0.6

Adjusted Signal

0.6

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

15.2K

Stars

JavaScript

Language

398.5K

Lines of Code

5.4K

Files

154

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 71 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.6/100 · LOW

Are imports declared and package/API names verified? 75 finding(s).

Agent Over-Engineering Ratio 1.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 68 finding(s).

PR Review Velocity Impact 2.7/100 · LOW

Which changes need focused human review? 154 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 5HIGH 0MEDIUM 9LOW 140

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 154 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Fake / Example Data70 hits · 75 pts

Severity	File	Line	Snippet	Context
LOW⚡	test/flags.js	1201	note: 'lorem ipsum dolor sit amet',	CODE
LOW⚡	test/flags.js	1201	note: 'lorem ipsum dolor sit amet',	CODE
LOW⚡	test/flags.js	1208	assert.strictEqual('lorem ipsum dolor sit amet', response.notes[0].content);	CODE
LOW⚡	test/flags.js	1208	assert.strictEqual('lorem ipsum dolor sit amet', response.notes[0].content);	CODE
LOW	test/user.js	198	username: 'Jane Doe',	CODE
LOW	test/user.js	208	username: 'Jane Doe',	CODE
LOW	test/user.js	281	content: 'lorem ipsum',	CODE
LOW	test/user.js	298	content: 'lorem ipsum',	CODE
LOW	test/user.js	315	content: 'lorem ipsum',	CODE
LOW	test/user.js	2366	User.deleteInvitation('doesnotexist', 'test@test.com', (err) => {	CODE
LOW	test/user.js	2743	content: 'lorem ipsum',	CODE
LOW	test/translator.js	686	Translator.removePatterns('Lorem ipsum dolor [[sit:amet]], consectetur adipiscing elit. [[sed:vitae, [[semper:dolor]	CODE
LOW	test/translator.js	687	'Lorem ipsum dolor , consectetur adipiscing elit. lorem'	CODE
LOW	test/activitypub.js	451	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub.js	451	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/emailer.js	20	const email = 'test@example.org';	CODE
LOW	test/emailer.js	129	const from = 'admin@example.org';	CODE
LOW	test/emailer.js	181	recipientUid = await user.create({ username: 'recipient', email: 'test@example.org' }, {	CODE
LOW⚡	test/user/emails.js	48	const email = 'test@example.org';	CODE
LOW⚡	test/user/emails.js	55	const email = 'test@example.org';	CODE
LOW⚡	test/user/emails.js	65	const email = 'test@example.org';	CODE
LOW	test/user/emails.js	83	const email = 'test@example.org';	CODE
LOW	test/user/emails.js	97	const email = 'test@example.org';	CODE
LOW	test/user/emails.js	132	const email = 'test@example.org';	CODE
LOW	test/user/emails.js	142	const email = 'test@example.org';	CODE
LOW	test/user/emails.js	160	username: 'fake-user',	CODE
LOW	test/user/emails.js	210	const { response } = await helpers.request('post', `/api/v3/users/${userObj.uid}/emails/${encodeURIComponent('fake@exa	CODE
LOW	test/user/emails.js	290	const { response } = await helpers.request('get', `/api/v3/users/${attackerUid}/emails/${encodeURIComponent('nonexiste	CODE
LOW	test/user/blocks.js	16	email: 'blockee@example.org',	CODE
LOW	test/user/blocks.js	21	email: 'blocker@example.org',	CODE
LOW⚡	test/api/schema.js	195	const adminUid = await user.create({ username: 'admin', password: '123456', email: 'test@example.org' }, { emailVerific	CODE
LOW⚡	test/api/schema.js	196	const unprivUid = await user.create({ username: 'unpriv', password: '123456', email: 'unpriv@example.org' }, { emailVer	CODE
LOW⚡	test/api/schema.js	197	const emailConfirmationUid = await user.create({ username: 'emailConf', email: 'emailConf@example.org' });	CODE
LOW	test/api/schema.js	438	activitypub.helpers._webfingerCache.set('foobar@example.org', { actorUri: 'https://example.org/foobar' });	CODE
LOW	test/activitypub/notes.js	380	content: 'Guaranteed to be more than 500 characters.\n\nLorem ipsum dolor sit amet, consectetur adipiscing elit. I	CODE
LOW	test/activitypub/notes.js	380	content: 'Guaranteed to be more than 500 characters.\n\nLorem ipsum dolor sit amet, consectetur adipiscing elit. I	CODE
LOW	test/activitypub/actors.js	58	activitypub.helpers._webfingerCache.set('example@example.org', { actorUri });	CODE
LOW	test/activitypub/actors.js	179	activitypub.helpers._webfingerCache.set('foobar@example.org', {	CODE
LOW	test/activitypub/actors.js	185	const { actorUri: confirm } = await activitypub.helpers.query('foobar@example.org');	CODE
LOW	test/activitypub/actors.js	703	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/actors.js	703	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/actors.js	736	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/actors.js	736	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/actors.js	763	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/actors.js	763	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/actors.js	801	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/actors.js	801	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/actors.js	832	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/actors.js	832	content: 'Lorem ipsum dolor sit amet',	CODE
LOW	test/activitypub/mocks.js	37	content: 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.\	CODE
LOW	test/activitypub/mocks.js	37	content: 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.\	CODE
LOW	test/activitypub/mocks.js	53	content: 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.\	CODE
LOW	test/activitypub/mocks.js	53	content: 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.\	CODE
LOW	test/activitypub/mocks.js	78	assert.strictEqual(this.withBreak.summary, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.\	CODE
LOW	test/activitypub/mocks.js	78	assert.strictEqual(this.withBreak.summary, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.\	CODE
LOW	test/activitypub/mocks.js	101	assert.strictEqual(mocked.summary, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.\	CODE
LOW	test/activitypub/mocks.js	101	assert.strictEqual(mocked.summary, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.\	CODE
LOW	test/activitypub/mocks.js	123	assert.strictEqual(mocked.summary, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. [...]');	CODE
LOW	test/activitypub/mocks.js	123	assert.strictEqual(mocked.summary, 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. [...]');	CODE
LOW	test/activitypub/mocks.js	148	content: 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. ' +	CODE
10 more matches not shown…

Hyper-Verbose Identifiers60 hits · 62 pts

Severity	File	Line	Snippet	Context
LOW	public/src/admin/federation/analytics.js	76	async function renderActivitiesByTypeLegend() {	CODE
LOW	public/src/modules/helpers.common.js	202	function generateCategoryBackground(category) {	CODE
LOW	public/src/modules/helpers.common.js	231	function generateChildrenCategories(category) {	CODE
LOW	public/src/modules/navigator.js	183	async function updateThumbTimestampToIndex(thumb, index) {	CODE
LOW	public/src/modules/chat.js	495	function makeModalResizeableDraggable(chatModal, uuid) {	CODE
LOW	public/src/modules/notifications.js	162	function scrollToPostIndexIfOnPage(notifEl) {	CODE
LOW	public/src/modules/messages.js	30	function hideAlertAndGotoEditEmail() {	CODE
LOW	public/src/client/post-queue.js	33	function replaceRelativeUploadPath(url) {	CODE
LOW	public/src/client/category.js	99	function handleLoadMoreSubcategories() {	CODE
LOW	public/src/client/chats.js	343	function getTopVisibleMessageIndex(el) {	CODE
LOW	public/src/client/chats.js	358	function updateUrlWithMessageIndex(roomId, el) {	CODE
LOW	public/src/client/groups/memberlist.js	119	function handleMemberInfiniteScroll() {	CODE
LOW	public/src/client/groups/details.js	336	function updatePendingAlertVisibility() {	CODE
LOW	public/src/client/groups/details.js	343	function updateInviteAlertVisibility() {	CODE
LOW	public/src/client/topic/events.js	67	function updatePostVotesAndUserReputation(data) {	CODE
LOW	public/src/client/topic/posts.js	57	function updateNavigatorLastPostTimestamp(post) {	CODE
LOW	public/src/client/topic/posts.js	429	function hidePostToolsForDeletedPosts(posts) {	CODE
LOW	public/src/client/account/settings.js	229	function handleNotificationToggles() {	CODE
LOW	src/flags.js	1123	async function mergeUsernameEmailChanges(history, targetUid, uids) {	CODE
LOW	src/install.js	417	async function createGlobalModeratorsGroup() {	CODE
LOW	src/notifications.js	28	function getOrCreateCache() {	CODE
LOW	src/middleware/user.js	320	async function requiresEmailConfirmation(req) {	CODE
LOW	src/middleware/render.js	148	async function loadClientHeaderFooterData(req, res, options) {	CODE
LOW	src/middleware/render.js	252	async function loadAdminHeaderFooterData(req, res, options) {	CODE
LOW	src/middleware/uploads.js	94	function normalizeUploadRequestPath(requestPath) {	CODE
LOW	src/database/index.js	40	function promisifySessionStoreMethod(method, sid) {	CODE
LOW	src/database/mongo/sorted.js	404	async function getSortedSetsMembersWithScores(keys, withScores) {	CODE
LOW	src/posts/delete.js	97	async function deleteFromTopicUserNotification(postData) {	CODE
LOW	src/posts/delete.js	169	async function deleteFromCategoryRecentPosts(postData) {	CODE
LOW	src/posts/uploads.js	89	function getUploadsFromPostContent(content) {	CODE
LOW	src/user/posts.js	152	async function incrementUserFieldAndSetBy(uid, field, set, value) {	CODE
LOW	src/user/auth.js	135	async function revokeSessionsAboveThreshold(activeSids, uid) {	CODE
LOW⚡	src/user/delete.js	186	async function deleteUserFromFollowedTopics(uid) {	CODE
LOW⚡	src/user/delete.js	191	async function deleteUserFromIgnoredTopics(uid) {	CODE
LOW⚡	src/user/delete.js	196	async function deleteUserFromFollowedTags(uid) {	CODE
LOW	src/user/picture.js	198	function generateProfileImageFilename(uid, extension) {	CODE
LOW	src/user/picture.js	247	async function getPicturePathFromUserField(uid, field) {	CODE
LOW	src/user/approval.js	151	async function getRegistrationQueuedMessage() {	CODE
LOW	src/groups/invite.js	84	async function inviteOrRequestMembership(groupName, uids, type) {	CODE
LOW	src/groups/delete.js	58	async function removeGroupsFromPublicRooms(groupNames) {	CODE
LOW	src/groups/delete.js	74	async function removeGroupsFromPostEditors(groupNames) {	CODE
LOW	src/groups/delete.js	82	async function removeGroupsFromPrivilegeGroups(groupNames) {	CODE
LOW	src/cli/package-install.js	96	function getPackageManagerByLockfile() {	CODE
LOW	src/privileges/helpers.js	136	async function isSystemGroupAllowedToCids(privilege, uid, cids) {	CODE
LOW	src/privileges/helpers.js	141	async function isSystemGroupAllowedToPrivileges(privileges, uid, cid) {	CODE
LOW	src/socket.io/admin/categories.js	21	async function copyPrivilegesToChildrenRecursive(parentCid, category, group, filter) {	CODE
LOW	src/api/users.js	532	async function isPrivilegedOrSelfAndPasswordMatch(caller, data) {	CODE
LOW	src/controllers/search.js	209	async function buildSelectedCategoryLabel(selectedCids) {	CODE
LOW	src/controllers/authentication.js	82	async function validateRegistrationPolicy(userData) {	CODE
LOW	src/controllers/admin/admins-mods.js	47	async function getModeratorsOfCategories(categoryData) {	CODE
LOW	src/categories/create.js	129	async function duplicateCategoriesChildren(parentCid, cid, uid) {	CODE
LOW	src/routes/feeds.js	332	async function generateForCategoryRecentPosts(req, res, next) {	CODE
LOW	src/topics/unread.js	241	async function filterTidsThatHaveBlockedPosts(params) {	CODE
LOW	src/topics/unread.js	258	async function doesTidHaveUnblockedUnreadPosts(tid, params) {	CODE
LOW	src/topics/posts.js	320	async function incrementFieldAndUpdateSortedSet(tid, field, by, set) {	CODE
LOW	src/topics/delete.js	155	async function deleteFromFollowersIgnorers(tids) {	CODE
LOW	src/topics/delete.js	196	async function deleteTopicsFromCategoryAndUser(topicsData) {	CODE
LOW	src/topics/index.js	238	function mergeConsecutiveShareEvents(arr) {	CODE
LOW	src/topics/sorted.js	135	async function getTidsWithMostPostsInTerm({ cids, uid, term, includeRemote }) {	CODE
LOW	src/topics/teaser.js	115	async function getPreviousNonBlockedPost(postData, blockedUids) {	CODE

Hallucination Indicators5 hits · 50 pts

Severity	File	Line	Snippet	Context
CRITICAL	public/src/ajaxify.js	319	ajaxify.data._header.tags.meta.forEach(async (tagObj) => {	CODE
CRITICAL	public/src/ajaxify.js	339	ajaxify.data._header.tags.link.forEach(async (tagObj) => {	CODE
CRITICAL	public/src/admin/manage/privileges.js	469	const privilegeSet = ajaxify.data.privileges.keys.groups.reduce(function (memo, cur, index) {	CODE
CRITICAL	public/src/admin/manage/privileges.js	507	const privilegeSet = ajaxify.data.privileges.keys.users.reduce(function (memo, cur, index) {	CODE
CRITICAL	src/socket.io/index.js	308	const roomMap = Sockets.server.sockets.adapter.rooms.get(room);	CODE

Decorative Section Separators8 hits · 24 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/activitypub/blocklists.js	50	// ─── blocklists.list() ───────────────────────────────────────────────	COMMENT
MEDIUM	test/activitypub/blocklists.js	105	// ─── blocklists.get() ────────────────────────────────────────────────	COMMENT
MEDIUM	test/activitypub/blocklists.js	143	// ─── blocklists.add() ────────────────────────────────────────────────	COMMENT
MEDIUM	test/activitypub/blocklists.js	173	// ─── blocklists.remove() ─────────────────────────────────────────────	COMMENT
MEDIUM	test/activitypub/blocklists.js	215	// ─── blocklists.refresh() ────────────────────────────────────────────	COMMENT
MEDIUM	test/activitypub/blocklists.js	297	// ─── blocklists.check() ──────────────────────────────────────────────	COMMENT
MEDIUM	test/activitypub/blocklists.js	378	// ─── blocklists.getSeverity() ────────────────────────────────────────	COMMENT
MEDIUM	test/activitypub/blocklists.js	414	// ─── Full lifecycle integration ──────────────────────────────────────	COMMENT

Verbosity Indicators4 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	test/activitypub/notes.js	861	// Step 1: Assert a note addressed to the remote category in cc	COMMENT
LOW⚡	test/activitypub/notes.js	876	// Step 2: Announce from the same remote category	COMMENT
LOW⚡	test/activitypub/notes.js	886	// Step 3: Verify the topic was moved to the remote category	COMMENT
LOW	src/activitypub/helpers.js	284	// Step 1: Backreference — non-strict query on domain B (the actor's id host).	COMMENT

Structural Annotation Overuse4 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	test/activitypub/notes.js	861	// Step 1: Assert a note addressed to the remote category in cc	COMMENT
LOW⚡	test/activitypub/notes.js	876	// Step 2: Announce from the same remote category	COMMENT
LOW⚡	test/activitypub/notes.js	886	// Step 3: Verify the topic was moved to the remote category	COMMENT
LOW	src/activitypub/helpers.js	284	// Step 1: Backreference — non-strict query on domain B (the actor's id host).	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	install/docker/entrypoint.sh	180	# Create a local array to work with	COMMENT

Over-Commented Block1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	public/scss/overrides.scss	1	// global bs5 overrides if necessary	COMMENT

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	public/src/client/topic/postTools.js	374	function getData(button, data) {	CODE

NodeBB/NodeBB

Open-Source Code Quality, Security and Technical Debt Review