1.8

Adjusted Signal

1.8

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

13.1K

Stars

TypeScript

Language

477.4K

Lines of Code

2.9K

Files

733

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 536 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.9/100 · LOW

Are imports declared and package/API names verified? 159 finding(s).

Agent Over-Engineering Ratio 6.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 519 finding(s).

PR Review Velocity Impact 8.6/100 · LOW

Which changes need focused human review? 733 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 4HIGH 1MEDIUM 41LOW 687

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 733 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers481 hits · 487 pts

Severity	File	Line	Snippet	Context
LOW	docs/custom.js	188	function updateQuickstartCopyPageAction() {	CODE
LOW	scripts/sanity-api-sync.ts	151	async function getTemplateIdsReferencingApis(apiIds: string[]): Promise<string[]> {	CODE
LOW	scripts/docs-generate-llms.ts	294	function resolveProviderCatalogConfig(provider: ProviderConfig \| undefined): ProviderCatalogConfig {	CODE
LOW	scripts/docs-generate-llms.ts	434	function routeForExistingProviderPage(route: string, slug: string): string {	CODE
LOW	scripts/docs-generate-llms.ts	447	function routeForExistingOptionalPage(route: string, page: string): string \| undefined {	CODE
LOW	scripts/docs-generate-llms.ts	452	function routeForExistingSetupPage(route: string): string \| undefined {	CODE
LOW	scripts/wrap-dek/gcp-client.ts	20	function lazyImpersonatedKmsClient(targetPrincipal: string): GcpKmsClient {	CODE
LOW	scripts/wrap-dek/gcp-client.ts	36	async function createImpersonatedKmsClient(targetPrincipal: string): Promise<KeyManagementServiceClient> {	CODE
LOW	…ts/one-off/backfill-orb-subscription-dates/backfill.ts	39	async function fetchOrbSubscriptionSchedule(subscriptionId: string): Promise<OrbSubscriptionScheduleItem[]> {	CODE
LOW	scripts/one-off/schedule-payg-migrations/schedule.ts	127	async function getFutureScheduledPlanChange(subscriptionId: string, client: ScheduleClient, now: Date): Promise<OrbSubsc	CODE
LOW	scripts/one-off/schedule-payg-migrations/schedule.ts	148	function getGrowthAddonActivationAt(plannedAt: Date \| null): Date {	CODE
LOW	scripts/one-off/schedule-payg-migrations/schedule.ts	183	async function getActiveSubscriptionsByAccountId(	CODE
LOW	scripts/validation/providers/sync-scopes.ts	419	function getDiffTargetProviderNames(providerMap: ProvidersMap): string[] {	CODE
LOW	scripts/validation/providers/sync-scopes.ts	430	function getExplicitTargetProviderNames(providerMap: ProvidersMap): string[] {	CODE
LOW	scripts/validation/providers/validate.ts	342	function findConnectionConfigReferences(obj: Record<string, any>, path: string[] = []): Ref[] {	CODE
LOW	packages/internal-auth/lib/middleware.ts	59	export function internalServiceAuthMiddleware(opts: {	CODE
LOW	packages/internal-auth/lib/jwt.ts	68	export function keyRegistryFromPublicKeys(entries: readonly InternalAuthPublicKey[] \| undefined, iss: InternalServiceIss	CODE
LOW	packages/internal-auth/lib/credential.ts	17	export function getInternalAuthBearerHeaderIfPresent(token: string \| null \| undefined): Record<string, string> {	CODE
LOW	packages/internal-auth/lib/verify.ts	17	export async function verifyInternalServiceCredential(token: string, audience: string, creds: InternalServiceCredentials	CODE
LOW	packages/internal-auth/lib/token.ts	120	export function createInternalServiceToken(args: CreateInternalServiceTokenArgs, signingKey: string \| null \| undefined):	CODE
LOW	packages/internal-auth/lib/token.ts	138	export function verifyInternalServiceToken(token: string, audience: string, signingKey: string \| null \| undefined): Veri	CODE
LOW	packages/internal-auth/lib/token.ts	170	export function createRunnerDispatchToken(args: CreateInternalServiceTokenArgs, jobsSigningKey: string \| null \| undefine	CODE
LOW	packages/internal-auth/lib/token.ts	185	export function verifyRunnerDispatchToken(token: string, audience: string, runnerPublicKey: string \| null \| undefined):	CODE
LOW	packages/hosted-telemetry/lib/postgres/db.ts	61	export function startHostedTelemetryPartitions(): { abort: () => Promise<void> } \| null {	CODE
LOW	packages/oauth-server/lib/cimd.ts	90	function hasForbiddenRawUrlCodePoint(value: string): boolean {	CODE
LOW	packages/oauth-server/lib/adapter.ts	72	export async function revokeOAuthUserInTransaction({	CODE
LOW	packages/oauth-server/lib/adapter.ts	438	export async function deleteExpiredOAuthArtifacts(knex: Knex, limit: number): Promise<number> {	CODE
LOW	packages/oauth-server/lib/provider.ts	154	function allowClaudeCodeLoopbackPort(client: Client): void {	CODE
LOW	packages/oauth-server/lib/provider.ts	161	function sameClaudeCodeLoopbackRedirectExceptPort(requestedValue: string, registeredValue: string): boolean {	CODE
LOW	packages/oauth-server/lib/provider.ts	187	function requireDashboardAuthentication(): interactionPolicy.DefaultPolicy {	CODE
LOW	packages/oauth-server/lib/provider.ts	210	function installOAuthOnlyMiddleware(provider: Provider): void {	CODE
LOW	packages/records/lib/helpers/uniqueKey.ts	7	export function verifyUniqueKeysAreUnique(records: FormattedRecord[]): { nonUniqueKeys: Set<string> } {	CODE
LOW	packages/keystore/lib/models/privatekeys.ts	141	export async function deletePrivateKeysByEntityUuid(	CODE
LOW	packages/egress/lib/denylist.ts	16	export function canonicalizeHostnameForDenylist(host: string): string {	CODE
LOW	packages/egress/lib/denylist.ts	28	export function formatHostForUrlAuthority(host: string): string {	CODE
LOW	packages/egress/lib/denylist.ts	78	export function mergeProxyBaseUrlOverrideDenylist(customEntries: string[]): string[] {	CODE
LOW	packages/egress/lib/denylist.ts	89	export function resolveProxyBaseUrlOverrideDenylist(raw: string \| undefined): string[] {	CODE
LOW	packages/egress/lib/denylist.ts	121	export function resolveProxyBaseUrlOverrideDenylistForRunner(raw: string \| undefined): string[] {	CODE
LOW	packages/egress/lib/agent.ts	67	export function clearPinnedAddressCacheForTests(): void {	CODE
LOW	packages/egress/lib/validate.ts	126	async function resolveAndValidateAddresses(	CODE
LOW	packages/egress/lib/validate.ts	187	export async function resolveValidatedHostAddresses(hostname: string, policy: OutboundUrlPolicy, url: string): Promise<s	CODE
LOW	packages/egress/lib/validate.ts	214	export function assertSafeOutboundUrlSync(url: string, policy: OutboundUrlPolicy, ctx?: ValidateOutboundUrlContext): URL	CODE
LOW	packages/egress/lib/validate.ts	234	export function isBaseUrlOverrideDeniedByPolicy(url: string, policy: OutboundUrlPolicy): boolean {	CODE
LOW	packages/egress/lib/policy.ts	120	function isBaseUrlOverrideEnabledFromEnv(raw: string \| undefined): boolean {	CODE
LOW	packages/egress/lib/policy.ts	132	export function resolvePolicyForRunnerSync(input: RunnerPolicyEnvInput): OutboundUrlPolicy {	CODE
LOW	packages/egress/lib/policy.ts	151	export function resolvePolicyFromProcessEnvForRunner(): OutboundUrlPolicy {	CODE
LOW	packages/egress/lib/policy.ts	161	export function resolveProxyDenylistFromServerRaw(raw: string \| undefined): string[] {	CODE
LOW	packages/egress/lib/redirect.ts	27	export function absoluteUrlFromRedirectRequestOptions(options: Record<string, unknown>): string \| null {	CODE
LOW	packages/egress/lib/redirect.ts	65	export function createAsyncRedirectValidator(	CODE
LOW	packages/runner/lib/monitor.ts	224	function getRenderTotalMemoryInBytes(): number {	CODE
LOW	packages/runner/lib/sdk/sdk.unit.test.ts	773	function expectInvalidCredentialsInLogs(persistClient: PersistClient, present: boolean): void {	CODE
LOW	packages/webapp/src/features/TokenEditorOverlay.tsx	226	function collectPrimitiveAliasRefs(ref: string): string[] {	CODE
LOW	packages/webapp/src/features/planOverride.ts	107	export function buildPaymentMethodOverride(): GetStripePaymentMethods['Success'] {	CODE
LOW	packages/webapp/src/features/tokenContrast.ts	218	export function deriveContrastRelevantVars(opts: { isKnownToken: (cssVar: string) => boolean; surfaces: string[]; allVar	CODE
LOW	packages/webapp/src/features/tokenEditorPersistence.ts	69	export function syncPersistedOverridesToTheme(theme: ThemeKey) {	CODE
LOW⚡	packages/webapp/src/features/Playground/analytics.ts	11	export function trackPlaygroundRunClicked(properties: AnalyticsEventProperties<'playground:run_start'>) {	CODE
LOW⚡	packages/webapp/src/features/Playground/analytics.ts	15	export function trackPlaygroundRunCompleted(properties: AnalyticsEventProperties<'playground:run_complete'>) {	CODE
LOW⚡	packages/webapp/src/features/Playground/analytics.ts	19	export function trackPlaygroundRunCancelled(properties: AnalyticsEventProperties<'playground:run_cancel'>) {	CODE
LOW	…ges/webapp/src/features/Playground/playground.utils.ts	50	export function validateAndParseInputs(	CODE
LOW	packages/webapp/src/utils/connect-ui.ts	3	export function createConnectUIPreviewIFrame({ baseURL, apiURL, sessionToken, lang }: ConnectUIProps) {	CODE
421 more matches not shown…

Fake / Example Data155 hits · 148 pts

Severity	File	Line	Snippet	Context
LOW	docs/llms-full.txt	10817	"client_name": "Acme Inc",	CODE
LOW	docs/llms-full.txt	10972	"end_user_email": "user@example.com",	CODE
LOW	docs/llms-full.txt	10988	"end_user_email": "user@example.com",	CODE
LOW	docs/llms-full.txt	12198	"end_user_email": "user@example.com",	CODE
LOW	docs/llms-full.txt	12214	"end_user_email": "user@example.com",	CODE
LOW	docs/llms-full.txt	12542	"end_user_email": "user@example.com",	CODE
LOW	packages/node-client/lib/index.unit.test.ts	145	tags: { displayName: 'My User', email: 'user@example.com' }	CODE
LOW	packages/node-client/lib/index.unit.test.ts	156	expect(url.searchParams.get('tags[end_user_email]')).toBe('user@example.com');	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	75	{ id: '1', name: 'John Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	76	{ id: '1', name: 'John Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	77	{ id: '2', name: 'Jane Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	153	{ id: '1', name: 'John Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	154	{ id: '1', name: 'John Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	155	{ id: '2', name: 'Jane Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	480	{ id: '1', name: 'John Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	481	{ id: '1', name: 'John Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	482	{ id: '2', name: 'Jane Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	622	{ id: '1', name: 'John Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	623	{ id: '2', name: 'Jane Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	632	{ id: '1', name: 'John Doe' },	CODE
LOW⚡	…cords/lib/stores/postgres/postgres.integration.test.ts	633	{ id: '2', name: 'Jane Doe' }	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	35	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	36	{ id: '2', name: 'Jane Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	96	{ id: '1', name: 'John Doe' }, // same	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	116	decrypted: { id: '1', name: 'John Doe' }	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	171	{ id: '1', name: 'John Doe' }, // same	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	187	decrypted: { id: '1', name: 'John Doe' }	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	208	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	209	{ id: '2', name: 'Jane Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	288	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	289	{ id: '2', name: 'Jane Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	307	{ id: '1', name: 'John Doe' }, // same	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	308	{ id: '2', name: 'Jane Doe' } // same	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	413	const records = [{ id: '1', person: { name: 'John Doe', age: 35, children: [{ name: 'Jenny Doe', age: 3 }] }	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	463	name: 'John Doe',	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	514	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	515	{ id: '2', name: 'Jane Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	673	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	674	{ id: '2', name: 'Jane Doe' }	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	784	const toInsert = [{ id: '1', name: 'John Doe' }];	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	793	expect(records).toContainEqual(expect.objectContaining({ id: '1', name: 'John Doe' }));	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1020	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1021	{ id: '2', name: 'Jane Doe' }	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1045	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1046	{ id: '2', name: 'Jane Doe' }	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1099	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1100	{ id: '2', name: 'Jane Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1131	const rec1 = { id: '1', name: 'John Doe' };	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1132	const rec2 = { id: '2', name: 'Jane Doe' };	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1253	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1254	{ id: '2', name: 'Jane Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1378	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1379	{ id: '2', name: 'Jane Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1406	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1407	{ id: '2', name: 'Jane Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1436	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1437	{ id: '2', name: 'Jane Doe' }	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1473	{ id: '1', name: 'John Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1474	{ id: '2', name: 'Jane Doe' },	CODE
LOW	…cords/lib/stores/postgres/postgres.integration.test.ts	1587	{ id: '1', name: 'John Doe' },	CODE
95 more matches not shown…

Decorative Section Separators38 hits · 114 pts

Severity	File	Line	Snippet	Context
MEDIUM	packages/webapp/src/features/tokenContrast.ts	89	// ── Colour math (WCAG 2.x) ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/webapp/src/features/tokenContrast.ts	180	// ── Intent-table walking ─────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/webapp/src/components/PlainChat.tsx	10	// ─── Plain types ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/webapp/src/components/PlainChat.tsx	131	// ─── PlainChat ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…ages/webapp/src/pages/Environment/Settings/ApiKeys.tsx	73	// ── Scope selector with dropdown + collapsible groups ───────────────	COMMENT
MEDIUM	…ages/webapp/src/pages/Environment/Settings/ApiKeys.tsx	226	// ── Create dialog ───────────────────────────────────────────────────	COMMENT
MEDIUM	…ages/webapp/src/pages/Environment/Settings/ApiKeys.tsx	312	// ── Key configuration page ──────────────────────────────────────────	COMMENT
MEDIUM	…ages/webapp/src/pages/Environment/Settings/ApiKeys.tsx	420	// ── Delete button with self-managed open state ─────────────────────	COMMENT
MEDIUM	…ages/webapp/src/pages/Environment/Settings/ApiKeys.tsx	449	// ── Managed secret key (env var) ────────────────────────────────────	COMMENT
MEDIUM	…ages/webapp/src/pages/Environment/Settings/ApiKeys.tsx	484	// ── Main component ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/server/lib/authz/authz.integration.test.ts	27	// ── Helpers ──────────────────────────────────────────────	COMMENT
MEDIUM	packages/server/lib/authz/authz.integration.test.ts	102	// ── Administrator — always allowed ──────────────────────	COMMENT
MEDIUM	packages/server/lib/authz/authz.integration.test.ts	173	// ── production_support — denied writes on prod ──────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	60	// ── Integrations ────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	132	// ── Connections ──────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	176	// ── Connect Sessions ────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	192	// ── Agent Sessions ──────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	208	// ── Deploy ───────────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	224	// ── Records ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	240	// ── Syncs ────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	270	// ── Actions ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	292	// ── V1 passthrough (deprecated) ───────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	400	// ── Proxy ────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	416	// ── Config ───────────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	460	// ── MCP ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	476	// ── Wildcard ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	507	// ── Credential stripping ─────────────────────────────────────────	COMMENT
MEDIUM	…rs/v1/environment/scopeEnforcement.integration.test.ts	698	// ── Internal script key (Nango-Is-Script header) ────────────────	COMMENT
MEDIUM	…/design-system/tokens/stories/ColorPalette.stories.tsx	15	// ─── Semantic data ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/design-system/tokens/stories/ColorPalette.stories.tsx	23	// ─── Primitive data ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/design-system/tokens/stories/ColorPalette.stories.tsx	70	// ─── Stories ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…es/design-system/tokens/stories/Typography.stories.tsx	88	// ─── Stories ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/design-system/src/components/ui/button.tsx	149	// ─── Button ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/design-system/src/components/ui/button.tsx	193	// ─── IconButton ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/billing/lib/clients/orb/adapters.unit.test.ts	19	// ─── toOrbPutCustomerPayload ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/billing/lib/clients/orb/adapters.unit.test.ts	123	// ─── fromOrbCustomer ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/billing/lib/clients/orb/adapters.unit.test.ts	181	// ─── fromOrbAddress ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/billing/lib/clients/orb/adapters.unit.test.ts	195	// ─── orbMetricToUsageMetric ───────────────────────────────────────────────────	COMMENT

Structural Annotation Overuse29 hits · 46 pts

Severity	File	Line	Snippet	Context
LOW	.agents/skills/agent-builder-skill/SKILL.md	63	### Step 1: Identify the Use Case	COMMENT
LOW	.agents/skills/agent-builder-skill/SKILL.md	77	### Step 2: Design Agent Scope	COMMENT
LOW	.agents/skills/agent-builder-skill/SKILL.md	92	### Step 3: Write the System Prompt	COMMENT
LOW	.agents/skills/agent-builder-skill/SKILL.md	173	### Step 4: Configure Tools Access	COMMENT
LOW	.agents/skills/agent-builder-skill/SKILL.md	217	### Step 5: Choose Model	COMMENT
LOW	.agents/skills/agent-builder-skill/SKILL.md	261	### Step 6: Write Clear Description	COMMENT
LOW	docs/llms-full.txt	8901	### Step 1: Add a checkpoint schema to your sync declaration	COMMENT
LOW	docs/llms-full.txt	8934	### Step 2: Replace `lastSyncDate` reads with `getCheckpoint()`	COMMENT
LOW	docs/llms-full.txt	8970	### Step 3: Add `saveCheckpoint()` calls after each batch	COMMENT
LOW	docs/llms-full.txt	9017	### Step 4: Test locally	COMMENT
LOW	docs/llms-full.txt	9027	### Step 5: Deploy	COMMENT
LOW	docs/llms-full.txt	9080	### Step 1: Start sending tags for new connect sessions	COMMENT
LOW	docs/llms-full.txt	9123	### Step 2: Update webhook reconciliation to use `tags`	COMMENT
LOW	docs/llms-full.txt	9145	### Step 3: Existing connections are already backfilled	COMMENT
LOW	docs/llms-full.txt	9162	### Step 4: Stop using `end_user`	COMMENT
LOW	docs/llms-full.txt	9227	### Step 1: Attach tags to all existing connections	COMMENT
LOW	docs/llms-full.txt	9269	### Step 2: Implement the Connect and reconnect flows	COMMENT
LOW	docs/llms-full.txt	9275	### Step 3: Clean up	COMMENT
LOW⚡	…/server/lib/webhook/connectwise-psa-webhook-routing.ts	73	// Step 1: Hash the shared secret key with SHA256	COMMENT
LOW⚡	…/server/lib/webhook/connectwise-psa-webhook-routing.ts	76	// Step 2: Compute HMAC-SHA256 of the payload using the hashed key	COMMENT
LOW⚡	…/server/lib/webhook/connectwise-psa-webhook-routing.ts	79	// Step 3: Compare signatures using timing-safe comparison	COMMENT
LOW	packages/design-system/AGENTS.md	13	### Step 1: Generate the base with shadcn CLI	COMMENT
LOW	packages/design-system/AGENTS.md	24	### Step 2: Replace shadcn CSS variables with design tokens	COMMENT
LOW	packages/design-system/AGENTS.md	131	### Step 3: Follow the component pattern	COMMENT
LOW	packages/design-system/AGENTS.md	181	### Step 4: Add a Storybook story	COMMENT
LOW	packages/design-system/AGENTS.md	206	### Step 5: Export from the barrel	COMMENT
LOW	.github/workflows/managed-release.yaml	129	# Step 1: Wait for PostgreSQL to be ready	COMMENT
LOW	.github/workflows/managed-release.yaml	150	# Step 2: Perform rolling restart of nango-self-server deployment	COMMENT
LOW	.github/workflows/managed-release.yaml	164	# Step 3: Wait for other pods to start successfully	COMMENT

Hallucination Indicators4 hits · 40 pts

Severity	File	Line	Snippet	Context
CRITICAL	…rver/lib/webhook/dispatch-queue/publisher.unit.test.ts	355	expect(tracerMocks.span.setTag.mock.calls.filter(([tag]) => tag === 'error')).toHaveLength(0);	CODE
CRITICAL	…/lib/controllers/v1/account/signin.integration.test.ts	153	expect(verification.json.data.user.email.toLowerCase()).toBe(email.toLowerCase());	CODE
CRITICAL	…es/server/lib/controllers/connection/getConnections.ts	17	endUserId: bodySchema.shape.end_user.shape.id.optional(),	CODE
CRITICAL	…es/server/lib/controllers/connection/getConnections.ts	19	endUserOrganizationId: bodySchema.shape.end_user.shape.id.optional(),	CODE

Over-Commented Block14 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	docker-compose.yaml	81	# hard: -1	COMMENT
LOW	packages/records/lib/stores/postgres/postgres.ts	141	// same transaction: the partition is empty at that point so the (non-	COMMENT
LOW	packages/types/lib/plans/http.api.ts	121	// Subset of UsageMetric carried as repeated-key array	COMMENT
LOW	…ges/webapp/src/components/patterns/chart/ChartCard.tsx	121		COMMENT
LOW	packages/connect-ui/src/lib/zod-config.ts	1	import * as z from 'zod';	COMMENT
LOW	packages/server/lib/clients/oauth1.client.ts	61	);	COMMENT
LOW	packages/server/lib/utils/express.ts	1	import type { Principal } from '@nangohq/authz';	COMMENT
LOW	…rver/lib/controllers/v1/plans/usage/getBillingUsage.ts	101	breakdown: breakdownSchema,	COMMENT
LOW	…/lib/controllers/v1/user/patchUser.integration.test.ts	41	});	COMMENT
LOW	…llers/v1/team/users/deleteTeamUser.integration.test.ts	61		COMMENT
LOW	…llers/v1/team/users/deleteTeamUser.integration.test.ts	81	// const listAfter = await api.fetch('/api/v1/team', { method: 'GET', query: { env: 'dev' }, token: env.secret_k	COMMENT
LOW	…es/usage/lib/clickhouse/clickhouse.integration.test.ts	361	}	COMMENT
LOW	packages/usage/lib/clickhouse/clickhouse.query.ts	201	// `batches` is the number of distinct `batch_id`s for the day (NOT the row	COMMENT
LOW	packages/cli/lib/index.ts	141	# Recommendation: in a ".env" file in ./nango-integrations.	COMMENT

Verbosity Indicators6 hits · 11 pts

Severity	File	Line	Snippet	Context
LOW⚡	…/server/lib/webhook/connectwise-psa-webhook-routing.ts	73	// Step 1: Hash the shared secret key with SHA256	COMMENT
LOW⚡	…/server/lib/webhook/connectwise-psa-webhook-routing.ts	76	// Step 2: Compute HMAC-SHA256 of the payload using the hashed key	COMMENT
LOW⚡	…/server/lib/webhook/connectwise-psa-webhook-routing.ts	79	// Step 3: Compare signatures using timing-safe comparison	COMMENT
LOW	.github/workflows/managed-release.yaml	129	# Step 1: Wait for PostgreSQL to be ready	COMMENT
LOW	.github/workflows/managed-release.yaml	150	# Step 2: Perform rolling restart of nango-self-server deployment	COMMENT
LOW	.github/workflows/managed-release.yaml	164	# Step 3: Wait for other pods to start successfully	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	packages/kvstore/lib/InMemoryStore.ts	163	// AI generated - works well for `usage::something:`	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	packages/providers/providers.scopes.yaml	2753	# source: https://developer.datev.de/en/guides/authentication (no comprehensive scopes list or discovery endpoint found)	COMMENT
MEDIUM	packages/connect-ui/src/lib/theme.ts	79	// Create a temporary element to leverage browser's color parsing	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/managed-release.yaml	79	# Create a new kind cluster for testing	COMMENT

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	.github/workflows/managed-release.yaml	210	# Check if any pods are not running	COMMENT

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…lib/middleware/productTracking.middleware.unit.test.ts	24	function handleRequest(resolve: (locals: Partial<RequestLocals>) => void, req = fakeRequest()): void {	CODE

NangoHQ/nango

Open-Source Code Quality, Security and Technical Debt Review