception_only_put_does_not_wipe_master( | STRING |
| LOW⚡ | tests/caldav/test_recurring.py | 297 | def test_all_day_recurring_master_plus_exception( | STRING |
| LOW⚡ | tests/caldav/test_carddav.py | 103 | def test_vcard_basic_round_trip( | STRING |
| LOW | tests/caldav/test_carddav.py | 121 | def test_vcard_email_survives_round_trip( | CODE |
| LOW | tests/caldav/test_carddav.py | 140 | def test_vcard_delete_removes_it( | CODE |
| LOW | tests/caldav/test_carddav.py | 160 | def test_addressbook_shows_up_in_propfind( | CODE |
| LOW⚡ | tests/caldav/test_carddav.py | 202 | def test_vcard_org_and_title_survive_round_trip( | CODE |
| LOW | tests/caldav/test_carddav.py | 224 | def test_vcard_note_survives_round_trip( | CODE |
| LOW | tests/caldav/test_carddav.py | 241 | def test_vcard_tel_uri_form_survives_round_trip( | CODE |
| LOW | tests/caldav/test_carddav.py | 262 | def test_vcard_adr_survives_round_trip( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/application/services/delta_upload_service.rs | 236 | /// Step 1: which of these chunks must the caller upload? | COMMENT |
| LOW | src/application/services/delta_upload_service.rs | 256 | /// Step 2: store uploaded chunk frames. Hashes are computed | COMMENT |
| LOW⚡ | src/application/services/delta_upload_service.rs | 271 | /// Step 3: pin → verify → attach manifest → create/update the file row. | COMMENT |
| LOW | src/application/services/file_retrieval_service.rs | 544 | // NOTE: This method does NOT perform any authorization check. Callers | COMMENT |
| LOW | src/application/services/file_management_service.rs | 600 | // Step 1: Try trash (soft delete — file row stays, blob stays referenced) | COMMENT |
| LOW | src/application/services/file_management_service.rs | 625 | // Step 2: Permanent delete — trigger handles blob ref_count | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/application/services/delta_upload_service.rs | 236 | /// Step 1: which of these chunks must the caller upload? | COMMENT |
| LOW | src/application/services/delta_upload_service.rs | 256 | /// Step 2: store uploaded chunk frames. Hashes are computed | COMMENT |
| LOW⚡ | src/application/services/delta_upload_service.rs | 271 | /// Step 3: pin → verify → attach manifest → create/update the file row. | COMMENT |
| LOW | src/application/services/file_management_service.rs | 600 | // Step 1: Try trash (soft delete — file row stays, blob stays referenced) | COMMENT |
| LOW | src/application/services/file_management_service.rs | 625 | // Step 2: Permanent delete — trigger handles blob ref_count | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/DESIGN-SYSTEM.md | 83 | ## 4. CI guardrails (what keeps the score from regressing) | COMMENT |
| MEDIUM | docs/guide/trash.md | 11 | 5. **Trash on a read-only drive is paused** — see [Drives → Read-only](/guide/drives#policies-per-drive-guardrails). The | CODE |
| MEDIUM | docs/guide/drives.md | 73 | ## Policies — per-drive guardrails | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/plan/plan-ReBAC-Permissions-Grants-Cascading.md | 574 | ### `GET /api/grants/outgoing` — grants I have created | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | frontend/static/locales/en.json | 1536 | "placeholder": "Type a command or search…", | CODE |
| LOW | frontend/static/locales/ko.json | 1604 | "placeholder": "명령을 입력하거나 검색하세요…", | CODE |
| LOW | examples/bench_round11_micro.rs | 728 | email_home: "ada@example.org".into(), | CODE |
| LOW | src/application/adapters/carddav_adapter_test.rs | 32 | full_name: Some("John Doe".to_string()), | CODE |
| LOW | src/application/adapters/carddav_adapter_test.rs | 54 | street: Some("123 Main St".to_string()), | CODE |
| LOW | src/application/adapters/carddav_adapter_test.rs | 62 | organization: Some("Acme Corp".to_string()), | CODE |
| LOW | src/application/adapters/carddav_adapter_test.rs | 604 | assert!(vcard.contains("123 Main St"), "Should have street"); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/caldav/conftest.py | 13 | CODE | |
| LOW | tests/caldav/test_report.py | 23 | CODE | |
| LOW | tests/caldav/test_ical_coverage.py | 24 | CODE | |
| LOW | tests/caldav/test_recurring.py | 27 | CODE | |
| LOW | tests/caldav/test_carddav.py | 27 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/webdav/common.sh | 20 | # Create the first admin account if the server is freshly initialised. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/caldav/conftest.py | 126 | except Exception: | CODE |
| LOW | tests/caldav/conftest.py | 225 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/infrastructure/services/azure_blob_backend.rs | 393 | // TODO: implement `list_blob_hashes` via | COMMENT |