Home / HabitRPG / habitica
AI Slop Code RIsk Monitor

HabitRPG/habitica

A habit tracker app which treats your goals like a Role Playing Game.

14.4 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for HabitRPG/habitica, a JavaScript project with 14,201 GitHub stars. SynthScan examined 541,144 lines of code across 2767 source files, recording 812 pattern matches distributed across 5 syntactic categories. The legacy adjusted pattern signal is 14.4 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

14.4
Adjusted Signal
14.4
Raw Pattern Score
100%
Time Factor
2026-10-05
Last Push
14.2K
Stars
JavaScript
Language
541.1K
Lines of Code
2.8K
Files
812
Pattern Hits
2026-10-12
Scan Date
0.26
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 0.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 90 finding(s).

Hallucinated Dependency & Supply Chain Risk 50.8/100 · HIGH

Are imports declared and package/API names verified? 722 finding(s).

Agent Over-Engineering Ratio 0.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 77 finding(s).

PR Review Velocity Impact 48.9/100 · MEDIUM

Which changes need focused human review? 812 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 717HIGH 0MEDIUM 0LOW 95

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 812 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators717 hits · 7675 pts
SeverityFileLineSnippetContext
CRITICAL⚡test/api/unit/models/group.test.js687 await expect(Group.validateInvitations({}, res)).to.eventually.be.rejected.and.eql({CODE
CRITICAL⚡test/api/unit/models/group.test.js697 await expect(Group.validateInvitations({ uuids: 'user-id' }, res)).to.eventually.be.rejected.and.eql({CODE
CRITICAL⚡test/api/unit/models/group.test.js707 await expect(Group.validateInvitations({ emails: 'user@example.com' }, res)).to.eventually.be.rejected.and.eql({CODE
CRITICALtest/api/unit/models/group.test.js718 .to.eventually.be.rejected.and.eql({CODE
CRITICALtest/api/unit/models/group.test.js729 .to.eventually.be.rejected.and.eql({CODE
CRITICALtest/api/unit/models/group.test.js740 .to.eventually.be.rejected.and.eql({CODE
CRITICALtest/api/unit/models/group.test.js761 .to.eventually.be.rejected.and.eql({CODE
CRITICALtest/api/unit/models/group.test.js1232 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/models/group.test.js1248 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/google.test.js63 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/google.test.js79 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/google.test.js93 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/google.test.js201 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/google.test.js213 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/google.test.js284 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/google.test.js297 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/google.test.js374 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/google.test.js402 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js73 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js85 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js95 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js115 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js269 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js292 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js501 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js525 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js551 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js591 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js640 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js655 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/apple.test.js668 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/cancel.test.js104 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/cancel.test.js139 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/cancel.test.js150 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/subscribe.test.js129 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/subscribe.test.js144 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/subscribe.test.js162 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/subscribe.test.js188 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/checkout.test.js152 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/checkout.test.js164 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/amazon/checkout.test.js176 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…api/unit/libs/payments/paypal/subscribe-cancel.test.js66 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…api/unit/libs/payments/paypal/subscribe-cancel.test.js75 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…api/unit/libs/payments/paypal/subscribe-cancel.test.js86 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/paypal/subscribe.test.js35 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/paypal/subscribe.test.js54 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/paypal/checkout.test.js80 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/paypal/checkout.test.js92 .to.eventually.be.rejected.and.to.eql({CODE
CRITICALtest/api/unit/libs/payments/paypal/checkout.test.js103 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…ibs/payments/group-plans/group-payments-create.test.js133 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…ibs/payments/group-plans/group-payments-cancel.test.js153 .eventually.be.rejected.and.to.eql({CODE
CRITICAL…/api/unit/libs/payments/stripe/oneTimePayments.test.js34 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…/api/unit/libs/payments/stripe/oneTimePayments.test.js44 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…/api/unit/libs/payments/stripe/oneTimePayments.test.js63 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…/api/unit/libs/payments/stripe/oneTimePayments.test.js84 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…/api/unit/libs/payments/stripe/oneTimePayments.test.js103 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…/api/unit/libs/payments/stripe/oneTimePayments.test.js197 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…/api/unit/libs/payments/stripe/oneTimePayments.test.js209 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL…/api/unit/libs/payments/stripe/oneTimePayments.test.js229 .to.eventually.be.rejected.and.to.eql({CODE
CRITICAL⚡…st/api/unit/libs/payments/stripe/subscriptions.test.js31 .to.eventually.be.rejected.and.to.eql({CODE
657 more matches not shown…
Hyper-Verbose Identifiers77 hits · 78 pts
SeverityFileLineSnippetContext
LOWtest/api/unit/middlewares/blocker.test.js12function checkIPBlockedErrorThrown (next) {CODE
LOWtest/api/unit/middlewares/blocker.test.js19function checkClientBlockedErrorThrown (next) {CODE
LOWtest/api/unit/libs/payments/paymentHelpers.js3export async function createNonLeaderGroupMember (group) { // eslint-disable-line import/prefer-default-export, max-lenCODE
LOWtest/api/unit/libs/payments/amazon/cancel.test.js29 function expectAmazonCancelSubscriptionSpy (groupId, lastBillingDate) {CODE
LOW⚡test/api/unit/libs/payments/amazon/cancel.test.js40 function expectAmazonCancelUserSubscriptionSpy () {CODE
LOW⚡test/api/unit/libs/payments/amazon/cancel.test.js45 function expectAmazonCancelGroupSubscriptionSpy (groupId) {CODE
LOW⚡test/api/unit/libs/payments/amazon/cancel.test.js50 function expectBillingAggreementDetailSpy () {CODE
LOWtest/api/unit/libs/payments/amazon/subscribe.test.js74 function expectAmazonAuthorizeBillingAgreementSpy () {CODE
LOWtest/api/unit/libs/payments/amazon/subscribe.test.js94 function expectAmazonSetBillingAgreementDetailsSpy () {CODE
LOW…ration/quests/POST-groups_groupid_quests_leave.test.js92 async function letPartyMemberLeaveAndCheckChanges (partyMember) {CODE
LOWtest/helpers/content.helper.js10export function expectValidTranslationString (attribute, contextKey) {CODE
LOWwebsite/server/middlewares/auth.js168 return function chatPrivilegesRequiredHandler (req, res, next) {CODE
LOWwebsite/server/middlewares/domain.js5export default function implementDomainMiddleware (server, mongoose) {CODE
LOWwebsite/server/models/pushDevice.js29schema.statics.cleanupCorruptData = function cleanupCorruptPushDevicesData (pushDevices) {CODE
LOWwebsite/server/models/newsPost.js82function getAndUpdateLastNewsPost () {CODE
LOWwebsite/server/models/task.js254TaskSchema.statics.sanitizeUserChallengeTask = function sanitizeUserChallengeTask (taskObj) {CODE
LOWwebsite/server/models/userNotification.js127schema.statics.cleanupCorruptData = function cleanupCorruptNotificationsData (notifications) {CODE
LOWwebsite/server/models/group.js516schema.methods.getParticipatingQuestMembers = function getParticipatingQuestMembers () {CODE
LOWwebsite/server/models/group.js868schema.methods.sendGroupChatReceivedWebhooks = function sendGroupChatReceivedWebhooks (chat) {CODE
LOWwebsite/server/models/user/methods.js93schema.methods.getObjectionsToInteraction = function getObjectionsToInteraction (interaction, receiver) { // eslint-disaCODE
LOWwebsite/server/models/user/methods.js326schema.statics.addComputedStatsToJSONObj = function addComputedStatsToUserJSONObj (CODE
LOWwebsite/server/libs/mongodb.js14export function getDevelopmentConnectionUrl (originalConnectionUrl) {CODE
LOWwebsite/server/libs/mongodb.js25export function getDefaultConnectionOptions () {CODE
LOWwebsite/server/libs/stringUtils.js5export function removePunctuationFromString (str) {CODE
LOWwebsite/server/libs/cron.js58function removeTerminatedSubscription (user) {CODE
LOWwebsite/server/libs/password.js70export async function validatePasswordResetCodeAndFindUser (code) {CODE
LOWwebsite/server/libs/slack.js115function sendInboxFlagNotification ({CODE
LOWwebsite/server/libs/slack.js179function sendChallengeFlagNotification ({CODE
LOWwebsite/server/libs/slack.js214function sendProfileFlagNotification ({CODE
LOWwebsite/server/libs/slack.js251function sendSubscriptionNotification ({CODE
LOWwebsite/server/libs/slack.js283function sendShadowMutedPostNotification ({CODE
LOWwebsite/server/libs/slack.js328function sendProfileSlurNotification ({CODE
LOWwebsite/server/libs/slack.js361function sendChallengeSlurNotification ({CODE
LOWwebsite/server/libs/content.js83export function getLocalizedContentResponse (langCode, removedKeys = {}) {CODE
LOWwebsite/server/libs/chat.js5export async function getAuthorEmailFromMessage (message) {CODE
LOWwebsite/server/libs/chat.js20export async function sendChatPushNotifications (user, group, message, mentions, translate) {CODE
LOWwebsite/server/libs/language.js17function checkForApplicableLanguageVariant (originalLanguageOptions) {CODE
LOWwebsite/server/libs/email.js165export function convertVariableObjectToArray (variableObject) {CODE
LOWwebsite/server/libs/payments/subscriptions.js72async function prepareSubscriptionValues (data) {CODE
LOWwebsite/server/libs/payments/subscriptions.js468async function handleSubscriptionRenewal (customerId) {CODE
LOWwebsite/server/libs/payments/paypal.js227api.getSubscriptionPaymentDetails = async function getSubscriptionPaymentDetails (options = {}) {CODE
LOW…/libs/payments/calculateSubscriptionTerminationDate.js6export default function calculateSubscriptionTerminationDate (CODE
LOWwebsite/server/libs/payments/groupPayments.js36async function addSubscriptionToGroupUsers (group) {CODE
LOWwebsite/server/libs/payments/groupPayments.js207async function cancelGroupUsersSubscription (group) {CODE
LOWwebsite/server/libs/payments/groupPayments.js221async function cancelGroupSubscriptionForUser (user, group, userWasRemoved = false) {CODE
LOWwebsite/server/libs/payments/amazon.js81api.authorizeOnBillingAgreement = function authorizeOnBillingAgreement (inputSet) {CODE
LOWwebsite/server/libs/payments/amazon.js367api.chargeForAdditionalGroupMember = async function chargeForAdditionalGroupMember (group) {CODE
LOWwebsite/server/libs/payments/stripe/subscriptions.js36export async function getSubscriptionPaymentDetails (user) {CODE
LOWwebsite/server/libs/payments/stripe/subscriptions.js81export async function handlePaymentMethodChange (session, stripeInc) {CODE
LOWwebsite/server/libs/payments/stripe/subscriptions.js99export async function chargeForAdditionalGroupMember (group, stripeInc) {CODE
LOWwebsite/server/libs/payments/stripe/checkout.js129export async function createEditCardCheckoutSession (options, stripeInc) {CODE
LOWwebsite/server/libs/tasks/index.js328function groupSubscriptionNotFound (group) {CODE
LOWwebsite/server/libs/inbox/index.js123export async function getInboxMessagesByUniqueId (uniqueMessageId) {CODE
LOW…server/libs/challenges/handleGetMembersForChallenge.js12async function getMembersTasksForChallenge (members, challenge) {CODE
LOW…server/libs/challenges/handleGetMembersForChallenge.js24export async function handleGetMembersForChallenge (req, res) {CODE
LOWwebsite/server/libs/challenges/index.js21export function addUserJoinChallengeNotification (user) {CODE
LOWwebsite/server/libs/challenges/index.js27export function getChallengeGroupResponse (group) {CODE
LOWwebsite/server/libs/user/validation.js36function usernameContainsInvalidCharacters (username) {CODE
LOWwebsite/server/libs/invites/index.js20async function sendInvitePushNotification (userToInvite, groupLabel, group, publicGuild, res) {CODE
LOWwebsite/server/controllers/api-v3/quests.js27function canStartQuestAutomatically (group) {CODE
17 more matches not shown…
Over-Commented Block12 hits · 12 pts
SeverityFileLineSnippetContext
LOWtest/helpers/api-integration/v4/object-generators.js101COMMENT
LOWtest/helpers/api-integration/v3/object-generators.js101 'x-client': 'habitica-web',COMMENT
LOWwebsite/server/models/user/methods.js421 now,COMMENT
LOWwebsite/server/models/user/methods.js441 // console.log("zone has changed - old zone says run cron,COMMENT
LOWwebsite/server/models/user/methods.js461 // NB: We don't change this.auth.timestamps.loggedin so that will still recordCOMMENT
LOWwebsite/server/libs/bannedWords.js1/* eslint-disable no-multiple-empty-lines */COMMENT
LOWwebsite/server/libs/bannedWords.js61// Legitimate place names: 'Dyke'COMMENT
LOWwebsite/server/libs/bannedSlurs.js1/* eslint-disable no-multiple-empty-lines */COMMENT
LOWwebsite/server/libs/payments/paypal.js41 client_secret: nconf.get('PAYPAL_CLIENT_SECRET'),COMMENT
LOWwebsite/server/libs/payments/stripe/constants.js1export default {COMMENT
LOWwebsite/client/src/components/hall/heroes.vue381 // let questsFormat = this.getFormattedItemReferenceCOMMENT
LOWwebsite/client/src/components/hall/heroes.vue401 // .{head/headAccessory/eyewear/armor/body/back/shield/weapon}.{gearKey}\n';COMMENT
Fake / Example Data5 hits · 6 pts
SeverityFileLineSnippetContext
LOW⚡test/api/unit/models/group.test.js707 await expect(Group.validateInvitations({ emails: 'user@example.com' }, res)).to.eventually.be.rejected.and.eql({CODE
LOWwebsite/client/src/components/ui/validatedTextInput.vue35 :placeholder="placeholder"CODE
LOW…ponents/tasks/modal-controls/selectTranslatedArray.vue12 :placeholder="placeholder"CODE
LOWwebsite/client/src/components/groups/chat.vue22 :placeholder="placeholder"CODE
LOWwebsite/client/src/components/groups/chat.vue119 props: ['label', 'group', 'placeholder'],CODE
Verbosity Indicators1 hit · 2 pts
SeverityFileLineSnippetContext
LOWwebsite/server/libs/email.js95 // as we need to check if he unsubscribedCOMMENT