0.6

Adjusted Signal

0.6

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

30.2K

Stars

TypeScript

Language

1.6M

Lines of Code

9.5K

Files

543

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 354 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.7/100 · LOW

Are imports declared and package/API names verified? 93 finding(s).

Agent Over-Engineering Ratio 1.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 148 finding(s).

PR Review Velocity Impact 2.7/100 · LOW

Which changes need focused human review? 543 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 9HIGH 7MEDIUM 93LOW 434

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 543 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators80 hits · 242 pts

Severity	File	Line	Snippet	Context
MEDIUM	frontend/src/lib/fn/permission.ts	175	// ─── Condition extraction ───────────────────────────────────────────	COMMENT
MEDIUM	frontend/src/lib/fn/permission.ts	263	// ─── Rule predicates ──────────────────────────────────────────────	COMMENT
MEDIUM	frontend/src/lib/fn/permission.ts	337	// ─── Subject helpers ─────────────────────────────────────────────────	COMMENT
MEDIUM	frontend/src/lib/fn/permission.ts	360	// ─── Permission checks (can) ─────────────────────────────────────────	COMMENT
MEDIUM⚡	frontend/src/lib/fn/permission.ts	390	// ─── Grant condition extractors ─────────────────────────────────────	COMMENT
MEDIUM	frontend/src/lib/fn/permission.ts	445	// ─── Grant condition utilities ──────────────────────────────────────	COMMENT
MEDIUM	frontend/src/lib/fn/permission.ts	483	// ─── Validation / formatting ─────────────────────────────────────────	COMMENT
MEDIUM	backend-go/internal/server/api/shared/overlay.yaml	7	# ============================================	COMMENT
MEDIUM	backend-go/internal/server/api/shared/overlay.yaml	9	# ============================================	COMMENT
MEDIUM	backend-go/internal/server/api/shared/overlay.yaml	116	# ============================================	COMMENT
MEDIUM	backend-go/internal/server/api/shared/overlay.yaml	118	# ============================================	COMMENT
MEDIUM	backend-go/internal/server/api/shared/overlay.yaml	137	# ============================================	COMMENT
MEDIUM	backend-go/internal/server/api/shared/overlay.yaml	139	# ============================================	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	10	// ── key namespace ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	36	// ── helpers ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	170	// ── single-pod: handler runs and completes ─────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	192	// ── two pods: exactly one handler invocation per fire boundary ─────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	217	// ── slot exhaustion: N+1 factories, exactly N participate ─────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	240	// ── slot handover on stop ──────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	261	// ── retry on failure ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	305	// ── handler timeout ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	345	// ── retry backoff spacing ──────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	391	// ── next-fire guard ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	415	// ── ZSET cleared on success ────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	433	// ── min-age gate ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	465	// ── jitter ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	517	// ── dedup across restarts ──────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/e2e-test/cron-job.spec.ts	605	// ── graceful shutdown ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v1/kmip-server-router.ts	94	// ─── POST / (Create KMIP server) ──────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v1/kmip-server-router.ts	174	// ─── GET /:kmipServerId ───────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v1/kmip-server-router.ts	205	// ─── GET / (List KMIP servers) ────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v1/kmip-server-router.ts	223	// ─── PATCH /:kmipServerId ─────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v1/kmip-server-router.ts	319	// ─── POST /:kmipServerId/token-auth/generate-enrollment-token ─────────────	COMMENT
MEDIUM	backend/src/ee/routes/v1/kmip-server-router.ts	352	// ─── POST /:kmipServerId/revoke ───────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v1/kmip-server-router.ts	390	// ─── DELETE /:kmipServerId ────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v1/kmip-server-router.ts	423	// ─── POST /login ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v1/kmip-server-router.ts	549	// ─── POST /connect ────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v2/relay-router.ts	54	// ─── POST / (Create Relay) ────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v2/relay-router.ts	127	// ─── GET /:relayId ────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v2/relay-router.ts	156	// ─── GET /:relayId/gateways ─────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v2/relay-router.ts	183	// ─── PATCH /:relayId ──────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v2/relay-router.ts	268	// ─── POST /:relayId/token-auth/generate-enrollment-token ──────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v2/relay-router.ts	299	// ─── POST /:relayId/revoke ────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v2/relay-router.ts	335	// ─── POST /login ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v2/relay-router.ts	459	// ─── POST /connect ────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v2/relay-router.ts	492	// ─── POST /heartbeat ──────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v3/gateway-router.ts	231	// ─── POST / ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v3/gateway-router.ts	294	// ─── GET /:gatewayId ─────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v3/gateway-router.ts	319	// ─── PATCH /:gatewayId ───────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v3/gateway-router.ts	421	// ─── POST /:gatewayId/token-auth/generate-enrollment-token ────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v3/gateway-router.ts	458	// ─── POST /:gatewayId/revoke ─────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v3/gateway-router.ts	499	// ─── POST /login ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v3/gateway-router.ts	827	// ─── POST /token-auth/enroll (DEPRECATED) ────────────────────────────────	COMMENT
MEDIUM	backend/src/ee/routes/v3/gateway-router.ts	872	// ─── POST /connect ───────────────────────────────────────────────────────	COMMENT
MEDIUM	…rc/ee/services/audit-report/audit-report-generators.ts	121	// ─── Secret access log helpers ──────────────────────────────────────────────────	COMMENT
MEDIUM	…rc/ee/services/audit-report/audit-report-generators.ts	150	// ─── Input schemas ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rc/ee/services/audit-report/audit-report-generators.ts	170	// ─── Definitions ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…kend/src/server/routes/v3/external-migration-router.ts	590	// ─── Doppler In-Platform Migration Routes ────────────────────────────────────	COMMENT
MEDIUM	backend/src/lib/cron/cron-job.test.ts	11	// ── helpers ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	backend/src/lib/cron/cron-job.test.ts	65	// ── lifecycle ─────────────────────────────────────────────────────────────────	COMMENT
20 more matches not shown…

Over-Commented Block194 hits · 154 pts

Severity	File	Line	Snippet	Context
LOW	docker-compose.test.yml	1	# Backing services for the backend test suites, deliberately separate from	COMMENT
LOW	frontend/src/const/nativeIntegrationDeprecation.ts	1	// Cutoff after which native integrations stop syncing secrets. Every in-product notice reads	COMMENT
LOW	…s/utilities/checks/password/checkIsPasswordBreached.ts	21	// in short, the pending password is hashed (SHA-1), the first 5 chars are sliced and compared against a ranged hash tab	COMMENT
LOW	frontend/src/hooks/api/pam/session-playback/decrypt.ts	1	// Web Crypto AES-GCM playback decrypt for PAM session recordings	COMMENT
LOW	frontend/src/hooks/api/orgIdentity/mutations.tsx	61	// const queryClient = useQueryClient();	COMMENT
LOW	frontend/src/hooks/api/orgIdentity/mutations.tsx	81	// return useMutation({	COMMENT
LOW	frontend/src/hooks/api/appConnections/queries.tsx	141	...options	COMMENT
LOW	frontend/src/hooks/api/appConnections/queries.tsx	161	// queryFn: async () => {	COMMENT
LOW	frontend/src/hooks/api/appConnections/queries.tsx	181	// >,	COMMENT
LOW	frontend/src/hooks/api/appConnections/queries.tsx	201	// connectionId: string,	COMMENT
LOW	frontend/src/hooks/api/appConnections/queries.tsx	221	// ...options	COMMENT
LOW	frontend/src/hooks/api/appConnections/types/index.ts	341		COMMENT
LOW	frontend/src/hooks/api/appConnections/types/index.ts	361	// [AppConnection.TerraformCloud]: TTerraformCloudConnection;	COMMENT
LOW	frontend/src/hooks/api/appConnections/types/index.ts	381	// [AppConnection.Zabbix]: TZabbixConnection;	COMMENT
LOW	frontend/src/hooks/api/appConnections/types/index.ts	401	// dataSources: Array<{ id: string; name: string }>;	COMMENT
LOW	…src/pages/secret-manager/OverviewPage/OverviewPage.tsx	3521	Object.values(selectedEntries.secret).flatMap((entries) => Object.keys(entries)),	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	1	// import { useMemo, useState } from "react";	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	21	// import { TAccessLocation } from "@app/hooks/api/secretInsights/types";	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	41	// CO: "170",	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	61	// KE: "404",	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	81	// ZA: "710",	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	101	// // Natural Earth 1 projection — trimmed left (before Hawaii), padded right	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	121	// const BORDER_STROKE = "#3a3c40";	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	141	// countryActivity.forEach((count, numericCode) => {	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	161	// <svg	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	181	// >	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	201	// <path	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	221	// <circle	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	241	// })}	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	261	// let local = 0;	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	281	// return { countryActivity: activity, countryMaxCount: maxVal };	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	301	// <CardContent>	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	321	// </span>{" "}	COMMENT
LOW	…es/secret-manager/InsightsPage/components/WorldMap.tsx	341	// </div>	COMMENT
LOW	backend-go/internal/database/pg/pg.go	141	//	COMMENT
LOW	backend-go/internal/database/pg/sqln/group.go	1	package sqln	COMMENT
LOW	…kend-go/internal/services/auth/apiauth/require_auth.go	41	}	COMMENT
LOW	backend-go/internal/services/permission/permission.go	121	return nil, errutil.BadRequest("Invalid actor provided").WithErrf("GetProjectPermission: unsupported actor type %s", a	COMMENT
LOW	wasm/ironrdp-decoder/src/lib.rs	1	//! Offline RDP session replay decoder, backed by IronRDP's own decoders.	COMMENT
LOW	tests/infra/runner.go	61		COMMENT
LOW	tests/infra/runner.go	261	// unexpected create means a name is varying when it should not, and everything	COMMENT
LOW	tests/infra/names.go	41	// Only set it where staleness would be SILENT. Infisical carries its Docker image	COMMENT
LOW	tests/infra/fakenet/dns.go	41	}	COMMENT
LOW	tests/infra/fakenet/fakenet.go	1	// Package fakenet is the harness's fake internet: one server holding a working	COMMENT
LOW	tests/internal/spec/spec.go	1	// Package spec carries the rationale for a test into its output.	COMMENT
LOW	tests/fakes/license/license.go	1	// Package license controls a tenant's entitlements.	COMMENT
LOW	tests/fakes/aws/aws.go	1	// Package aws fakes the parts of AWS that Infisical calls: STS, SSM Parameter Store,	COMMENT
LOW	tests/harness/tenant.go	21	openapi_types "github.com/oapi-codegen/runtime/types"	COMMENT
LOW	tests/harness/harness.go	241	}	COMMENT
LOW	tests/harness/principal.go	61	// fakenet, where a field would be a nil dereference three frames inside the client.	COMMENT
LOW	tests/harness/infisical/bootstrap.go	21	RootPassword = "HarnessRootPassword7!"	COMMENT
LOW	tests/harness/infisical/client.go	41	// identity-creation and project-creation are hardcoded and keyed on req.realIp. A	COMMENT
LOW	tests/harness/infisical/infisical.go	21	Key = infra.ModuleKey("infisical")	COMMENT
LOW	tests/harness/infisical/ready.go	21		COMMENT
LOW	sink/index.html	81	// console.log("Received data:", data);	COMMENT
LOW	sink/cassandra.yaml	1		COMMENT
LOW	sink/cassandra.yaml	21	# Specifying initial_token will override this setting on the node's initial start,	COMMENT
LOW	sink/cassandra.yaml	41		COMMENT
LOW	sink/cassandra.yaml	61	# this defines the maximum amount of time a dead host will have hints	COMMENT
LOW	sink/cassandra.yaml	81	# If not set, the default directory is $CASSANDRA_HOME/data/hints.	COMMENT
134 more matches not shown…

Hallucination Indicators9 hits · 90 pts

Severity	File	Line	Snippet	Context
CRITICAL	tests/suites/secretmanager/rotations/helpers_test.go	172	res, err := r.e.tn.Admin.API.GetPostgreSQLCredentialsRotationWithResponse(t.Context(), r.ID)	CODE
CRITICAL	tests/suites/secretmanager/rotations/helpers_test.go	186	res, err := r.e.tn.Admin.API.RotatePostgreSQLCredentialsRotationWithResponse(t.Context(), r.ID)	CODE
CRITICAL	tests/suites/secretmanager/rotations/helpers_test.go	214	res, err := r.e.tn.Admin.API.UpdatePostgreSQLCredentialsRotationWithResponse(t.Context(), r.ID, body)	CODE
CRITICAL	tests/suites/secretmanager/rotations/helpers_test.go	231	res, err := r.e.tn.Admin.API.DeletePostgreSQLCredentialsRotationWithResponse(t.Context(), r.ID,	CODE
CRITICAL	…ynamic-secret-lease/dynamic-secret-lease-queue.test.ts	356	harness.queueService.queue.mock.calls.filter(	CODE
CRITICAL	…dge/secret-change-global-policy-bridge-service.test.ts	573	const stateRead = deps.secretChangeGlobalPolicyBridgeDAL.findSecretChangePolicies.mock.calls.findIndex(	CODE
CRITICAL	backend/src/services/secret-sync/gcp/gcp-sync-fns.ts	111	error.response.data.error.message.match(/(?:disabled\|destroyed)/i)))	CODE
CRITICAL	.github/workflows/publish-storybook-chromatic.yml	68	const head = context.payload.pull_request.head.sha.slice(0, 7);	CODE
CRITICAL	.github/workflows/check-api-for-breaking-changes.yml	229	const head = context.payload.pull_request.head.sha.slice(0, 7);	CODE

Structural Annotation Overuse45 hits · 87 pts

Severity	File	Line	Snippet	Context
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	242	// Step 1: Replace + with a placeholder	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	244	// Step 2: Replace * with **	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	246	// Step 3: Replace placeholder with *	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	368	// Step 1: Clean HCL policy - remove comments and extra whitespace	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	375	// Step 2: Extract path blocks using regex	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	379	// Step 3: Process each path block	COMMENT
LOW	…ailsBySlugPage/components/VaultPolicyAnalyzer.utils.ts	133	// Step 1: Extract all path blocks	COMMENT
LOW	…ailsBySlugPage/components/VaultPolicyAnalyzer.utils.ts	180	// Step 2: Process each line	COMMENT
LOW⚡	…/ViewSharedSecretByIDPage/ViewSharedSecretByIDPage.tsx	68	// Step 1: Fetch public metadata (is it password protected? what access type?)	COMMENT
LOW⚡	…/ViewSharedSecretByIDPage/ViewSharedSecretByIDPage.tsx	75	// Step 2: Access the secret value (mutation — triggered automatically or after password entry)	COMMENT
LOW⚡	sink/cassandra.yaml	1311	# Step 1: Set internode_encryption=<dc\|rack\|all> and explicitly set optional=true. Restart all nodes	COMMENT
LOW⚡	sink/cassandra.yaml	1313	# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual	COMMENT
LOW⚡	sink/cassandra.yaml	1363	# Step 1: Set enabled=true and explicitly set optional=true. Restart all nodes	COMMENT
LOW⚡	sink/cassandra.yaml	1365	# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual	COMMENT
LOW	backend/e2e-test/routes/v3/auth-signup-oauth.spec.ts	203	// Step 1: seed an unverified alias on the victim by asserting their email unverified.	COMMENT
LOW	backend/e2e-test/routes/v3/auth-signup-oauth.spec.ts	220	// Step 2: same provider identity, now asserting an attacker-controlled VERIFIED email.	COMMENT
LOW	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	69	// Step 1: Begin signup	COMMENT
LOW	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	81	// Step 2: Verify	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	139	// Step 1: Begin signup	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	149	// Step 2: Verify email	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	157	// Step 3: Complete account	COMMENT
LOW	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	231	// Step 1: full signup flow to create an accepted user	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	259	// Step 2: first re-signup request for the now-accepted account — should succeed (informational email)	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	267	// Step 3: wrong-code verification must match the response for a new-account challenge	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	276	// Step 4: second request within cooldown — must return 400 for both paths to be indistinguishable	COMMENT
LOW	…d/src/ee/services/pki-scep/pki-scep-message-builder.ts	37	// Step 1: Wrap the issued certificate in a degenerate PKCS#7 (cert-only SignedData)	COMMENT
LOW	…d/src/ee/services/pki-scep/pki-scep-message-builder.ts	54	// Step 2: Encrypt the cert payload in an EnvelopedData for the device	COMMENT
LOW	…d/src/ee/services/pki-scep/pki-scep-message-builder.ts	78	// Step 3: Build the outer SignedData	COMMENT
LOW⚡	backend/src/services/auth/auth-signup-service.ts	251	// Step 1: Extract and validate the signup token	COMMENT
LOW⚡	backend/src/services/auth/auth-signup-service.ts	259	// Step 2: Find the user	COMMENT
LOW⚡	backend/src/services/auth/auth-signup-service.ts	262	// Step 3: Type-specific validation and user updates	COMMENT
LOW	backend/src/services/auth/auth-signup-service.ts	288	// Step 4: Check org membership — create org if self-signup with no existing membership	COMMENT
LOW	backend/src/services/auth/auth-signup-service.ts	401	// Step 5: Issue session tokens	COMMENT
LOW⚡	backend/src/services/auth/auth-login-service.ts	806	// Step 1: Look up user by provider alias (stable, immutable ID)	COMMENT
LOW⚡	backend/src/services/auth/auth-login-service.ts	814	// Step 2: Fall back to email lookup for existing users without an alias yet	COMMENT
LOW⚡	…rotation/app-connection-credential-rotation-service.ts	484	// Step 1: Create new credential first (safe — worst case we have 3 secrets temporarily)	COMMENT
LOW⚡	…rotation/app-connection-credential-rotation-service.ts	492	// Step 2: Update connection credentials and rotation metadata atomically	COMMENT
LOW	…end/src/services/secret-sync/render/render-sync-fns.ts	286	// Step 1: Process existing Render secrets - determine what to keep or delete	COMMENT
LOW	…end/src/services/secret-sync/render/render-sync-fns.ts	310	// Step 2: Process all secrets from Infisical (these will overwrite any duplicates from Step 1)	COMMENT
LOW⚡	…end/src/services/secret-sync/render/render-sync-fns.ts	321	// Step 3: Batch update all secrets in Render	COMMENT
LOW⚡	…end/src/services/secret-sync/render/render-sync-fns.ts	324	// Step 4: Delete secrets that were removed from Infisical, only for environment groups because it doesn't delete on	COMMENT
LOW	docs/STYLE_GUIDE.md	151	If a guide has more than one stage, give each stage a heading in the form `## Step 1: Configure in Infisical`, and put t	CODE
LOW	docs/STYLE_GUIDE.md	154	## Step 1: Create a machine identity	COMMENT
LOW	docs/STYLE_GUIDE.md	488	Capitalize the first word after a colon: `## Step 1: Configure in Infisical`.	CODE
LOW	docs/.vale/styles/Infisical/SentenceCaseHeadings.yml	10	# A colon starts a new clause, so `## Step 1: Set up authentication` is correct.	COMMENT

Verbosity Indicators44 hits · 86 pts

Severity	File	Line	Snippet	Context
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	242	// Step 1: Replace + with a placeholder	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	244	// Step 2: Replace * with **	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	246	// Step 3: Replace placeholder with *	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	368	// Step 1: Clean HCL policy - remove comments and extra whitespace	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	375	// Step 2: Extract path blocks using regex	COMMENT
LOW⚡	…sBySlugPage/components/VaultPolicyImportModal.utils.ts	379	// Step 3: Process each path block	COMMENT
LOW	…ailsBySlugPage/components/VaultPolicyAnalyzer.utils.ts	133	// Step 1: Extract all path blocks	COMMENT
LOW	…ailsBySlugPage/components/VaultPolicyAnalyzer.utils.ts	180	// Step 2: Process each line	COMMENT
LOW⚡	…/ViewSharedSecretByIDPage/ViewSharedSecretByIDPage.tsx	68	// Step 1: Fetch public metadata (is it password protected? what access type?)	COMMENT
LOW⚡	…/ViewSharedSecretByIDPage/ViewSharedSecretByIDPage.tsx	75	// Step 2: Access the secret value (mutation — triggered automatically or after password entry)	COMMENT
LOW⚡	sink/cassandra.yaml	1311	# Step 1: Set internode_encryption=<dc\|rack\|all> and explicitly set optional=true. Restart all nodes	COMMENT
LOW⚡	sink/cassandra.yaml	1313	# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual	COMMENT
LOW⚡	sink/cassandra.yaml	1363	# Step 1: Set enabled=true and explicitly set optional=true. Restart all nodes	COMMENT
LOW⚡	sink/cassandra.yaml	1365	# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual	COMMENT
LOW	backend/e2e-test/routes/v3/auth-signup-oauth.spec.ts	203	// Step 1: seed an unverified alias on the victim by asserting their email unverified.	COMMENT
LOW	backend/e2e-test/routes/v3/auth-signup-oauth.spec.ts	220	// Step 2: same provider identity, now asserting an attacker-controlled VERIFIED email.	COMMENT
LOW	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	69	// Step 1: Begin signup	COMMENT
LOW	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	81	// Step 2: Verify	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	139	// Step 1: Begin signup	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	149	// Step 2: Verify email	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	157	// Step 3: Complete account	COMMENT
LOW	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	231	// Step 1: full signup flow to create an accepted user	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	259	// Step 2: first re-signup request for the now-accepted account — should succeed (informational email)	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	267	// Step 3: wrong-code verification must match the response for a new-account challenge	COMMENT
LOW⚡	backend/e2e-test/routes/v3/auth-email-signup.spec.ts	276	// Step 4: second request within cooldown — must return 400 for both paths to be indistinguishable	COMMENT
LOW	…d/src/ee/services/pki-scep/pki-scep-message-builder.ts	37	// Step 1: Wrap the issued certificate in a degenerate PKCS#7 (cert-only SignedData)	COMMENT
LOW	…d/src/ee/services/pki-scep/pki-scep-message-builder.ts	54	// Step 2: Encrypt the cert payload in an EnvelopedData for the device	COMMENT
LOW	…d/src/ee/services/pki-scep/pki-scep-message-builder.ts	78	// Step 3: Build the outer SignedData	COMMENT
LOW	backend/src/lib/crypto/cryptography/crypto.ts	186	// if fips mode is enabled, we need to check if the deployment is a new deployment or an old one.	COMMENT
LOW⚡	backend/src/services/auth/auth-signup-service.ts	251	// Step 1: Extract and validate the signup token	COMMENT
LOW⚡	backend/src/services/auth/auth-signup-service.ts	259	// Step 2: Find the user	COMMENT
LOW⚡	backend/src/services/auth/auth-signup-service.ts	262	// Step 3: Type-specific validation and user updates	COMMENT
LOW	backend/src/services/auth/auth-signup-service.ts	288	// Step 4: Check org membership — create org if self-signup with no existing membership	COMMENT
LOW	backend/src/services/auth/auth-signup-service.ts	401	// Step 5: Issue session tokens	COMMENT
LOW⚡	backend/src/services/auth/auth-login-service.ts	806	// Step 1: Look up user by provider alias (stable, immutable ID)	COMMENT
LOW⚡	backend/src/services/auth/auth-login-service.ts	814	// Step 2: Fall back to email lookup for existing users without an alias yet	COMMENT
LOW⚡	…rotation/app-connection-credential-rotation-service.ts	484	// Step 1: Create new credential first (safe — worst case we have 3 secrets temporarily)	COMMENT
LOW⚡	…rotation/app-connection-credential-rotation-service.ts	492	// Step 2: Update connection credentials and rotation metadata atomically	COMMENT
LOW	…end/src/services/secret-sync/render/render-sync-fns.ts	286	// Step 1: Process existing Render secrets - determine what to keep or delete	COMMENT
LOW	…end/src/services/secret-sync/render/render-sync-fns.ts	310	// Step 2: Process all secrets from Infisical (these will overwrite any duplicates from Step 1)	COMMENT
LOW⚡	…end/src/services/secret-sync/render/render-sync-fns.ts	321	// Step 3: Batch update all secrets in Render	COMMENT
LOW⚡	…end/src/services/secret-sync/render/render-sync-fns.ts	324	// Step 4: Delete secrets that were removed from Infisical, only for environment groups because it doesn't delete on	COMMENT
LOW	…src/services/secret-sync/windmill/windmill-sync-fns.ts	21	// windmill paginates but doesn't return if there's more pages so we need to check if page size full	COMMENT
LOW	docs/.vale/styles/Infisical/SentenceCaseHeadings.yml	10	# A colon starts a new clause, so `## Step 1: Set up authentication` is correct.	COMMENT

Fake / Example Data78 hits · 82 pts

Severity	File	Line	Snippet	Context
LOW	…ponents/organization/CreateOrgModal/CreateOrgModal.tsx	111	placeholder="Acme Corp"	CODE
LOW	…on/NewSubOrganizationModal/NewSubOrganizationModal.tsx	110	placeholder="Acme Corp"	CODE
LOW	…nts/secrets/SecretAccessGraph/buildAccessGraph.test.ts	40	name: "admin@example.com",	CODE
LOW	…nd/src/components/v3/generic/CodeEditor/CodeEditor.tsx	112	"language" \| "isReadOnly" \| "hasLineNumbers" \| "hasLineWrapping" \| "placeholder"	CODE
LOW	…rc/components/v3/generic/Combobox/Combobox.stories.tsx	249	await expect(input).toHaveAttribute("placeholder", "Select environment...");	CODE
LOW	…rc/components/v3/generic/Combobox/Combobox.stories.tsx	252	await expect(input).toHaveAttribute("placeholder", "Select environment...");	CODE
LOW	…rc/components/v3/generic/Combobox/Combobox.stories.tsx	405	await expect(input).toHaveAttribute("placeholder", "Select organization...");	CODE
LOW	…rc/components/v3/generic/Combobox/Combobox.stories.tsx	1382	const knownOrganizationEmails = ["member@example.com", "admin@example.com"];	CODE
LOW	…nd/src/components/v3/generic/Dialog/Dialog.stories.tsx	225	<span className="font-medium">Section {i + 1}.</span> Lorem ipsum dolor sit amet,	CODE
LOW	…nd/src/components/v3/generic/Dialog/Dialog.stories.tsx	225	<span className="font-medium">Section {i + 1}.</span> Lorem ipsum dolor sit amet,	CODE
LOW	…/src/components/v3/generic/Command/Command.stories.tsx	437	{ id: "2", name: "Acme Corp" },	CODE
LOW⚡	…/components/agent-vault/service-sheet/serviceSchema.ts	542	at("placeholder", "Required");	CODE
LOW⚡	…/components/agent-vault/service-sheet/serviceSchema.ts	544	at("placeholder", CONTROL_CHARS_MESSAGE);	CODE
LOW⚡	…/components/agent-vault/service-sheet/serviceSchema.ts	547	"placeholder",	CODE
LOW⚡	…/components/agent-vault/service-sheet/serviceSchema.ts	551	at("placeholder", "This placeholder is listed twice.");	CODE
LOW	…mponents/OrgNameChangeSection/OrgNameChangeSection.tsx	131	placeholder="Acme Corp"	CODE
LOW	…nents/OrgNameChangeSection/SubOrgNameChangeSection.tsx	114	placeholder="Acme Corp"	CODE
LOW	…mponents/AppConnectionForm/BitbucketConnectionForm.tsx	115	placeholder="user@example.com"	CODE
LOW	…ge/components/AppConnectionForm/JiraConnectionForm.tsx	272	placeholder="user@example.com"	CODE
LOW	…horitiesPage/components/CreateCaWizard/SubjectStep.tsx	13	{ name: "organization", label: "Organization (O)", placeholder: "Acme Corp" },	CODE
LOW	…omponents/CertificatePoliciesTab/CreatePolicyModal.tsx	169	email: "admin@example.com",	CODE
LOW	…omponents/CertificatePoliciesTab/CreatePolicyModal.tsx	171	upn: "user@example.com"	CODE
LOW	…anager/CertificatesPage/components/certificateUtils.ts	15	return "admin@example.com";	CODE
LOW	…r/PkiSubscribersPage/components/PkiSubscriberModal.tsx	712	placeholder="admin@example.com"	CODE
LOW	backend-go/internal/ee/services/license/license_test.go	47	licenseJSON: `{"issuedTo":"Acme Corp","licenseId":"lic-456","features":{"secretsManagement":true}}`,	CODE
LOW	backend/e2e-test/routes/v1/agent-vault.spec.ts	1170	expect(reached.payload).not.toContain("admin@example.com");	CODE
LOW	backend/e2e-test/routes/v3/secrets.spec.ts	149	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore	CODE
LOW	backend/e2e-test/routes/v3/secrets.spec.ts	149	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore	CODE
LOW	backend/e2e-test/routes/v3/secrets.spec.ts	185	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore	CODE
LOW	backend/e2e-test/routes/v3/secrets.spec.ts	185	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore	CODE
LOW	backend/e2e-test/testUtils/saml-config.ts	14	const placeholder = Buffer.from("placeholder");	CODE
LOW	…c/ee/services/dynamic-secret/providers/aws-iam.test.ts	47	identity: { name: "user@example.com" },	CODE
LOW	…ices/assume-privilege/assume-privilege-service.test.ts	23	const USERS: Record<string, string> = { "junior-user": "junior@example.com", "admin-user": "admin@example.com" };	CODE
LOW	…ices/assume-privilege/assume-privilege-service.test.ts	67	conditions: { userEmail: "admin@example.com" }	CODE
LOW	…ices/assume-privilege/assume-privilege-service.test.ts	125	conditions: { userEmail: "admin@example.com" }	CODE
LOW	…ices/agent-vault/agent-vault-transformation-schemas.ts	144	path: [index, "placeholder"]	CODE
LOW	…kend/src/ee/services/permission/permission-fns.test.ts	420	conditions: { userEmail: "admin@example.com" }	CODE
LOW	…kend/src/ee/services/permission/permission-fns.test.ts	444	conditions: { userEmail: "admin@example.com", assignableRole: "admin" }	CODE
LOW	…rvices/github-org-sync/github-org-sync-service.test.ts	148	username: "admin@example.com",	CODE
LOW	…rvices/github-org-sync/github-org-sync-service.test.ts	149	email: "admin@example.com"	CODE
LOW	backend/src/server/routes/mfa-step-up-fns.test.ts	38	getMe: vi.fn().mockResolvedValue({ id: USER_ID, email: "user@example.com" })	CODE
LOW	backend/src/lib/validator/disposable_emails.txt	1056	fake-email.pp.ua	CODE
LOW	backend/src/lib/api-docs/constants.ts	1113	name: "The display name of the sub-organization (e.g. 'Acme Corp'). Allows alphanumeric characters, spaces, dashes,	CODE
LOW	backend/src/db/seed-saml.ts	43	{ username: "john@saml.com", email: "john@saml.com", name: "John Doe" },	CODE
LOW	…end/src/services/license-client/license-client.test.ts	19	account: { sfdc_account_id: "0014x000001abcd", name: "Acme Corp" },	CODE
LOW	…end/src/services/license-client/license-client.test.ts	93	await resolver.getEntitlements({ id: ORG_ID, name: "Acme Corp", slug: "acme" });	CODE
LOW	…end/src/services/license-client/license-client.test.ts	94	expect(getOrgs()[0]).toEqual({ id: ORG_ID, name: "Acme Corp", slug: "acme" });	CODE
LOW	backend/src/services/user-alias/user-alias-fns.test.ts	24	expect(resolveAssertedProfileName({ givenName: "Jane", familyName: "Doe", displayName: "Jane Doe" })).toEqual({	CODE
LOW	backend/src/services/user-alias/user-alias-fns.test.ts	37	expect(resolveAssertedProfileName({ familyName: "Doe", displayName: "Jane Doe" })).toEqual({	CODE
LOW	backend/src/services/user-alias/user-alias-fns.test.ts	74	expect(resolveAssertedProfileName({ displayName: "Jane Doe" })).toEqual({	CODE
LOW	backend/src/services/user-alias/user-alias-fns.test.ts	75	firstName: "Jane Doe",	CODE
LOW	backend/src/services/user-alias/user-alias-fns.test.ts	97	firstName: "Jane Doe",	CODE
LOW⚡	backend/src/services/user-alias/user-alias-fns.test.ts	109	displayName: "Jane Doe"	CODE
LOW⚡	backend/src/services/user-alias/user-alias-fns.test.ts	115	expect(resolveAssertedProfileName({ familyName: "Doe", displayName: ["Jane Doe", "jdoe"] })).toEqual({	CODE
LOW⚡	backend/src/services/user-alias/user-alias-fns.test.ts	123	expect(resolveAssertedProfileName({ givenName: [], familyName: [" ", "Doe"], displayName: ["Jane Doe"] })).toEqual(	CODE
LOW	backend/src/services/alert/alert-engine.test.ts	193	const resolved = opts.recipients ?? [{ userId: "u1", email: "user@example.com", firstName: "U" }];	CODE
LOW	backend/src/services/alert/alert-engine.test.ts	240	expect(sentMail[0].recipients).toEqual(["user@example.com"]);	CODE
LOW	…end/src/services/alert/channels/alert-channels.test.ts	459	recipient: { userId: "u1", email: "user@example.com" },	CODE
LOW	…end/src/services/alert/channels/alert-channels.test.ts	471	expect(sentTo).toEqual(["user@example.com"]);	CODE
LOW	…end/src/services/alert/channels/alert-channels.test.ts	505	recipient: { email: "user@example.com" },	CODE
18 more matches not shown…

Hyper-Verbose Identifiers51 hits · 52 pts

Severity	File	Line	Snippet	Context
LOW	…s/v3/generic/DataGrid/data-grid-keyboard-shortcuts.tsx	36	function DataGridKeyboardShortcutsImpl({ enableSearch = false }: DataGridKeyboardShortcutsProps) {	CODE
LOW	…omponents/v3/generic/RadioGroup/RadioGroup.stories.tsx	523	function WithValidationErrorRender() {	CODE
LOW	…rc/components/v3/generic/Checkbox/Checkbox.stories.tsx	283	function WithValidationErrorRender() {	CODE
LOW	…rc/components/v3/generic/Combobox/Combobox.stories.tsx	1566	function SingleDialogCreationRender({ modal = false }: { modal?: boolean }) {	CODE
LOW	…ponents/v3/generic/ColorPicker/ColorPicker.stories.tsx	196	function WithValidationErrorRender() {	CODE
LOW	…/src/components/v3/generic/AlertDialog/AlertDialog.tsx	228	function AlertDialogConfirmationLabel({	CODE
LOW	…/src/components/v3/generic/AlertDialog/AlertDialog.tsx	318	function AlertDialogConfirmationField({	CODE
LOW	…omponents/v3/generic/InputGroup/InputGroup.stories.tsx	471	render: function TextAreaWithCharCounterRender() {	CODE
LOW	frontend/src/lib/fn/permission.ts	343	export function getSecretSyncPermissionSubject(sync: {	CODE
LOW	frontend/src/lib/fn/permission.ts	362	export function hasSecretReadValueOrDescribePermission(	CODE
LOW⚡	frontend/src/lib/fn/permission.ts	393	export function getMemberAssignRoleConditions(	CODE
LOW⚡	frontend/src/lib/fn/permission.ts	403	export function getMemberAssignPrivilegesConditions(	CODE
LOW	frontend/src/lib/fn/permission.ts	414	export function getIdentityAssignRoleConditions(	CODE
LOW	frontend/src/lib/fn/permission.ts	424	export function getIdentityAssignPrivilegesConditions(	CODE
LOW	frontend/src/lib/fn/permission.ts	466	export function canModifyByGrantConditions(options: {	CODE
LOW	frontend/src/lib/fn/permission.ts	485	export function formatValidationErrorPath(	CODE
LOW	…omponents/ResourceFilter/ResourceFilterMenuContent.tsx	39	export function ResourceFilterMenuContent({	CODE
LOW	…reKeyVaultAuthorizePage/AzureKeyVaultAuthorizePage.tsx	32	export function AzureKeyVaultAuthorizePage() {	CODE
LOW	…ges/pam/PamAccountsPage/components/EditAccountForm.tsx	41	function filterUnchangedCredentials(	CODE
LOW	…nd/src/pages/pam/PamAccountAccessPage/useRdpSession.ts	41	function removeInnerHeightOverride() {	CODE
LOW	…nd/src/pages/pam/PamDataExplorerPage/sql-generation.ts	10	function assertRowEditingSupported(dialect: SqlDialect): void {	CODE
LOW	backend/bdd/features/steps/pki_acme.py	51	def _create_acme_profile_with_app(	CODE
LOW	backend/bdd/features/steps/pki_acme.py	397	def register_account_with_eab(	CODE
LOW	…uest-bridge/secret-change-global-request-bridge-dal.ts	85	.join(TableName.Environment, function joinActiveEnvForSecretFolder() {	CODE
LOW	…s/access-approval-policy/access-approval-policy-dal.ts	630	.join(TableName.Environment, function joinActiveEnvForAccessApprovalPolicy() {	CODE
LOW	…olicy-bridge/secret-change-global-policy-bridge-dal.ts	40	.join(TableName.Environment, function joinActiveEnvForSecretChangePolicy() {	CODE
LOW	…access-approval-request/access-approval-request-dal.ts	358	.leftJoin(TableName.Environment, function joinActiveEnvForApprovalPolicy() {	CODE
LOW	…access-approval-request/access-approval-request-dal.ts	654	.leftJoin(TableName.Environment, function joinActiveEnvForApprovalPolicyEnvironment() {	CODE
LOW	…access-approval-request/access-approval-request-dal.ts	891	.leftJoin(TableName.Environment, function joinActiveEnvForApprovalPolicy() {	CODE
LOW	…secret-approval-request/secret-approval-request-dal.ts	123	.join(TableName.Environment, function joinActiveEnvForSecretFolder() {	CODE
LOW	…secret-approval-request/secret-approval-request-dal.ts	453	.join(TableName.Environment, function joinActiveEnvForSecretFolder() {	CODE
LOW	…secret-approval-request/secret-approval-request-dal.ts	524	.join(TableName.Environment, function joinActiveEnvForSecretFolder() {	CODE
LOW	…secret-approval-request/secret-approval-request-dal.ts	752	.join(TableName.Environment, function joinActiveEnvForSecretFolder() {	CODE
LOW	backend/src/ee/services/permission/permission-fns.ts	37	export function throwIfMissingSecretReadValueOrDescribePermission(	CODE
LOW	backend/src/ee/services/permission/permission-fns.ts	58	export function hasSecretReadValueOrDescribePermission(	CODE
LOW	backend/src/ee/services/permission/permission-fns.ts	90	export function validateSecretMovePermissions(	CODE
LOW	backend/src/ee/services/permission/permission-fns.ts	143	export function checkForInvalidPermissionCombination(permissions: z.infer<typeof OptionalArrayPermissionSchema>) {	CODE
LOW	…s/secret-approval-policy/secret-approval-policy-dal.ts	288	.join(TableName.Environment, function joinActiveEnvForSecretApprovalPolicy() {	CODE
LOW	…-scanning/secret-scanning-queue/secret-scanning-fns.ts	117	export async function scanFullRepoContentAndGetFindings(	CODE
LOW	…-scanning/secret-scanning-queue/secret-scanning-fns.ts	140	export async function scanContentAndGetFindings(textContent: string, configPath?: string): Promise<SecretMatch[]> {	CODE
LOW	backend/src/server/lib/cookie.ts	11	export function addAuthOriginDomainCookie(res: FastifyReply) {	CODE
LOW	backend/src/lib/casl/permission-filter-utils.ts	195	export function getProcessedPermissionRules(	CODE
LOW	…egated-approval/providers/servicenow/servicenow-fns.ts	49	function assertServiceNowConnection(connection: TAppConnection): asserts connection is TServiceNowConnection {	CODE
LOW	…ces/folder-commit-changes/folder-commit-changes-dal.ts	99	.leftJoin<TProjectEnvironments>(TableName.Environment, function joinActiveEnvForFolderCommit() {	CODE
LOW	…ckend/src/services/secret-sync/flyio/flyio-sync-fns.ts	46	function parseMachinesListResponse(data: unknown): TFlyioMachineListItem[] {	CODE
LOW	backend/src/services/folder-commit/folder-commit-dal.ts	75	.leftJoin(TableName.Environment, function joinActiveEnvForFolderCommit() {	CODE
LOW	backend/src/services/folder-commit/folder-commit-dal.ts	394	.leftJoin<TProjectEnvironments>(TableName.Environment, function joinActiveEnvForFolderCommit() {	CODE
LOW	…nd/src/services/approval-policy/approval-policy-dal.ts	698	.join(TableName.Environment, function joinActiveEnvForSecretChangePolicy() {	CODE
LOW	.github/resources/changelog-generator.py	44	def find_previous_release_tag(release_tag:str):	CODE
LOW	.github/resources/changelog-generator.py	119	def extract_commit_details_from_prs(prs):	CODE
LOW	.github/resources/changelog-generator.py	153	def generate_changelog_with_claude(commit_details):	CODE

AI Slop Vocabulary7 hits · 21 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker-compose.test.yml	4	# That separation is not tidiness. The e2e harness (backend/e2e-test/vitest-environment-knex.ts)	COMMENT
MEDIUM	frontend/src/components/v3/generic/RowLink/RowLink.tsx	9	// data-row-interactive. Absolutely positioned controls are skipped so they keep their layout.	COMMENT
MEDIUM	tests/clients/api/oapi-codegen.yaml	17	# harness's own container can never serve it. Generate from the dev stack. Half the	COMMENT
MEDIUM	tests/infra/runner.go	27	// a more robust implementation that is not based on container names".	COMMENT
MEDIUM	tests/infra/container.go	92	// "subject to change for a more robust implementation that is not based on	COMMENT
MEDIUM	sink/cassandra.yaml	1550	# each write which may be lower in order to facilitate availability.	COMMENT
MEDIUM	…s/pam-account-rotation/pam-account-rotation-service.ts	962	// to it (not just metadata read): otherwise a caller could leverage a privileged account they can only see.	COMMENT

Cross-Language Confusion (JS/TS)4 hits · 20 pts

Severity	File	Line	Snippet	Context
HIGH	backend/src/ee/routes/v1/dynamic-secret-router.ts	566	elif systemctl cat ssh.service &>/dev/null; then	CODE
HIGH	backend/src/ee/routes/v1/dynamic-secret-router.ts	571	elif command -v service &> /dev/null; then	CODE
HIGH	…end/src/ee/routes/v1/pam-routers/pam-account-router.ts	1138	elif systemctl cat ssh.service &>/dev/null; then	CODE
HIGH	…end/src/ee/routes/v1/pam-routers/pam-account-router.ts	1143	elif command -v service &> /dev/null; then	CODE

Excessive Try-Catch Wrapping11 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	backend/bdd/features/steps/pki_acme.py	435	except Exception as exp:	CODE
LOW	backend/bdd/features/steps/pki_acme.py	470	except Exception as exp:	CODE
LOW	backend/bdd/features/steps/pki_acme.py	482	except Exception as exp:	CODE
LOW	backend/bdd/features/steps/pki_acme.py	688	except Exception as exp:	CODE
LOW	backend/bdd/features/steps/pki_acme.py	1076	except Exception as exp:	CODE
LOW	backend/bdd/features/steps/pki_scep.py	76	except Exception:	CODE
LOW	backend/bdd/features/steps/pki_scep.py	436	except Exception:	CODE
MEDIUM	.github/resources/changelog-generator.py	21	print("Error: OPENROUTER_API_KEY is required", file=sys.stderr)	CODE
MEDIUM	.github/resources/changelog-generator.py	25	print("Error: SLACK_WEBHOOK_URL is required", file=sys.stderr)	CODE
LOW	.github/resources/changelog-generator.py	255	except Exception as e:	CODE
MEDIUM	.github/resources/changelog-generator.py	256	print(f"Error: {str(e)}", file=sys.stderr)	CODE

Magic Placeholder Names2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	docs/STYLE_GUIDE.md	264	- Use obvious placeholders: `<your-api-key>`, `<project-id>`, not `abc123` or `foo`	CODE
HIGH	docs/.vale/styles/Infisical/Placeholders.yml	2	message: "Use an obvious placeholder such as '<your-api-key>' instead of '%s'."	CODE

Slop Phrases3 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	…SlugPage/components/ProjectRoleModifySection.utils.tsx	3562	// scott: this structure ensures we don't forget to add project permissions to their relevant project type	COMMENT
MEDIUM	sink/cassandra.yaml	46	# initial_token allows you to specify tokens manually. While you can use it with	COMMENT
MEDIUM	sink/cassandra.yaml	811	# you may want to adjust max_value_size accordingly. This should be positive and less than 2048.	COMMENT

Deep Nesting5 hits · 5 pts

Severity	File	Line	Context
LOW	backend/bdd/features/steps/pki_acme.py	581	CODE
LOW	backend/bdd/features/steps/utils.py	44	CODE
LOW	backend/bdd/features/steps/utils.py	95	CODE
LOW	backend/bdd/features/steps/utils.py	124	CODE
LOW	backend/bdd/features/steps/utils.py	162	CODE

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	backend/bdd/features/steps/pki_acme.py	315	except json.decoder.JSONDecodeError:	CODE

Modern Structural Boilerplate4 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	backend/bdd/features/environment.py	17	logger = logging.getLogger(__name__)	CODE
LOW	backend/bdd/features/steps/pki_acme.py	39	logger = logging.getLogger(__name__)	CODE
LOW	backend/bdd/features/steps/utils.py	19	logger = logging.getLogger(__name__)	CODE
LOW	backend/bdd/features/steps/pki_scep.py	16	logger = logging.getLogger(__name__)	CODE

Modern AI Meta-Vocabulary1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/docs.json	5117	"destination": "/cli/reference#pam-agentic"	CODE

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	sink/cassandra.yaml	995	# Set sstable_preemptive_open_interval to null for disabled which is equivalent to	COMMENT

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	backend/scripts/export-assets.sh	3	# Usage:	COMMENT

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…d/src/server/routes/v1/certificate-authority-router.ts	933	// TODO: implement this endpoint in the future	COMMENT

AI Structural Patterns1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	backend/bdd/features/steps/utils.py	263		CODE

Infisical/infisical

Open-Source Code Quality, Security and Technical Debt Review