AutoHotkey - macro-creation and automation-oriented scripting utility for Windows.
This report summarizes scanner evidence for AutoHotkey/AutoHotkey, a C++ project with 13,270 GitHub stars. SynthScan examined 150,118 lines of code across 152 source files, recording 812 pattern matches distributed across 2 syntactic categories. The legacy adjusted pattern signal is 4.6 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 812 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 0 finding(s).
Which changes need focused human review? 812 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 812 distinct pattern matches across 2 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | source/TextIO.h | 1 | #pragma once | COMMENT |
| LOW | source/util.cpp | 141 | // of the YYYYMMDDHH24MISS format is present. | COMMENT |
| LOW | source/util.cpp | 321 | return (__int64)((__int64)(uiEnd.QuadPart - uiStart.QuadPart) / 10000000); // Convert from tenths-of-microsecond. | COMMENT |
| LOW | source/util.cpp | 461 | } | COMMENT |
| LOW | source/util.cpp | 521 | } | COMMENT |
| LOW | source/util.cpp | 541 | COMMENT | |
| LOW | source/util.cpp | 661 | } // while() find next match | COMMENT |
| LOW | source/util.cpp | 681 | // version 2.1 of the License, or (at your option) any later version. | COMMENT |
| LOW | source/util.cpp | 1081 | // - aLimit: Specify UINT_MAX to have no restriction on the number of replacements. Otherwise, specify a number >=0. | COMMENT |
| LOW | source/util.cpp | 1101 | // two other/related StrReplace() functions obsolete. Also, the code has been simplified to avoid doing | COMMENT |
| LOW | source/util.cpp | 1161 | if (!length_delta // old_len==new_len, so use in-place method because it's just as fast in this case but it avoids the | COMMENT |
| LOW | source/util.cpp | 1261 | } | COMMENT |
| LOW | source/util.cpp | 1301 | } | COMMENT |
| LOW | source/util.cpp | 1361 | { // A limit is currently in effect and it's less than expected replacements, so cap the expected. | COMMENT |
| LOW | source/util.cpp | 1381 | double quality = 1 + 2*(1-( | COMMENT |
| LOW | source/util.cpp | 1861 | // Caller has ensured that aBuf is large enough (though anything >=32767 is always large enough). | COMMENT |
| LOW | source/util.cpp | 1961 | // Since above didn't return, an error occurred. MSDN isn't clear about what conditions can | COMMENT |
| LOW | source/util.cpp | 2061 | // This differs from GetDpiForSystem, as it appears the "system DPI" is fixed at initial login | COMMENT |
| LOW | source/util.cpp | 2121 | return NULL; | COMMENT |
| LOW | source/util.cpp | 2141 | // said that an ICL is an "ICon Library... a renamed 16-bit Windows .DLL (an NE format executable) which | COMMENT |
| LOW | source/util.cpp | 2201 | // It is also not documented to support resource IDs, unlike ExtractIcon and ExtractIconEx. | COMMENT |
| LOW | source/util.cpp | 2261 | // LR_CREATEDIBSECTION applies only when aImageType == IMAGE_BITMAP, but seems appropriate in that case. | COMMENT |
| LOW | source/util.cpp | 2281 | // Gui, Show | COMMENT |
| LOW | source/util.cpp | 2501 | // The following will also handle HICON/HCURSOR correctly if aImageType == IMAGE_ICON/CURSOR. | COMMENT |
| LOW | source/util.cpp | 2521 | // Therefore, it seems best to call the right function even though DeleteObject might work on | COMMENT |
| LOW | source/MdType.h | 121 | #define md_cat(a, ...) a ## __VA_ARGS__ | COMMENT |
| LOW | source/TextIO.cpp | 121 | { | COMMENT |
| LOW | source/debug.h | 1 | #pragma once | COMMENT |
| LOW | source/debug.h | 21 | // #define _CRTDBG_MAP_ALLOC | COMMENT |
| LOW | source/debug.h | 41 | #ifndef VERIFY | COMMENT |
| LOW | source/AutoHotkey.cpp | 41 | // that has no media (and possibly other errors) won't cause the system to display an error | COMMENT |
| LOW | source/AutoHotkey.cpp | 101 | COMMENT | |
| LOW | source/AutoHotkey.cpp | 301 | // top part (the auto-execute part) of the script so that they will be in effect even if the | COMMENT |
| LOW | source/stdafx.h | 21 | COMMENT | |
| LOW | source/stdafx.h | 41 | #include <stdlib.h> | COMMENT |
| LOW | source/stdafx.h | 61 | // dependencies sneaking in, or subtle naming conflicts: | COMMENT |
| LOW | source/script.h | 21 | #include "defines.h" | COMMENT |
| LOW | source/script.h | 41 | // Explanation: If/when AutoExec() finishes, although it no longer needs g_array[0] (not even | COMMENT |
| LOW | source/script.h | 121 | #define ERR_ABORT_DELETE _T("__Delete will now return.") | COMMENT |
| LOW | source/script.h | 141 | #define ERR_PARAM4_INVALID _T("Parameter #4 invalid.") | COMMENT |
| LOW | source/script.h | 161 | #define ERR_MISSING_PARAM_NAME _T("Missing parameter name.") | COMMENT |
| LOW | source/script.h | 181 | #define ERR_INVALID_LINE_IN_CLASS_DEF _T("Not a valid method, class or property definition.") | COMMENT |
| LOW | source/script.h | 201 | #define ERR_NO_PROCESS _T("Target process not found.") | COMMENT |
| LOW | source/script.h | 381 | }; | COMMENT |
| LOW | source/script.h | 401 | // It is also best for maintainability to avoid setting mem_to_free or an object without | COMMENT |
| LOW | source/script.h | 421 | #define _o__ret _f__ret | COMMENT |
| LOW | source/script.h | 441 | // or probably any other method of dynamically allocating/expanding the buffers. It also | COMMENT |
| LOW | source/script.h | 701 | COMMENT | |
| LOW | source/script.h | 721 | // want to review if any of the API calls used expect a string whose contents are | COMMENT |
| LOW | source/script.h | 741 | COMMENT | |
| LOW | source/script.h | 761 | #define ARG4 sArgDeref[3] | COMMENT |
| LOW | source/script.h | 781 | // If the arg's text is non-blank, it means the variable is a dynamic name such as array%i% | COMMENT |
| LOW | source/script.h | 801 | static LPTSTR *sSourceFile; // Will hold an array of strings. | COMMENT |
| LOW | source/script.h | 821 | #define EXPR_SYMBOLS_AFTER_MAYBE _T("),]}:?") // Excludes '.', which needs more complicated logic. | COMMENT |
| LOW | source/script.h | 1561 | // in case it calls any functions that have side-effects, e.g. "return LogThisError()". | COMMENT |
| LOW | source/script.h | 1581 | // ToolTip, O, ((cos(A_Index) * 500) + 500), A_Index | COMMENT |
| LOW | source/script_gui.h | 21 | COMMENT | |
| LOW | source/script_gui.h | 101 | // Keep any fields that are smaller than 4 bytes adjacent to each other. This conserves memory | COMMENT |
| LOW | source/script_gui.h | 161 | return TypeHasAttrib(TYPE_SUPPORTS_BGTRANS); | COMMENT |
| LOW | source/script_gui.h | 361 | class GuiType : public Object | COMMENT |
| 741 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | source/script_object.h | 21 | // Used by Object, but defined here on (x64 builds only) to utilize the space | COMMENT |
| LOW | source/script_com.cpp | 1828 | // - foo.bar() and foo.bar[] in C#. There's no way to differentiate, so we just use METHOD | COMMENT |
| MEDIUM | source/defines.h | 189 | #define YIELDS_AN_OPERAND(symbol) ((symbol) < SYM_OPAREN) // CPAREN also covers the tail end of a function call. Post-i | COMMENT |
| MEDIUM | source/defines.h | 189 | #define YIELDS_AN_OPERAND(symbol) ((symbol) < SYM_OPAREN) // CPAREN also covers the tail end of a function call. Post-i | COMMENT |
| MEDIUM | source/script_gui.cpp | 1033 | // script is unable to alternate between tab controls and still utilize autosizing. | COMMENT |
| MEDIUM | source/script_gui.cpp | 3654 | // control types won't utilize the extra space (they are apparently clipped according | COMMENT |
| MEDIUM | source/script_gui.cpp | 11012 | // maintainable/robust (plus LV_GeneralSort() relies on us to do this check). | COMMENT |
| MEDIUM | source/script_object.cpp | 2551 | if (si->nested_object_size < sizeof(Object)) // Definitely no constructible properties defined by aBase. | CODE |
| MEDIUM | source/script_object.cpp | 3379 | // this PropEnum. Other callers must utilize aMemToFree for strings (which would | COMMENT |
| MEDIUM | source/script_autoit.cpp | 524 | // utilize the notification in that case (e.g. Notepad's Save As dialog). | COMMENT |
| MEDIUM | source/lib/drive.cpp | 40 | // support within the OS is improved in future, callers can utilize it. | COMMENT |