2.2

Adjusted Signal

2.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

6.8K

Stars

JavaScript

Language

35.4K

Lines of Code

190

Files

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 53 finding(s).

Hallucinated Dependency & Supply Chain Risk 3.6/100 · LOW

Are imports declared and package/API names verified? 8 finding(s).

Agent Over-Engineering Ratio 6.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 50 finding(s).

PR Review Velocity Impact 10.6/100 · LOW

Which changes need focused human review? 61 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 0MEDIUM 0LOW 59

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 61 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers50 hits · 50 pts

Severity	File	Line	Snippet	Context
LOW	deploy/worker/workerCache.js	35	function responseHasCacheDirective(cacheControl, directive) {	CODE
LOW	functions/file/[[path]].js	310	function getChunkedFileCacheControl(context) {	CODE
LOW	functions/file/[[path]].js	318	async function handleTelegramChunkedFile(context, imgRecord, encodedFileName, fileType) {	CODE
LOW	functions/file/[[path]].js	473	async function fetchTelegramChunkWithRetry(botToken, chunk, proxyUrl = '', maxRetries = 3) {	CODE
LOW	functions/file/[[path]].js	667	async function fetchDiscordChunkWithRetry(botToken, channelId, chunk, proxyUrl, maxRetries = 3) {	CODE
LOW	functions/file/imageTransform.js	81	export function validateImageTransformRequest(request, imageTransform) {	CODE
LOW	functions/file/imageTransform.js	101	export function validateImageTransformSource(imageTransform, env, fileType, fileName) {	CODE
LOW	functions/file/imageTransform.js	121	export async function transformImageRequestViaUrl(context) {	CODE
LOW	functions/file/imageTransform.js	246	function hasConfiguredImageProcessor(env) {	CODE
LOW	functions/file/imageTransform.js	255	function hasConfiguredStreamImageProcessor(env) {	CODE
LOW	functions/file/imageTransform.js	327	function inferImageTypeFromFileName(fileName) {	CODE
LOW	functions/file/fileTools.js	109	function buildUpstreamFileRequestHeaders(requestHeaders) {	CODE
LOW	functions/file/fileTools.js	190	function unauthorizedAdminPreviewResponse() {	CODE
LOW	functions/utils/uploadFormat.js	12	export function normalizeUploadFormatConfig(raw) {	CODE
LOW	functions/utils/uploadFormat.js	21	export function validateUploadFormatConfig(raw) {	CODE
LOW	functions/utils/fileExpiryHelpers.js	50	export function normalizeFileExpiryConfig(raw = {}) {	CODE
LOW	functions/utils/indexManager.js	177	export async function batchRemoveFilesFromIndex(context, fileIds) {	CODE
LOW	functions/utils/indexManager.js	1037	function createUploadTrendAccumulator(files, options) {	CODE
LOW	functions/utils/indexManager.js	1486	function applyBatchRemoveOperation(index, data) {	CODE
LOW	functions/utils/auth/sessionManager.js	151	export async function destroySessionsByAuthType(env, authType) {	CODE
LOW	functions/utils/auth/sessionConfig.js	11	export function normalizeSessionMaxAgeDays(value) {	CODE
LOW	functions/utils/metadata/channelCredentials.js	42	export async function resolveTelegramCredentials(db, env, metadata = {}) {	CODE
LOW	functions/utils/metadata/channelCredentials.js	63	export async function resolveDiscordCredentials(db, env, metadata = {}) {	CODE
LOW	functions/utils/metadata/channelCredentials.js	84	export async function resolveHuggingFaceCredentials(db, env, metadata = {}) {	CODE
LOW	functions/utils/metadata/channelConfig.js	103	function findLegacyTelegramEnvChannel(channels, groupName, metadata = {}) {	CODE
LOW	functions/utils/metadata/channelConfig.js	113	function findChannelByPersistedIdentity(channels, groupName, metadata = {}) {	CODE
LOW	functions/utils/metadata/channelConfig.js	171	function normalizeBooleanIdentityValue(value) {	CODE
LOW	functions/utils/metadata/channelConfig.js	177	function normalizeUrlIdentityValue(value) {	CODE
LOW	functions/utils/metadata/metadataView.js	12	export async function createMetadataViewContext(db, env) {	CODE
LOW	functions/utils/metadata/metadataView.js	21	export async function buildFileMetadataForManagement(db, env, metadata = {}, viewContext = null) {	CODE
LOW	functions/utils/metadata/metadataView.js	34	export async function serializeFileRecordForManagement(db, env, file, viewContext = null) {	CODE
LOW	functions/utils/metadata/metadataView.js	75	function enrichHuggingFaceMetadata(context, sourceMetadata, view) {	CODE
LOW	functions/utils/metadata/metadataSecurity.js	53	export function stripConfigDerivedMetadata(metadata = {}) {	CODE
LOW	functions/utils/metadata/metadataSecurity.js	75	export function stripSensitiveMetadataInPlace(metadata = {}) {	CODE
LOW	functions/utils/metadata/metadataSecurity.js	102	export function stripConfigDerivedMetadataInPlace(metadata = {}) {	CODE
LOW	functions/utils/metadata/metadataSecurity.js	116	export function cleanPersistedMetadataInPlace(metadata = {}) {	CODE
LOW	functions/api/manage/_middleware.js	50	function extractRequiredPermission(pathname) {	CODE
LOW	functions/api/manage/batch/list.js	52	function isChunkedFileNeedingValue(metadata) {	CODE
LOW	functions/api/manage/batch/index/chunk.js	67	function calculateFallbackChecksum(data) {	CODE
LOW	functions/api/manage/sysConfig/security.js	204	function normalizeImageTransformAllowedSizes(value) {	CODE
LOW	functions/api/manage/sysConfig/security.js	244	function normalizeIpQueryResponseFields(fields) {	CODE
LOW	functions/dav/[[path]].js	488	function generateDirectoryListingHtml(basePath, contents) {	CODE
LOW	functions/upload/chunkUpload.js	221	async function uploadChunkToStorageWithTimeout(context, chunkIndex, totalChunks, uploadId, originalFileName, originalFil	CODE
LOW	functions/upload/chunkUpload.js	582	async function uploadSingleChunkToTelegram(context, chunkData, chunkIndex, totalChunks, uploadId, originalFileName, orig	CODE
LOW	functions/upload/chunkUpload.js	646	async function uploadSingleChunkToDiscord(context, chunkData, chunkIndex, totalChunks, uploadId, originalFileName, origi	CODE
LOW	functions/upload/chunkUpload.js	710	async function uploadChunkToDiscordWithRetry(botToken, channelId, chunkBlob, chunkFileName, chunkIndex, totalChunks, max	CODE
LOW	functions/upload/chunkUpload.js	971	export async function cleanupFailedMultipartUploads(context, uploadId, uploadChannel) {	CODE
LOW	functions/upload/chunkUpload.js	1191	export async function uploadLargeFileToTelegram(context, file, fullId, metadata, fileName, fileType, returnLink, tgBotTo	CODE
LOW	functions/upload/chunkUpload.js	1303	async function uploadChunkToTelegramWithRetry(tgBotToken, tgChatId, tgProxyUrl, chunkBlob, chunkFileName, chunkIndex, to	CODE
LOW	functions/upload/huggingface/getUploadUrl.js	140	function rewriteMultipartCompletionUrl(requestUrl, uploadInfo) {	CODE

Hallucination Indicators2 hits · 20 pts

Severity	File	Line	Snippet	Context
CRITICAL	frontend-dist/js/657.6c34e6db.js	1	(self["webpackChunksanyue_imghub"]=self["webpackChunksanyue_imghub"]\|\|[]).push([[657],{3975:function(e,t,i){i(44114),i(1	CODE
CRITICAL	frontend-dist/js/77.299b40eb.js	22	class To{constructor(){this._request=null,this._charts=new Map,this._running=!1,this._lastDate=void 0}_notify(e,t,s,i){c	CODE

Fake / Example Data6 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	frontend-dist/js/604.5b7069c2.js	1	(self["webpackChunksanyue_imghub"]=self["webpackChunksanyue_imghub"]\|\|[]).push([[604],{30604:function(e,t,i){"use strict	CODE
LOW	frontend-dist/js/657.6c34e6db.js	1	(self["webpackChunksanyue_imghub"]=self["webpackChunksanyue_imghub"]\|\|[]).push([[657],{3975:function(e,t,i){i(44114),i(1	CODE
LOW	frontend-dist/js/77.299b40eb.js	22	class To{constructor(){this._request=null,this._charts=new Map,this._running=!1,this._lastDate=void 0}_notify(e,t,s,i){c	CODE
LOW	frontend-dist/js/851.732f2b9d.js	1	"use strict";(self["webpackChunksanyue_imghub"]=self["webpackChunksanyue_imghub"]\|\|[]).push([[851],{9728:function(e,t,i)	CODE
LOW	frontend-dist/js/app.b6b1d908.js	1	(function(){"use strict";var e={457:function(e,a,t){var o=t(94373);const n=o.A.create({baseURL:"/",withCredentials:!0});	CODE
LOW	frontend-dist/js/375.43b3c74e.js	1	(self["webpackChunksanyue_imghub"]=self["webpackChunksanyue_imghub"]\|\|[]).push([[375],{213:function(e,t,o){"use strict";	CODE

Over-Commented Block3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	deploy/worker/wrangler.toml	1	# Cloudflare Workers 部署配置	COMMENT
LOW	deploy/worker/wrangler.toml	41	# [[r2_buckets]]	COMMENT
LOW	.github/workflows/deploy-worker.yml	21	#	COMMENT

MarSeventh/CloudFlare-ImgBed

Open-Source Code Quality, Security and Technical Debt Review