AI Slop Code Risk Monitor

OWASP/wstg

SlopCodeMonitor badge for OWASP/wstg Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

2.5 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for OWASP/wstg, a CSS project with 10,163 GitHub stars. SynthScan examined 35,599 lines of code across 273 source files, recording 63 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 2.5 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

2.5
Adjusted Signal
2.5
Raw Pattern Score
100%
Time Factor
2026-10-30
Last Push
10.2K
Stars
CSS
Language
35.6K
Lines of Code
273
Files
63
Pattern Hits
2026-10-31
Scan Date
0.01
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 41 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.9/100 · LOW

Are imports declared and package/API names verified? 14 finding(s).

Agent Over-Engineering Ratio 5.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 28 finding(s).

PR Review Velocity Impact 10.8/100 · LOW

Which changes need focused human review? 63 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 2MEDIUM 4LOW 57

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 63 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers20 hits · 22 pts
SeverityFileLineSnippetContext
LOWwebsite/scripts/prepare_site.py142def rewrite_markdown_file_links(path: Path) -> None:CODE
LOW⚡website/scripts/prepare_site.py169def convert_readmes_to_redirects(channel_root: Path, channel_path: str) -> None:CODE
LOW⚡website/scripts/prepare_site.py177def set_root_index_to_foreword(channel_root: Path) -> None:CODE
LOW⚡website/scripts/prepare_site.py186def extract_document_from_tag(tag: str, dest: Path) -> None:CODE
LOWwebsite/scripts/prepare_site.py404def remove_stable_content_artifacts() -> None:CODE
LOW.github/ebooks/build-link-manifest.py33def extract_headings_from_json(json_data: dict) -> dict[str, str]:CODE
LOW.github/workflows/scripts/format_lint_output.py166def generate_formatted_output(file_blocks: List[Dict], total_error_count: int) -> str:CODE
LOW.github/json/scripts/generate_checklist_json.py182def _opencre_coerce_total_pages(raw: Any) -> tuple[int, bool]:CODE
LOW.github/json/scripts/generate_checklist_json.py236def _cre_ids_map_from_categories(categories: dict[str, Any]) -> dict[str, list[str]]:CODE
LOW.github/json/scripts/generate_checklist_json.py283def collect_cre_ids_by_test_id(checklist: OrderedDict) -> dict[str, list[str]]:CODE
LOW.github/json/scripts/generate_checklist_json.py301def _sort_test_ids_guide_order(ids: Iterable[str], guide_rank: dict[str, int]) -> list[str]:CODE
LOW.github/json/scripts/generate_checklist_json.py418def category_label_from_dirname(dirname: str) -> str | None:CODE
LOW.github/json/scripts/generate_checklist_json.py447def category_wstg_id_from_intro(category_dir: Path) -> str | None:CODE
LOW.github/json/scripts/generate_checklist_json.py467def is_removed_placeholder_document(content: str) -> bool:CODE
LOW.github/json/scripts/generate_checklist_json.py476def _nonblank_lines_in_objectives_section(content: str) -> list[str]:CODE
LOW.github/json/scripts/generate_checklist_json.py524def first_wstg_id_in_document(content: str) -> str | None:CODE
LOW.github/json/scripts/generate_checklist_json.py536def _objectives_are_empty_or_blank(objectives: list[str]) -> bool:CODE
LOW.github/json/scripts/generate_checklist_json.py562def _write_empty_objectives_report(entries: list[tuple[str, str, str, str]]) -> None:CODE
LOW.github/json/scripts/generate_checklist_json.py590def _cre_guide_status_table_rows(CODE
LOW.github/json/scripts/generate_checklist_json.py612def _write_cre_opencre_summary_report(CODE
Unused Imports12 hits · 12 pts
SeverityFileLineSnippetContext
LOWwebsite/scripts/generate_nav.py4CODE
LOWwebsite/scripts/copy_markdown_for_agents.py8CODE
LOWwebsite/scripts/prepare_site.py11CODE
LOWwebsite/scripts/generate_llms.py9CODE
LOWwebsite/scripts/generate_llms.py11CODE
LOWwebsite/scripts/generate_llms.py12CODE
LOW.github/ebooks/build-link-manifest.py13CODE
LOW.github/ebooks/build-link-manifest.py21CODE
LOW.github/ebooks/fix-typst-body.py12CODE
LOW.github/ebooks/list-chapters.py25CODE
LOW.github/xlsx/scripts/create-google-drive-cred.py2CODE
LOW.github/www/scripts/generate_nav.py4CODE
Verbosity Indicators5 hits · 10 pts
SeverityFileLineSnippetContext
LOW⚡.github/workflows/build-ebooks-typst.yml42 # Step 1: Generate file list with synthetic chapter headingsCOMMENT
LOW⚡.github/workflows/build-ebooks-typst.yml52 # Step 2: Build manifest of real heading identifiersCOMMENT
LOW⚡.github/workflows/build-ebooks-typst.yml58 # Step 3: Set resource paths for image resolutionCOMMENT
LOW⚡.github/workflows/build-ebooks-typst.yml62 # Step 4: PDF generationCOMMENT
LOW.github/workflows/build-ebooks-typst.yml83 # Step 5: EPUB generationCOMMENT
Structural Annotation Overuse5 hits · 10 pts
SeverityFileLineSnippetContext
LOW⚡.github/workflows/build-ebooks-typst.yml42 # Step 1: Generate file list with synthetic chapter headingsCOMMENT
LOW⚡.github/workflows/build-ebooks-typst.yml52 # Step 2: Build manifest of real heading identifiersCOMMENT
LOW⚡.github/workflows/build-ebooks-typst.yml58 # Step 3: Set resource paths for image resolutionCOMMENT
LOW⚡.github/workflows/build-ebooks-typst.yml62 # Step 4: PDF generationCOMMENT
LOW.github/workflows/build-ebooks-typst.yml83 # Step 5: EPUB generationCOMMENT
Excessive Try-Catch Wrapping6 hits · 9 pts
SeverityFileLineSnippetContext
LOWwebsite/scripts/generate_llms.py59 except Exception:CODE
LOW⚡.github/workflows/scripts/format_lint_output.py237 except Exception as e:CODE
LOW⚡.github/workflows/scripts/format_lint_output.py243 except Exception:CODE
MEDIUM⚡.github/workflows/scripts/format_lint_output.py244 print(f"Error: {e}")CODE
LOW.github/json/scripts/generate_checklist_json.py134 except Exception as e:CODE
LOW.github/json/scripts/generate_checklist_json.py390 except Exception as exc:CODE
Deep Nesting7 hits · 7 pts
SeverityFileLineSnippetContext
LOW.github/ebooks/build-link-manifest.py33CODE
LOW.github/ebooks/build-link-manifest.py86CODE
LOW.github/ebooks/build-link-manifest.py40CODE
LOW.github/ebooks/build-link-manifest.py57CODE
LOW.github/json/scripts/generate_checklist_json.py148CODE
LOW.github/json/scripts/generate_checklist_json.py236CODE
LOW.github/json/scripts/generate_checklist_json.py612CODE
Empty Error Handlers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHwebsite/scripts/generate_llms.py59except Exception:CODE
AI Response Leakage1 hit · 5 pts
SeverityFileLineSnippetContext
HIGH…ng/11-Client-side/01-DOM-based_Cross_Site_Scripting.md27An attacker may append `#<script>alert('xss')</script>` to the affected page URL which would, when executed, display theCODE
AI Slop Vocabulary2 hits · 4 pts
SeverityFileLineSnippetContext
MEDIUMwebsite/scripts/generate_llms.py148 """Generate comprehensive markdown concatenation."""STRING
MEDIUMwebsite/scripts/generate_llms.py197 # Generate comprehensive llms-full.txt for latest channelCOMMENT
Modern AI Meta-Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUM…nt_Management/02-Application_Platform_Configuration.md107- Confirm debug/development-mode environment variables are not set as image defaults (e.g. `ENV FLASK_DEBUG=1`, `ENV NODCODE
Fake / Example Data2 hits · 2 pts
SeverityFileLineSnippetContext
LOW…iguration_and_Deployment_Management/06-HTTP_Methods.md159 "email": "foo@example.org"CODE
LOW…lication_Security_Testing/12-API_Testing/99-GraphQL.md575 { "id": 1, "name": "Admin", "email": "admin@example.com" }CODE
Modern Structural Boilerplate1 hit · 2 pts
SeverityFileLineSnippetContext
LOW⚡website/scripts/prepare_site.py177def set_root_index_to_foreword(channel_root: Path) -> None:CODE