1.8

Adjusted Signal

1.8

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

12.7K

Stars

JavaScript

Language

312.5K

Lines of Code

1.2K

Files

246

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 126 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.8/100 · LOW

Are imports declared and package/API names verified? 49 finding(s).

Agent Over-Engineering Ratio 3.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 107 finding(s).

PR Review Velocity Impact 7.9/100 · LOW

Which changes need focused human review? 246 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 12HIGH 3MEDIUM 73LOW 158

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 246 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators52 hits · 182 pts

Severity	File	Line	Snippet	Context
MEDIUM	src/network-services-pentesting/pentesting-sap.md	107	# -------------	COMMENT
MEDIUM	src/AI/AI-Deep-Learning.md	264	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	src/AI/AI-Deep-Learning.md	266	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	src/AI/AI-Deep-Learning.md	278	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	src/AI/AI-Deep-Learning.md	280	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	src/AI/AI-Deep-Learning.md	309	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	src/AI/AI-Deep-Learning.md	311	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	src/AI/AI-Deep-Learning.md	320	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	src/AI/AI-Deep-Learning.md	322	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	src/AI/AI-Deep-Learning.md	329	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	src/AI/AI-Deep-Learning.md	331	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	src/AI/AI-Deep-Learning.md	366	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	src/AI/AI-Deep-Learning.md	368	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	src/AI/AI-Unsupervised-Learning-Algorithms.md	372	# 1 ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Unsupervised-Learning-Algorithms.md	377	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Unsupervised-Learning-Algorithms.md	408	# 2 ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Unsupervised-Learning-Algorithms.md	410	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Unsupervised-Learning-Algorithms.md	414	# 3 ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Unsupervised-Learning-Algorithms.md	416	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Unsupervised-Learning-Algorithms.md	427	# 4 ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Unsupervised-Learning-Algorithms.md	429	# ──────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	104	# ── 2. Load data without header row ─────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	111	# ── 3. Encode the 3 nominal features ─────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	118	# ── 4. Prepare features / target ─────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	125	# ── 5. Train & evaluate simple Linear Regression ─────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	542	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	545	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	550	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	555	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	563	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	565	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	570	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	575	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	580	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	582	# ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	979	# ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	981	# ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	984	# ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	src/AI/AI-Supervised-Learning-Algorithms.md	986	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	89	# ── 1. Column names taken from the NSL‑KDD documentation ──────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	418	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	421	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	442	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	444	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	462	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	464	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	482	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	484	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	939	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	941	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	953	# ──────────────────────────────────────────────	COMMENT
MEDIUM	src/AI/AI-Supervised-Learning-Algorithms.md	958	# ──────────────────────────────────────────────	COMMENT

Hallucination Indicators12 hits · 135 pts

Severity	File	Line	Snippet	Context
CRITICAL	…web/ssti-server-side-template-injection/jinja2-ssti.md	215	{% with a = config.__class__.from_envvar.__globals__.__builtins__.__import__("os").popen("id").read() %}{{ a }}{% endwit	CODE
CRITICAL	…web/ssti-server-side-template-injection/jinja2-ssti.md	216	{% if config.__class__.from_envvar.__globals__.__builtins__.__import__("os").popen("id").read().startswith("uid=") %}yes	CODE
CRITICAL	…web/ssti-server-side-template-injection/jinja2-ssti.md	372	{{ request.__class__._load_form_data.__globals__.__builtins__.open("/etc/passwd").read() }}	CODE
CRITICAL	…web/ssti-server-side-template-injection/jinja2-ssti.md	375	{{ config.__class__.from_envvar.__globals__.__builtins__.__import__("os").popen("ls").read() }}	CODE
CRITICAL	…ting-web/ssti-server-side-template-injection/README.md	494	{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=ne	CODE
CRITICAL	…ting-web/ssti-server-side-template-injection/README.md	496	{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=ne	CODE
CRITICAL	…ting-web/ssti-server-side-template-injection/README.md	513	- `{{request.getClass().getDeclaredMethods()[0]}}` - public boolean com.hubspot.content.hubl.context.TemplateContextRequ	CODE
CRITICAL	…ting-web/ssti-server-side-template-injection/README.md	550	{{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\"var x=ne	CODE
CRITICAL	…ting-web/ssti-server-side-template-injection/README.md	554	Payload: {{'a'.getClass().forName('javax.script.ScriptEngineManager').newInstance().getEngineByName('JavaScript').eval(\	CODE
CRITICAL⚡	…ting-web/ssti-server-side-template-injection/README.md	1171	{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }}	CODE
CRITICAL⚡	…ting-web/ssti-server-side-template-injection/README.md	1172	{{ self._TemplateReference__context.joiner.__init__.__globals__.os.popen('id').read() }}	CODE
CRITICAL⚡	…ting-web/ssti-server-side-template-injection/README.md	1173	{{ self._TemplateReference__context.namespace.__init__.__globals__.os.popen('id').read() }}	CODE

Hyper-Verbose Identifiers34 hits · 45 pts

Severity	File	Line	Snippet	Context
LOW	theme/sponsor.js	237	function renderLegacyBottomSponsor(sponsor) {	CODE
LOW	theme/book.js	20	(function openContentLinksInNewTabs() {	CODE
LOW⚡	scripts/test_merge_approved_prs.py	23	def test_only_the_authorized_whole_comment_approves(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	29	def test_comments_on_issues_do_not_trigger_merging(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	36	def test_completion_wakes_the_merger_but_its_own_completion_does_not(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	48	def test_research_title_exception_is_limited_to_the_authorized_author(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	56	def test_translator_capacity_allows_one_running_and_no_waiting(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	65	def test_translator_capacity_blocks_queued_language_job(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	74	def test_translator_capacity_fails_closed_if_language_jobs_are_missing(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	84	def test_translator_capacity_blocks_any_queued_run_or_two_running(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	93	def test_translator_capacity_fails_closed_on_bad_api_response(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	98	def test_failed_reads_and_invalid_json_are_not_treated_as_idle(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	131	def test_comment_event_handles_its_pr_without_scanning_the_queue(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	136	def test_batch_limit_is_respected(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	141	def test_busy_translator_prevents_merge(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	146	def test_closed_draft_and_conflicting_prs_are_skipped(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	155	def test_unknown_mergeability_uses_server_side_merge_guard(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	162	def test_comment_verification_failure_never_merges(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	171	def test_paginated_comments_can_authorize_a_pr(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	178	def test_approval_queue_is_requested_oldest_first_on_every_page(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	183	def test_unknown_mergeability_is_rechecked(self):	CODE
LOW⚡	scripts/test_merge_approved_prs.py	190	def test_head_change_during_merge_is_rejected(self):	CODE
LOW	scripts/test_mark_unchanged_s3_files.py	30	def test_only_byte_identical_single_part_objects_are_aged(self) -> None:	CODE
LOW⚡	scripts/test_mark_unchanged_s3_files.py	60	def test_rejects_absolute_remote_prefix(self) -> None:	CODE
LOW⚡	scripts/test_mark_unchanged_s3_files.py	65	def test_empty_manifest_for_new_language_prefix(self) -> None:	CODE
LOW⚡	scripts/test_mark_unchanged_s3_files.py	70	def test_rejects_non_list_contents(self) -> None:	CODE
LOW	scripts/seo_postprocess.py	350	def update_language_menu_links(document, rel_path, languages):	CODE
LOW	scripts/seo_postprocess.py	436	def generate_language_sitemap(book_dir, site_url, lang, languages, default_lang):	CODE
LOW	.github/actions/invalidation-needed/decide.py	38	def covering_run_is_handling_this_commit(repo, sha, token, workflows):	CODE
LOW	.github/actions/invalidation-needed/decide.py	57	def newer_run_of_this_workflow(repo, run_id, workflow_file, token):	CODE
LOW	.github/actions/invalidation-needed/decide.py	96	def pull_requests_awaiting_auto_merge(repo, token, author):	STRING
LOW	src/pentesting-web/saml-attacks/README.md	372	def intercept_and_redirect_saml_response(saml_response, sp_target_url):	CODE
LOW	…llm-architecture/6.-pre-training-and-loading-models.md	453	def generate_and_print_sample(model, tokenizer, device, start_context):	CODE
LOW	…llm-architecture/6.-pre-training-and-loading-models.md	838	def generate_and_print_sample(model, tokenizer, device, start_context):	CODE

Modern AI Meta-Vocabulary18 hits · 43 pts

Severity	File	Line	Snippet	Context
MEDIUM	…i-agent-mode-phishing-abusing-hosted-agent-browsers.md	179	- [1] [Lack of isolation in agentic browsers resurfaces old vulnerabilities (Trail of Bits)](https://blog.trailofbits.co	CODE
MEDIUM	…ensic-methodology/android-malware-post-exploitation.md	523	## Android Accessibility/Overlay & Device Admin Abuse, ATS automation, and NFC relay orchestration – RatOn case study	COMMENT
MEDIUM	…ensic-methodology/android-malware-post-exploitation.md	669	### NFC relay orchestration (NFSkate)	COMMENT
MEDIUM	…ric-methodologies-and-resources/pentesting-wifi/wps.md	138	# Use Wifite2's Bully backend to orchestrate the same Pixie Dust workflow.	COMMENT
MEDIUM	…android-app-pentesting/accessibility-services-abuse.md	338	## NFC-relay orchestration	COMMENT
MEDIUM	…-stack-binary-exploitation-methodology/tools/README.md	256	A debugger-created process stops at the loader's initial breakpoint before the executable's PE entry point; `bp @$exentr	CODE
MEDIUM	…exploitation/posix-cpu-timers-toctou-cve-2025-38352.md	262	### Practical PoC orchestration	COMMENT
MEDIUM	src/linux-hardening/post-exploitation/README.md	229	## Process-event-driven credential interception with `ptrace`	COMMENT
MEDIUM	…art-contract-security/mutation-testing-with-slither.md	173	- [1] [Mutation testing for the agentic era](https://blog.trailofbits.com/2026/04/01/mutation-testing-for-the-agentic-er	CODE
MEDIUM	…orkflow-compromise-safe-delegatecall-proxy-takeover.md	38	Safe proposals are submitted to the Safe Client Gateway.<sup>[[5]](#references)</sup> Prior to hardened checks, the	CODE
MEDIUM	…ervices-pentesting/pentesting-web/code-review-tools.md	97	Modern AI-assisted code review works better as a staged pipeline than as a single `scan this repo` prompt. A pra	CODE
MEDIUM	…ervices-pentesting/pentesting-web/code-review-tools.md	589	- [4] [Visa Vulnerability Agentic Harness](https://github.com/visa/visa-vulnerability-agentic-harness)	CODE
MEDIUM	…ervices-pentesting/pentesting-web/code-review-tools.md	590	- [5] [VVAH Architecture](https://github.com/visa/visa-vulnerability-agentic-harness/blob/main/docs/architecture.md)	CODE
MEDIUM	src/AI/AI-Agent-Security-Methodology.md	7	The [OWASP Top 10 for Agentic Applications](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2	CODE
MEDIUM	src/AI/AI-Agent-Security-Methodology.md	129	- [1] [OWASP Top 10 for Agentic Applications for 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applica	CODE
MEDIUM	src/AI/AI-Exposed-Self-Hosted-AI-Services.md	114	## Vector databases used by RAG	COMMENT
MEDIUM	…Assisted-Source-Review-and-Vulnerability-Validation.md	106	The [graph-first fuzz-target workflow](../generic-methodologies-and-resources/fuzzing.md#graph-first-fuzz-target-selecti	CODE
MEDIUM	src/AI/AI-Prompts.md	103	In this attack, the user instructs the AI to act as if it has two (or more) personas, one of which ignores the rules	CODE

Fake / Example Data35 hits · 40 pts

Severity	File	Line	Snippet	Context
LOW	…ces/basic-forensic-methodology/ios-backup-forensics.md	147	✗ THREAT in WhatsApp chat 'John Doe': suspicious_document.pdf → FORCEDENTRY (JBIG2)	CODE
LOW	…ies-and-resources/pentesting-wifi/evil-twin-eap-tls.md	414	-subj '/CN=test-user@example.org'	CODE
LOW	…ies-and-resources/pentesting-wifi/evil-twin-eap-tls.md	435	identity="test-user@example.org"	CODE
LOW	…ies-and-resources/pentesting-wifi/evil-twin-eap-tls.md	436	anonymous_identity="anonymous@example.org"	CODE
LOW	…-and-resources/pentesting-wifi/wpa-enterprise-8021x.md	272	anonymous_identity="anonymous@example.org"	CODE
LOW	…-and-resources/pentesting-wifi/wpa-enterprise-8021x.md	273	identity="test-user@example.org"	CODE
LOW	…-and-resources/pentesting-wifi/wpa-enterprise-8021x.md	357	anonymous_identity="anonymous@example.org"	CODE
LOW	src/generic-hacking/reverse-shells/windows.md	392	<stylesheet xmlns="http://www.w3.org/1999/XSL/Transform" xmlns:ms="urn:schemas-microsoft-com:xslt" xmlns:user="placehold	CODE
LOW	src/binary-exploitation/array-indexing.md	70	'123 Main St', 'Springfield'	CODE
LOW	src/pentesting-web/mass-assignment-cwe-915.md	38	"email": "user@example.com",	CODE
LOW	src/pentesting-web/mass-assignment-cwe-915.md	50	"email": "user@example.com",	CODE
LOW	src/pentesting-web/mass-assignment-cwe-915.md	82	"email": "user@example.com",	CODE
LOW	src/pentesting-web/orm-injection.md	383	{"email":"admin@example.com"}	CODE
LOW	src/pentesting-web/rsql-injection.md	130	GET /api/registrations?filter[userAccounts]=email=='test@test.com' HTTP/1.1	CODE
LOW⚡	src/pentesting-web/xss-cross-site-scripting/README.md	1997	smtp_user = "user@example.org"	CODE
LOW⚡	src/pentesting-web/xss-cross-site-scripting/README.md	1999	sender = "list@example.org"	CODE
LOW⚡	src/pentesting-web/xss-cross-site-scripting/README.md	2000	recipient = "victim@example.org"	CODE
LOW⚡	src/pentesting-web/xss-cross-site-scripting/README.md	2044	smtp_user = "user@example.org"	CODE
LOW⚡	src/pentesting-web/xss-cross-site-scripting/README.md	2052	msg["From"] = "list@example.org"	CODE
LOW⚡	src/pentesting-web/xss-cross-site-scripting/README.md	2053	msg["To"] = "victim@example.org"	CODE
LOW	…pentesting-web/deserialization/ruby-class-pollution.md	120	name: "John Doe",	CODE
LOW	…pentesting-web/deserialization/ruby-class-pollution.md	136	# ruby class_pollution.rb '{"to_s":"Admin","name":"Jane Doe","details":{"location":{"city":"Barcelona"}}}'	COMMENT
LOW	…pentesting-web/deserialization/ruby-class-pollution.md	140	# ruby class_pollution.rb '{"protected_methods":["puts 1"],"name":"Jane Doe","details":{"location":{"city":"Barcelon	COMMENT
LOW	…pentesting-web/deserialization/ruby-class-pollution.md	234	name: "John Doe",	CODE
LOW	…pentesting-web/deserialization/ruby-class-pollution.md	250	# Example usage: ruby hashie.rb '{"_": "Admin", "name":"Jane Doe","details":{"location":{"city":"Barcelona"}}}'	COMMENT
LOW	…pentesting-web/deserialization/ruby-class-pollution.md	343	name: "John Doe",	CODE
LOW	…c/network-services-pentesting/pentesting-web/nextjs.md	532	body: JSON.stringify({ name: "John Doe" }),	CODE
LOW	…c/network-services-pentesting/pentesting-web/nextjs.md	561	return new Response(JSON.stringify({ userId: id, name: "Jane Doe" }), {	CODE
LOW	…c/network-services-pentesting/pentesting-web/nextjs.md	711	res.status(200).json({ userId: id, name: 'John Doe' });	CODE
LOW	…/network-services-pentesting/pentesting-web/graphql.md	248	searchPerson(name: "John Doe") {	CODE
LOW	…/network-services-pentesting/pentesting-web/graphql.md	258	searchPerson(name: "John Doe") {	CODE
LOW	…/network-services-pentesting/pentesting-web/graphql.md	287	johnsMovieList: searchPerson(name: "John Doe") {	CODE
LOW	…/network-services-pentesting/pentesting-web/graphql.md	335	addPerson(name: "James Yoe", email: "jy@example.com", friends: [{name: "John Doe"}, {email: "jd@example.com"}], subscr	CODE
LOW	src/AI/AI-llm-architecture/2.-data-sampling.md	30	"Lorem ipsum dolor sit amet, consectetur adipiscing elit."	CODE
LOW	src/AI/AI-llm-architecture/2.-data-sampling.md	30	"Lorem ipsum dolor sit amet, consectetur adipiscing elit."	CODE

Over-Commented Block39 hits · 38 pts

Severity	File	Line	Snippet	Context
LOW	README.md	21	# "it" for Italian	COMMENT
LOW	theme/book.js	421	if (theme == "default-theme"){	COMMENT
LOW	theme/book.js	441	// document.addEventListener('keydown', function (e) {	COMMENT
LOW	theme/book.js	461	// li.nextElementSibling.querySelector('button').focus();	COMMENT
LOW	src/README.md	21	# "it" for Italian	COMMENT
LOW	src/macos-hardening/macos-auto-start-locations.md	2421	> [!CAUTION] > This isn't working in modern MacOS versions	COMMENT
LOW	src/macos-hardening/macos-auto-start-locations.md	2441		COMMENT
LOW	…on/macos-proces-abuse/macos-xpc-mach-services-abuse.md	281	# If no code-signing verification strings → likely vulnerable	COMMENT
LOW	…-abuse/macos-ipc-inter-process-communication/README.md	821	{{#endref}}	COMMENT
LOW	…-abuse/macos-ipc-inter-process-communication/README.md	1161	#include <unistd.h>	COMMENT
LOW	…-inspecting-debugging-and-fuzzing/objects-in-memory.md	41	// - if the callback is passed 1 in 'op' it should increment the 'cf's reference count and return 0	COMMENT
LOW	…alation/macos-security-protections/macos-gatekeeper.md	281	```c	COMMENT
LOW	…ation/macos-security-protections/macos-code-signing.md	221		COMMENT
LOW	…ation/macos-security-protections/macos-code-signing.md	241	#define CS_EXEC_SET_HARD 0x00100000 /* set CS_HARD on any exec'ed process */	COMMENT
LOW	…s/macos-code-signing-weaknesses-and-sandbox-escapes.md	341	# Find custom sandbox profiles	COMMENT
LOW	src/generic-hacking/exfiltration.md	81	```python	COMMENT
LOW	…entesting/ios-pentesting/frida-configuration-in-ios.md	601		COMMENT
LOW	…entesting/ios-pentesting/frida-configuration-in-ios.md	861		COMMENT
LOW	…entesting/ios-pentesting/frida-configuration-in-ios.md	1121	For quick fuzzing tests without fpicker setup, use this standalone script:	COMMENT
LOW	…exploitation/format-strings/format-strings-template.md	101	# Therefore, get_formatstring_config finds the offset and padding needed to exploit the format string	COMMENT
LOW	…ng/interesting-files-permissions/linux-capabilities.md	1041	First of all read the previous section that [abuses DAC_READ_SEARCH capability to read arbitrary files](linux-capabi	COMMENT
LOW	src/pentesting-web/email-injections.md	121		COMMENT
LOW	…ting-web/ssti-server-side-template-injection/README.md	301	#set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("whoami"))	COMMENT
LOW	…postgresql-injection/rce-with-postgresql-extensions.md	201	#define PG_REVSHELL_CALLHOME_SERVER "10.10.10.10"	COMMENT
LOW	src/pentesting-web/deserialization/README.md	641	# DNS request	COMMENT
LOW	…ng/reversing-tools-basic-methods/angr/angr-examples.md	421		COMMENT
LOW	…ng/reversing-tools-basic-methods/angr/angr-examples.md	441	# ...	COMMENT
LOW	…ng/reversing-tools-basic-methods/angr/angr-examples.md	541		COMMENT
LOW	…ng/reversing-tools-basic-methods/angr/angr-examples.md	801	</details>	COMMENT
LOW	…ng/reversing-tools-basic-methods/angr/angr-examples.md	821	# angr.SIM_PROCEDURES['libc']['strncmp']	COMMENT
LOW	src/network-services-pentesting/pentesting-sap.md	81	```text	COMMENT
LOW	src/network-services-pentesting/pentesting-sap.md	101	SOLMAN_ADMIN:init1234:*	COMMENT
LOW	…ypass/disable_functions-bypass-php-7.0-7.4-nix-only.md	1	# disable_functions bypass - PHP 7.0-7.4 (\*nix only)	COMMENT
LOW	src/AI/AI-Deep-Learning.md	161		COMMENT
LOW	src/AI/AI-Supervised-Learning-Algorithms.md	461		COMMENT
LOW	src/AI/AI-Supervised-Learning-Algorithms.md	541		COMMENT
LOW	src/windows-hardening/cobalt-strike.md	141	## Methods:	COMMENT
LOW	…cal-privilege-escalation/leaked-handle-exploitation.md	301	### Exploit Example 1	COMMENT
LOW	…cal-privilege-escalation/leaked-handle-exploitation.md	521	```c	COMMENT

Structural Annotation Overuse16 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	…/macos-hardening/macos-red-teaming/macos-mdm/README.md	99	### Step 4: DEP check-in - Getting the Activation Record	COMMENT
LOW	…/macos-hardening/macos-red-teaming/macos-mdm/README.md	150	### Step 6: Profile Installation	COMMENT
LOW	src/privacy/capture-resilient-authorized-field-nodes.md	54	## Step 1: authorize and register the placement	COMMENT
LOW	src/privacy/capture-resilient-authorized-field-nodes.md	63	## Step 2: build a minimal recoverable image	COMMENT
LOW	src/privacy/capture-resilient-authorized-field-nodes.md	75	## Step 3: issue identities with one-way trust	COMMENT
LOW	src/privacy/capture-resilient-authorized-field-nodes.md	87	## Step 4: stable outbound rendezvous	COMMENT
LOW	src/privacy/capture-resilient-authorized-field-nodes.md	128	## Step 5: uplink stability without personal links	COMMENT
LOW	src/privacy/capture-resilient-authorized-field-nodes.md	149	## Step 6: constrain work and data	COMMENT
LOW	src/binary-exploitation/libc-heap/house-of-roman.md	122	### Step 3: Retarget \_\_malloc_hook	COMMENT
LOW	…ening/linux-basics/bypass-linux-restrictions/README.md	268	## Step 1: generate `ls -t>g` to file "_" to be able to execute ls ordening names by cration date	COMMENT
LOW	src/AI/AI-llm-architecture/4.-attention-mechanisms.md	41	#### Step 1: Compute Attention Scores	COMMENT
LOW	src/AI/AI-llm-architecture/4.-attention-mechanisms.md	60	#### Step 2: Normalize Attention Scores to Obtain Attention Weights	COMMENT
LOW	src/AI/AI-llm-architecture/4.-attention-mechanisms.md	83	#### Step 3: Compute the Context Vector	COMMENT
LOW	src/AI/AI-llm-architecture/4.-attention-mechanisms.md	126	#### Step 1: Compute Queries, Keys, and Values	COMMENT
LOW	src/AI/AI-llm-architecture/4.-attention-mechanisms.md	162	#### Step 2: Compute Scaled Dot-Product Attention	COMMENT
LOW	src/AI/AI-llm-architecture/4.-attention-mechanisms.md	183	#### Step 3: Compute Context Vectors	COMMENT

Excessive Try-Catch Wrapping18 hits · 20 pts

Severity	File	Line	Snippet	Context
LOW	hacktricks-preprocessor.py	48	except Exception as e:	CODE
LOW	hacktricks-preprocessor.py	72	except Exception as e:	CODE
LOW	hacktricks-preprocessor.py	93	except Exception as e:	CODE
LOW	hacktricks-preprocessor.py	124	except Exception as e:	CODE
LOW	.github/actions/invalidation-needed/decide.py	180	except Exception as exc: # noqa: BLE001 - any doubt must keep the invalidation	STRING
LOW	src/crypto/ctf-workflow/README.md	151	except Exception:	CODE
LOW⚡	…/keras-model-deserialization-rce-and-gadget-hunting.md	234	except Exception:	CODE
LOW⚡	…/keras-model-deserialization-rce-and-gadget-hunting.md	242	except Exception:	CODE
LOW⚡	…/keras-model-deserialization-rce-and-gadget-hunting.md	249	except Exception:	CODE
LOW	…thon-sandboxes/load_name-load_const-opcode-oob-read.md	284	except Exception:	CODE
LOW	…e-brackets-expression-evaluation-rce-cve-2023-33733.md	103	except Exception as exc:	CODE
LOW	…g/android-app-pentesting/reversing-native-libraries.md	227	except Exception:	CODE
LOW	…/common-binary-protections-and-bypasses/aslr/README.md	157	except Exception as e:	CODE
LOW	src/pentesting-web/orm-injection.md	18	except Exception as e:	CODE
LOW	src/pentesting-web/reset-password.md	343	except Exception as e:	CODE
LOW	src/pentesting-web/saml-attacks/README.md	387	except Exception as e:	CODE
LOW	…ork-services-pentesting/pentesting-remote-gdbserver.md	175	except Exception as e:	CODE
MEDIUM	…ork-services-pentesting/pentesting-remote-gdbserver.md	143	def invoke(self, arg, from_tty):	CODE

AI Response Leakage3 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	…-methodologies-and-resources/pentesting-methodology.md	65	There are also several tools that can perform automatic vulnerabilities assessments. *I would recommend you to try	CODE
HIGH	…hardening/windows-local-privilege-escalation/README.md	2126	[MSF-Credentials Plugin](https://github.com/carlospolop/MSF-Credentials) is a msf plugin I have created this plu	CODE
HIGH	src/windows-hardening/stealing-credentials/README.md	35	Use the [Credentials Plugin](https://github.com/carlospolop/MSF-Credentials) that I have created to **search for	CODE

Redundant / Tautological Comments7 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	hacktricks-preprocessor.py	153	elif isinstance(sections, list): # Iterate through list when in sections and in sub_items	CODE
LOW	.github/workflows/cleanup_branches.yml	43	# Check if this is a dry run	COMMENT
LOW	.github/workflows/cleanup_branches.yml	87	# Check if it's a protected branch	COMMENT
LOW⚡	.github/workflows/cleanup_branches.yml	102	# Check if it's a translation branch (any 2-letter combination)	COMMENT
LOW⚡	.github/workflows/cleanup_branches.yml	110	# Check if branch has an open PR	COMMENT
LOW⚡	.github/workflows/cleanup_branches.yml	117	# Check if branch had a PR that was merged or closed	COMMENT
LOW	.github/workflows/cleanup_branches.yml	149	# Check if branch is older than 30 days and has no recent activity	COMMENT

Deep Nesting5 hits · 5 pts

Severity	File	Line	Context
LOW	hacktricks-preprocessor.py	36	CODE
LOW	hacktricks-preprocessor.py	146	CODE
LOW	scripts/merge_approved_prs.py	128	CODE
LOW	scripts/translation_backlog.py	78	CODE
LOW	.github/actions/invalidation-needed/decide.py	96	CODE

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	clean_unused_images.sh	3	# Define the image folder and the root of your project	COMMENT

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	src/images/template.py	94	# will be the real one, you can use it directly (NOT NEED TO ADD AGAINF THE LIBC BASE ADDRESS)	COMMENT

AI Structural Patterns2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	hacktricks-preprocessor.py	108		CODE
LOW	hacktricks-preprocessor.py	137		CODE

Unused Imports2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	scripts/mark_unchanged_s3_files.py	14		CODE
LOW	src/images/template.py	1		CODE

Modern Structural Boilerplate1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	hacktricks-preprocessor.py	9	logger = logging.getLogger(__name__)	CODE

HackTricks-wiki/hacktricks

Open-Source Code Quality, Security and Technical Debt Review