2.6

Adjusted Signal

2.6

Raw Pattern Score

100%

Time Factor

2026-10-22

Last Push

7.5K

Stars

Language

338.3K

Lines of Code

873

Files

817

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 771 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.3/100 · LOW

Are imports declared and package/API names verified? 23 finding(s).

Agent Over-Engineering Ratio 2.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 121 finding(s).

PR Review Velocity Impact 12.4/100 · LOW

Which changes need focused human review? 817 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 11MEDIUM 13LOW 793

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 817 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block648 hits · 642 pts

Severity	File	Line	Snippet	Context
LOW	INSTALL-cross-linux-arm64.md	121	#	COMMENT
LOW	INSTALL-cross-linux-arm64.md	141	#	COMMENT
LOW	sigtool/sigtool.c	21	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,	COMMENT
LOW	sigtool/sigtool.c	41		COMMENT
LOW	sigtool/sigtool.c	61	#include "clamav_rust.h"	COMMENT
LOW	sigtool/vba.c	21	#include "clamav-config.h"	COMMENT
LOW	libclammspack/mspack/readbits.h	81		COMMENT
LOW	libclammspack/mspack/oab.h	41	#define oabblk_CompSize (0x0004)	COMMENT
LOW	libclammspack/mspack/mszipd.c	21	#define BITS_ORDER_LSB	COMMENT
LOW	libclammspack/mspack/lzx.h	21		COMMENT
LOW	libclammspack/mspack/mszip.h	21		COMMENT
LOW	libclammspack/mspack/chm.h	21	#define chmhead_Timestamp (0x0010)	COMMENT
LOW	libclammspack/mspack/chm.h	41		COMMENT
LOW	libclammspack/mspack/chm.h	61		COMMENT
LOW	libclammspack/mspack/chm.h	81	#define lzxcd_Unknown1 (0x0018)	COMMENT
LOW	libclammspack/mspack/macros.h	21	#endif	COMMENT
LOW	libclammspack/mspack/macros.h	41	#define EndGetM32(a) (((unsigned int) ((unsigned char *)(a))[0] << 24) \| \	COMMENT
LOW	libclammspack/mspack/macros.h	61	# define D(x)	COMMENT
LOW	libclammspack/mspack/readhuff.h	21	#if !(defined(HUFF_TABLE) && defined(HUFF_LEN))	COMMENT
LOW	libclammspack/mspack/kwaj.h	61	#if KWAJ_TABLESIZE < (KWAJ_MATCHLEN1_SYMS * 2)	COMMENT
LOW	libclammspack/mspack/cab.h	21	#define cfhead_NumFolders (0x1A)	COMMENT
LOW	libclammspack/mspack/cab.h	41	#define cffile_SIZEOF (0x10)	COMMENT
LOW	libclammspack/mspack/lzxd.c	81		COMMENT
LOW	libclammspack/test/kwajd_test.c	1	/* KWAJ regression test suite */	COMMENT
LOW	libclammspack/test/md5.h	41	typedef uintptr_t md5_uintptr;	COMMENT
LOW	libclammspack/test/md5.h	61	# if USHRT_MAX == UINT_MAX_32_BITS	COMMENT
LOW	libclammspack/test/md5.h	161	}	COMMENT
LOW	libclammspack/test/chmd_test.c	1	/* CHM regression test suite */	COMMENT
LOW	libclammspack/test/cabd_test.c	1	/* cabinet decompression regression test suite */	COMMENT
LOW	libclammspack/test/cabd_md5.c	1	#ifdef HAVE_CONFIG_H	COMMENT
LOW	libclammspack/test/md5.c	21	/* Written by Ulrich Drepper <drepper@gnu.ai.mit.edu>, 1995. */	COMMENT
LOW	libclammspack/test/md5.c	41	# define md5_process_block __md5_process_block	COMMENT
LOW	libclammspack/examples/chmextract.c	1	#ifdef HAVE_CONFIG_H	COMMENT
LOW	libclammspack/examples/cabrip.c	1	#ifdef HAVE_CONFIG_H	COMMENT
LOW	clamscan/manager.c	21	*/	COMMENT
LOW	clamscan/manager.c	41	#include <sys/resource.h>	COMMENT
LOW	clamscan/manager.c	61	// common	COMMENT
LOW	clamscan/clamscan.c	21		COMMENT
LOW	clamscan/clamscan.c	41	#endif	COMMENT
LOW	cmake/CheckFDPassing.c	1	#ifdef HAVE_SYS_TYPES_H	COMMENT
LOW	unit_tests/check_disasm.c	21	* MA 02110-1301, USA.	COMMENT
LOW	unit_tests/check_clamav.c	1	#if HAVE_CONFIG_H	COMMENT
LOW	unit_tests/check_clamav.c	21		COMMENT
LOW	unit_tests/check_clamav.c	141	// cvd2->dsig= malloc(1);	COMMENT
LOW	unit_tests/check_jsnorm.c	21	* MA 02110-1301, USA.	COMMENT
LOW	unit_tests/testcase.py	181	# cls.log.info(f" clamd: {cls.clamd}")	COMMENT
LOW	unit_tests/check_clamd.c	21	* MA 02110-1301, USA.	COMMENT
LOW	unit_tests/check_clamd.c	41	#include <winsock2.h>	COMMENT
LOW	unit_tests/check_matchers.c	21	#if HAVE_CONFIG_H	COMMENT
LOW	unit_tests/check_bytecode.c	21	* MA 02110-1301, USA.	COMMENT
LOW	unit_tests/check_htmlnorm.c	21	* MA 02110-1301, USA.	COMMENT
LOW	unit_tests/check_regex.c	21	* MA 02110-1301, USA.	COMMENT
LOW	unit_tests/check_str.c	21	* MA 02110-1301, USA.	COMMENT
LOW	unit_tests/clamscan/allmatch_test.py	141	# TARGET(0)	COMMENT
LOW	unit_tests/input/pe_allmatch/test-exe-src/build.py	1	#!/bin/env python3	COMMENT
LOW	unit_tests/input/pe_allmatch/test-exe-src/extract.h	1	#include <stdio.h>	COMMENT
LOW	unit_tests/input/pe_allmatch/test-exe-src/extract.h	21	#define DO8(X) DO7(X) X(8)	COMMENT
LOW	unit_tests/input/pe_allmatch/test-exe-src/extract.h	41	#define DO28(X) DO27(X) X(28)	COMMENT
LOW	unit_tests/input/pe_allmatch/test-exe-src/test.c	1	#include <stdio.h>	COMMENT
LOW	…ests/input/embedded_testfiles/emb/smol_exe/src/main.rs	1	#![no_std]	COMMENT
588 more matches not shown…

Hyper-Verbose Identifiers98 hits · 92 pts

Severity	File	Line	Snippet	Context
LOW	unit_tests/testcase.py	37	def _get_valgrind_track_fds_mode(valgrind):	CODE
LOW	unit_tests/clamsubmit_test.py	225	def test_false_negative_workflow_with_acl(self):	CODE
LOW	unit_tests/clamsubmit_test.py	256	def test_false_positive_workflow_without_acl(self):	CODE
LOW	unit_tests/clamsubmit_test.py	283	def test_http_failures_stop_at_failing_stage(self):	CODE
LOW	unit_tests/clamsubmit_test.py	297	def test_invalid_presigned_responses(self):	CODE
LOW	unit_tests/clamsubmit_test.py	362	def test_oversized_presigned_response(self):	CODE
LOW	unit_tests/clamsubmit_test.py	368	def test_bad_submission_redirects(self):	CODE
LOW	unit_tests/clamsubmit_test.py	385	def test_missing_token_fails_cleanly(self):	CODE
LOW	unit_tests/clamsubmit_test.py	392	def test_missing_page_csrf_token_fails_cleanly(self):	CODE
LOW	unit_tests/clamsubmit_test.py	404	def test_empty_report_form_fails_cleanly(self):	CODE
LOW	unit_tests/clamsubmit_test.py	411	def test_debug_output_redacts_sensitive_values(self):	CODE
LOW	unit_tests/clamd_test.py	253	def run_clamdscan_fdpass_only(self,	STRING
LOW	unit_tests/freshclam_test.py	826	def start_mock_database_mirror(handler):	STRING
LOW	unit_tests/freshclam_test.py	868	def create_mock_database_mirror_server(handler, port):	STRING
LOW	unit_tests/clamscan/hash_and_file_type_test.py	274	def test_html_file_type_tag_signatures_require_tag_boundary(self):	CODE
LOW	unit_tests/clamscan/assorted_test.py	169	def test_pe_cert_trust_archive(self):	CODE
LOW	unit_tests/clamscan/assorted_test.py	366	def test_cvdload_no_sign_fips_limits(self):	CODE
LOW	unit_tests/clamscan/container_sigs_test.py	84	def test_clamscan_container_cache(self):	CODE
LOW	unit_tests/clamscan/container_sigs_test.py	166	def test_handler_type_does_not_alert_on_retyped_layer(self):	CODE
LOW	unit_tests/clamscan/container_sigs_test.py	194	def test_handler_type_retyped_layer_is_not_cached(self):	CODE
LOW	unit_tests/clamscan/heuristics_test.py	50	def test_hidden_by_strong_indicator(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	86	def _can_create_directory_symlink(parent_dir: Path):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	102	def _create_directory_redirect(link_path: Path, target_path: Path):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	121	def _remove_directory_redirect(link_path: Path):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	194	def _exercise_quarantine_directory_replacement(self, action_mode: str):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	315	def _exercise_source_link_quarantine(self, action_mode: str):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	379	def _exercise_source_hardlink_quarantine(self, action_mode: str):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	435	def _exercise_source_link_replacement_quarantine(self, action_mode: str, attempt: int):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	550	def _exercise_source_link_replacement_until_infected(self, action_mode: str):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	564	def _exercise_search_only_quarantine_directory(self, action_mode: str):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	622	def test_quarantine_directory_replacement_does_not_redirect_copy_target(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	659	def test_quarantine_directory_replacement_does_not_redirect_move_target(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	704	def test_quarantine_copy_uses_real_source_path_for_symlink_source(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	722	def test_quarantine_move_uses_real_source_path_for_symlink_source(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	738	def test_quarantine_remove_uses_real_source_path_for_symlink_source(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	752	def test_quarantine_move_unlinks_submitted_hardlink(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	768	def test_quarantine_remove_unlinks_submitted_hardlink(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	778	def test_quarantine_copy_does_not_act_on_replaced_source_link(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	795	def test_quarantine_move_does_not_act_on_replaced_source_link(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	812	def test_quarantine_remove_does_not_act_on_replaced_source_link(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	826	def test_quarantine_copy_allows_search_only_destination_dir(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	839	def test_quarantine_move_allows_search_only_destination_dir(self):	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	852	def test_quarantine_copy_preserves_xattr(self):	CODE
LOW	unit_tests/clamscan/fp_check_test.py	97	def test_alerts_on_normalized(self):	STRING
LOW	unit_tests/clamscan/fp_check_test.py	185	def test_fp_for_normalized_wild(self):	STRING
LOW	unit_tests/clamscan/fp_check_test.py	203	def test_fp_for_nonnormalized(self):	STRING
LOW	unit_tests/clamscan/fp_check_test.py	220	def test_fp_for_nonnormalized_wild(self):	STRING
LOW	unit_tests/clamscan/fp_check_test.py	253	def test_fp_for_zipped_file_wild(self):	STRING
LOW	unit_tests/clamscan/ole2_encryption_test.py	94	def test_ministream_doc_metadata(self):	CODE
LOW	unit_tests/clamscan/ole2_encryption_test.py	173	def test_ministream_docx_metadata(self):	CODE
LOW	unit_tests/clamscan/ole2_encryption_test.py	251	def test_ministream_dot_metadata(self):	CODE
LOW	unit_tests/clamscan/ole2_encryption_test.py	329	def test_ministream_ppsx_metadata(self):	CODE
LOW	unit_tests/clamscan/ole2_encryption_test.py	407	def test_ministream_pptx_metadata(self):	CODE
LOW	unit_tests/clamscan/ole2_encryption_test.py	485	def test_ministream_xls_metadata(self):	CODE
LOW	unit_tests/clamscan/ole2_encryption_test.py	563	def test_ministream_xlsx_metadata(self):	CODE
LOW	unit_tests/clamscan/allmatch_test.py	91	def test_many_sigs_no_allmatch(self):	CODE
LOW	unit_tests/clamscan/allmatch_test.py	107	def test_regression_imphash_nosize(self):	CODE
LOW	unit_tests/clamscan/allmatch_test.py	134	def test_regression_cbc_and_ndb(self):	CODE
LOW	unit_tests/clamscan/allmatch_test.py	188	def test_txt_plus_clam_zipsfx(self):	CODE
LOW	unit_tests/clamscan/allmatch_test.py	213	def test_exe_imphash_plus_zipsfx(self):	CODE
38 more matches not shown…

Empty Error Handlers11 hits · 55 pts

Severity	File	Line	Snippet	Context
HIGH	unit_tests/testcase.py	220	except Exception:	CODE
HIGH	unit_tests/clamsubmit_test.py	91	except BrokenPipeError:	CODE
HIGH	unit_tests/clamd_test.py	138	except Exception:	CODE
HIGH	unit_tests/clamd_test.py	142	except Exception:	CODE
HIGH	unit_tests/clamd_test.py	969	except Exception:	CODE
HIGH	unit_tests/clamd_test.py	973	except Exception:	CODE
HIGH	unit_tests/freshclam_test.py	83	except Exception:	CODE
HIGH	unit_tests/freshclam_test.py	90	except Exception:	CODE
HIGH	unit_tests/clamscan/quarantine_toctou_test.py	284	except FileNotFoundError:	CODE
HIGH	unit_tests/clamscan/quarantine_toctou_test.py	523	except FileNotFoundError:	CODE
HIGH	unit_tests/input/pe_allmatch/test-exe-src/build.py	223	except:	CODE

Unused Imports23 hits · 23 pts

Severity	File	Line	Context
LOW	unit_tests/sigtool_test.py	8	CODE
LOW	unit_tests/sigtool_test.py	11	CODE
LOW	unit_tests/sigtool_test.py	12	CODE
LOW	unit_tests/sigtool_test.py	13	CODE
LOW	unit_tests/libclamav_test.py	7	CODE
LOW	unit_tests/libclamav_test.py	8	CODE
LOW	unit_tests/libclamav_test.py	10	CODE
LOW	unit_tests/libclamav_test.py	11	CODE
LOW	unit_tests/libclamav_test.py	12	CODE
LOW	unit_tests/libclamav_test.py	13	CODE
LOW	unit_tests/clamscan/save_pdf_uris_test.py	9	CODE
LOW	unit_tests/clamscan/embedded_files_test.py	8	CODE
LOW	unit_tests/clamscan/embedded_files_test.py	8	CODE
LOW	unit_tests/clamscan/assorted_test.py	8	CODE
LOW	unit_tests/clamscan/fp_check_test.py	7	CODE
LOW	unit_tests/clamscan/ole2_encryption_test.py	9	CODE
LOW	unit_tests/clamscan/pdf_stats_test.py	9	CODE
LOW	unit_tests/clamscan/save_html_uris_test.py	9	CODE
LOW	unit_tests/clamscan/match_offsets_test.py	7	CODE
LOW	unit_tests/examples/ex_scan_callbacks_test.py	42	CODE
LOW	fuzz/run_fuzzer_tests.py	9	CODE
LOW	fuzz/run_fuzzer_tests.py	9	CODE
LOW	fuzz/run_fuzzer_tests.py	9	CODE

Self-Referential Comments7 hits · 17 pts

Severity	File	Line	Snippet	Context
MEDIUM	libclammspack/test/test_files/chmd/generate.pl	128	# Create a CHM with the filename "::" right at the end of a PMGL chunk	COMMENT
MEDIUM	libclammspack/test/test_files/chmd/generate.pl	146	# Create a CHM with entries containing unicode character U+100	COMMENT
MEDIUM	libclammspack/test/test_files/chmd/generate.pl	157	# Create a CHM with ENCINTs that go beyond what 32-bit architectures can handle	COMMENT
MEDIUM	libclammspack/test/test_files/chmd/generate.pl	164	# Create a CHM with ENCINTs that go beyond what 64-bit architectures can handle	COMMENT
MEDIUM	unit_tests/testcase.py	779	"""This class provides methods to check logs and strings."""	STRING
MEDIUM	unit_tests/sigtool_test.py	164	# Create a file to sign.	STRING
MEDIUM	unit_tests/clamscan/heuristics_test.py	24	# Create a ZIP that has two things:	COMMENT

AI Slop Vocabulary6 hits · 16 pts

Severity	File	Line	Snippet	Context
MEDIUM	libclammspack/mspack/readhuff.h	16	# error "readhuff.h is used in conjunction with readbits.h, include that first"	COMMENT
LOW	unit_tests/clamscan/_basic_test.py	81	# in our scan, we'll just use the whole directory, which should load the ignore db first.	COMMENT
MEDIUM	libclamunrar/secpassword.cpp	173	// Try to utilize the secure Crypt[Un]ProtectMemory if possible.	COMMENT
MEDIUM	libclamunrar/arcread.cpp	81	// If locator extra field is available for recovery record, let's utilize it.	COMMENT
MEDIUM	libclamav/mbox.c	1741	// ole2 recursion does not leverage the ctx->recursion_stack stack.	COMMENT
MEDIUM	libclamav/ole2_extract.c	902	// ole2 recursion does not leverage the ctx->recursion_stack stack.	COMMENT

Excessive Try-Catch Wrapping12 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	unit_tests/testcase.py	211	except Exception:	CODE
LOW	unit_tests/testcase.py	220	except Exception:	CODE
LOW	unit_tests/clamd_test.py	138	except Exception:	STRING
LOW	unit_tests/clamd_test.py	142	except Exception:	STRING
LOW	unit_tests/clamd_test.py	969	except Exception:	STRING
LOW	unit_tests/clamd_test.py	973	except Exception:	STRING
LOW	unit_tests/freshclam_test.py	83	except Exception:	CODE
LOW	unit_tests/freshclam_test.py	90	except Exception:	CODE
LOW	unit_tests/freshclam_test.py	848	except Exception:	STRING
LOW	unit_tests/freshclam_test.py	905	except Exception as e:	STRING
MEDIUM	unit_tests/input/xor_testfile.py	32	print("Error: Input file to be XOR'd does not exist: {}".format(in_file))	CODE
LOW	unit_tests/input/xor_testfile.py	61	except Exception as exc:	CODE

Deep Nesting9 hits · 8 pts

Severity	File	Line	Context
LOW	unit_tests/testcase.py	304	CODE
LOW	unit_tests/testcase.py	547	CODE
LOW	unit_tests/testcase.py	714	CODE
LOW	unit_tests/testcase.py	882	CODE
LOW	unit_tests/testcase.py	959	CODE
LOW	unit_tests/clamsubmit_test.py	67	CODE
LOW	unit_tests/clamsubmit_test.py	105	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	64	CODE
LOW	unit_tests/clamscan/quarantine_toctou_test.py	194	CODE

Redundant / Tautological Comments2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	unit_tests/testcase.py	160	# Check if Valgrind testing is requested	COMMENT
LOW	unit_tests/clamd_test.py	109	# Check if fdpassing is supported.	STRING

Verbosity Indicators1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	libclamav/scanners.c	5975	// If hash_hint is provided, we need to check if the hash_alg is valid.	COMMENT

Cisco-Talos/clamav

Open-Source Code Quality, Security and Technical Debt Review