1.7

Adjusted Signal

1.7

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

3.6K

Stars

Language

283.5K

Lines of Code

971

Files

306

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 249 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.7/100 · LOW

Are imports declared and package/API names verified? 25 finding(s).

Agent Over-Engineering Ratio 2.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 33 finding(s).

PR Review Velocity Impact 6.7/100 · LOW

Which changes need focused human review? 306 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 3MEDIUM 36LOW 267

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 306 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block126 hits · 123 pts

Severity	File	Line	Snippet	Context
LOW	docker/build.sh	1	#!/usr/bin/env bash	COMMENT
LOW	docker/docker-compose.yml	1	# =============================================================================	COMMENT
LOW	frontend/src/main.jsx	1	import { QueryClient, QueryClientProvider } from "@tanstack/react-query";	COMMENT
LOW	frontend/src/contexts/AuthContext.jsx	161	// Detect fresh OIDC/Discord SSO return. Backend sets HttpOnly auth cookies then 302s	COMMENT
LOW	frontend/src/utils/hostStatus.js	1	// Reporting-state derivation shared by the Hosts table, the Reporting filter	COMMENT
LOW	frontend/src/components/PatchWizard.jsx	201	(presetHosts \|\| []).length > 0 &&	COMMENT
LOW	frontend/src/components/PatchWizard.jsx	221	).join(",")}\|P:${(packageNames \|\| []).join("\n")}`;	COMMENT
LOW	frontend/src/components/PatchWizard.jsx	601	currentStepId === "timing" \|\|	COMMENT
LOW	frontend/src/components/HostStatusPills.jsx	161	? "WebSocket disconnected, within grace window"	COMMENT
LOW	frontend/src/hooks/usePageRefresh.js	21	// marks exactly the window a refresh is responsible for.	COMMENT
LOW	frontend/src/pages/Billing.jsx	741	)}	COMMENT
LOW	frontend/src/pages/Billing.jsx	821	// The commit input appears on ANY annual selection — upgrade, downgrade,	COMMENT
LOW	frontend/src/pages/Billing.jsx	881	// nav badges (Patching, Docker, Compliance, etc.) reflect the new	COMMENT
LOW	frontend/src/pages/Login.jsx	141	};	COMMENT
LOW	…rce-code/cmd/patchmon-agent/commands/version_update.go	901	logger.Debug("Detected systemd, scheduling service restart via helper script")	COMMENT
LOW	…rce-code/cmd/patchmon-agent/commands/version_update.go	1021	// Create a helper script that will restart the service after we exit	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	1621	)	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	2461	// patchStepWaitDelay is how long a step allows for the process to exit and then	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/report.go	581	logger.WithFields(logrus.Fields{	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/report.go	601	// regardless of the hash compare. Ticks are numbered from 1 and count only	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/report.go	621	// computes per-section hashes, pings the server, and on a non-empty	COMMENT
LOW	agent-source-code/internal/config/config.go	501	configViper.Set("apk_secdb", map[string]interface{}{	COMMENT
LOW	agent-source-code/internal/config/transient_windows.go	1	//go:build windows	COMMENT
LOW	agent-source-code/internal/utils/offset.go	1	// Package utils provides utility functions for common operations	COMMENT
LOW	agent-source-code/internal/textsan/textsan.go	1	// Package textsan normalises text collected from the host before the agent	COMMENT
LOW	agent-source-code/internal/system/reboot.go	301	// can never match a running release such as 6.12.4-arch1-1.	COMMENT
LOW	agent-source-code/internal/packages/pacman.go	201	return pkgs, nil	COMMENT
LOW	…rce-code/internal/packages/windows_integration_test.go	21	// customer's machine. These tests are the only thing that executes those	COMMENT
LOW	agent-source-code/internal/packages/apt.go	241	}	COMMENT
LOW	agent-source-code/internal/packages/apt.go	381	// Inst linux-generic [6.8.0-136.136] (6.8.0-137.137 Ubuntu:24.04/noble-updates [amd64]) []	COMMENT
LOW	agent-source-code/internal/packages/apt_test.go	101	assert.Equal(t, len(tt.expected), len(result))	COMMENT
LOW	agent-source-code/internal/winexec/powershell.go	1	// Package winexec centralises how the agent shells out to Windows PowerShell.	COMMENT
LOW	agent-source-code/internal/winexec/powershell.go	21	// writes that preamble to a redirected stream varies by runtime, so the	COMMENT
LOW	agent-source-code/internal/pkgversion/version.go	1	// Package pkgversion provides version information for the agent	COMMENT
LOW	agent-source-code/pkg/models/models.go	221	// (v2.0.3+). Pre-2.0.3 servers ignore the ping body entirely and answer	COMMENT
LOW	docs/patchmon-operator-guide.md	5761	```yaml	COMMENT
LOW	docs/patchmon-operator-guide.md	5781	# equals the agent version once the agent has loaded this file.	COMMENT
LOW	docs/patchmon-operator-guide.md	5801	# Skip SSL certificate verification when connecting to the server.	COMMENT
LOW	docs/patchmon-operator-guide.md	5821	# Integration toggles control optional agent features.	COMMENT
LOW	docs/patchmon-operator-guide.md	5841	# Can be toggled from the PatchMon UI.	COMMENT
LOW	docs/patchmon-operator-guide.md	5861		COMMENT
LOW	.github/workflows/agent-scripts.yml	1	name: Agent scripts	COMMENT
LOW	.github/workflows/docker.yml	281	pull-requests: write	COMMENT
LOW	.github/workflows/docker.yml	401	provenance: false	COMMENT
LOW	.github/workflows/docker.yml	421	# the GHCR build above and the Harbor build below keep `provenance: false`	COMMENT
LOW	.github/workflows/docker.yml	521	context: .	COMMENT
LOW	.github/actions/release-context/action.yml	81	# Why not just the last tag: an :edge image built from main contains	COMMENT
LOW	server-source-code/cmd/server/startup_checks.go	21	// 100->150, 200->300.	COMMENT
LOW	server-source-code/cmd/server/startup_checks.go	81	// This gives roughly 1.5 connections per active host, which covers concurrent	COMMENT
LOW	server-source-code/internal/handler/compliance.go	1241	}	COMMENT
LOW	server-source-code/internal/handler/compliance.go	1261	// report a re-install on a working host as already complete.	COMMENT
LOW	server-source-code/internal/handler/marketing.go	61	return nil	COMMENT
LOW	server-source-code/internal/handler/billing.go	1	// Package handler - billing.go implements the two thin proxy endpoints that back	COMMENT
LOW	server-source-code/internal/handler/billing.go	81	// currentTenantID returns the context ("tenant") id from the multi-context registry.	COMMENT
LOW	server-source-code/internal/handler/billing.go	321	// PostMyBillingTierChange returns the handler for POST /me/billing/tier-change.	COMMENT
LOW	server-source-code/internal/handler/billing.go	341	// 3. The provisioner's JSON response (including the freshly-projected	COMMENT
LOW	server-source-code/internal/handler/auth.go	1301	}	COMMENT
LOW	server-source-code/internal/handler/patching_stream.go	21	}	COMMENT
LOW	server-source-code/internal/handler/patching.go	221	JSON(w, http.StatusInternalServerError, map[string]string{"error": "Failed to save patch output"})	COMMENT
LOW	…r-source-code/internal/handler/compliance_hash_test.go	81	// TestCanonicalComplianceHashFromPayload_CarriesRemediationFields is the direct	COMMENT
66 more matches not shown…

Structural Annotation Overuse78 hits · 105 pts

Severity	File	Line	Snippet	Context
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	939	// Step 1: Detect OS	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	958	// Step 2: Install OpenSCAP packages	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	997	// Step 3: Verify installation and SSG content	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	1065	// Step 4: Docker Bench (if docker enabled)	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	1105	// Step 5: Complete	COMMENT
LOW	docs/patchmon-admin-guide.md	453	### Step 1: Choose OS	COMMENT
LOW	docs/patchmon-admin-guide.md	465	### Step 2: Host Details	COMMENT
LOW	docs/patchmon-admin-guide.md	492	### Step 3: Copy the Install Command	COMMENT
LOW	docs/patchmon-admin-guide.md	526	### Step 4: Waiting for Connection	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	64	### Step 1: Find your callback URL	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	74	### Step 2: Create a Discord application	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	91	### Step 3: Configure PatchMon	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	103	### Step 4: Test	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	174	### Step 1: Create a Discord incoming webhook	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	187	### Step 2: Add the webhook to PatchMon	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	201	### Step 3: Route alerts to the destination	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	372	#### Step 1: Create a GetHomepage API key	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	383	#### Step 2: Copy the credentials	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	394	#### Step 3: Configure GetHomepage	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	657	#### Step 1: Find out your top 3 operating systems	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	678	#### Step 2: Add the counts to the widget, using the names as labels	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	692	#### Step 3: Restart GetHomepage	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	838	# Step 1: encode	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	841	# Step 2: test	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	1455	#### Step 1: Create Auto-Enrollment Token	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	1492	#### Step 2: Prepare Proxmox Host	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	1537	#### Step 3: Test with Dry Run	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	1557	#### Step 4: Run Actual Enrollment	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	1571	#### Step 5: Verify in PatchMon	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	2794	### Step 1: Create an Auto-Enrolment Token	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	2805	### Step 2: Prepare the Scripts	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	2819	### Step 3: Build the Package	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	2829	### Step 4: Create the Win32 App	COMMENT
LOW	docs/patchmon-api-integrations-guide.md	2859	### Step 5: Check the Rollout	COMMENT
LOW⚡	docs/patchmon-operator-guide.md	4913	# Step 1: Check service status	COMMENT
LOW⚡	docs/patchmon-operator-guide.md	4916	# Step 2: Check recent logs for errors	COMMENT
LOW⚡	docs/patchmon-operator-guide.md	4921	# Step 3: Run diagnostics for full picture	COMMENT
LOW⚡	docs/patchmon-operator-guide.md	4924	# Step 4: Test connectivity explicitly	COMMENT
LOW⚡	docs/patchmon-operator-guide.md	4927	# Step 5: If needed, restart with debug logging temporarily	COMMENT
LOW	docs/patchmon-operator-guide.md	1967	### Step 1: Create Admin Account	COMMENT
LOW	docs/patchmon-operator-guide.md	2006	### Step 2: Multi-Factor Authentication	COMMENT
LOW	docs/patchmon-operator-guide.md	2036	### Step 3: Confirm Server URL	COMMENT
LOW	docs/patchmon-operator-guide.md	2064	### Step 4: Stay Updated (optional)	COMMENT
LOW	docs/patchmon-operator-guide.md	2074	### Step 5: Get in Touch	COMMENT
LOW	docs/patchmon-operator-guide.md	2782	### Step 1 - Create an OIDC Application in Your IdP	COMMENT
LOW	docs/patchmon-operator-guide.md	2822	### Step 2 - Configure PatchMon	COMMENT
LOW	docs/patchmon-operator-guide.md	2875	### Step 3 - Group-Based Role Mapping (Optional)	COMMENT
LOW	docs/patchmon-operator-guide.md	2918	### Step 4 - Restart PatchMon	COMMENT
LOW	docs/patchmon-operator-guide.md	2967	### Step 5 - Test the Login	COMMENT
LOW	docs/patchmon-operator-guide.md	3431	#### Step 1: Get the Callback URL from PatchMon First	COMMENT
LOW	docs/patchmon-operator-guide.md	3447	#### Step 2: Register an Application in Entra ID	COMMENT
LOW	docs/patchmon-operator-guide.md	3466	#### Step 3: Create a Client Secret	COMMENT
LOW	docs/patchmon-operator-guide.md	3480	#### Step 4: Configure Token Claims (Add Groups)	COMMENT
LOW	docs/patchmon-operator-guide.md	3503	#### Step 5: API Permissions	COMMENT
LOW	docs/patchmon-operator-guide.md	3511	#### Step 6: Create Security Groups for Role Mapping	COMMENT
LOW	docs/patchmon-operator-guide.md	3547	#### Step 7: Fill in the OAuth2 Configuration Section	COMMENT
LOW	docs/patchmon-operator-guide.md	3569	#### Step 8: Configure the Toggles	COMMENT
LOW	docs/patchmon-operator-guide.md	3585	#### Step 9: Fill in the Role Mapping Table	COMMENT
LOW	docs/patchmon-operator-guide.md	3608	#### Step 10: Turn On OIDC and Test	COMMENT
LOW	docs/patchmon-operator-guide.md	3766	#### Step 1: Open the Add Host Wizard	COMMENT
18 more matches not shown…

Decorative Section Separators27 hits · 102 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	docker/docker-compose.dev.yml	1	# ============================================================================	COMMENT
MEDIUM⚡	docker/docker-compose.dev.yml	3	# ============================================================================	COMMENT
MEDIUM⚡	docker/docker-compose.dev.yml	10	# ============================================================================	COMMENT
MEDIUM	docker/build.sh	2	# =============================================================================	COMMENT
MEDIUM	docker/build.sh	19	# =============================================================================	COMMENT
MEDIUM	docker/docker-compose.yml	1	# =============================================================================	COMMENT
MEDIUM	docker/docker-compose.yml	3	# =============================================================================	COMMENT
MEDIUM	docker/docker-compose.yml	16	# =============================================================================	COMMENT
MEDIUM⚡	docs/patchmon-operator-guide.md	5765	# ─── Server Connection ───────────────────────────────────────────────	COMMENT
MEDIUM⚡	docs/patchmon-operator-guide.md	5774	# ─── Host Identity (agent 2.1.4 and later) ───────────────────────────	COMMENT
MEDIUM⚡	docs/patchmon-operator-guide.md	5784	# ─── File Paths ──────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docs/patchmon-operator-guide.md	5794	# ─── Logging ─────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docs/patchmon-operator-guide.md	5800	# ─── SSL / TLS ───────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	docs/patchmon-operator-guide.md	5806	# ─── Reporting Schedule ──────────────────────────────────────────────	COMMENT
MEDIUM	docs/patchmon-operator-guide.md	5820	# ─── Integrations ────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/patchmon-operator-guide.md	5862	# ─── Docker Image Update Check ───────────────────────────────────────	COMMENT
MEDIUM	docs/patchmon-operator-guide.md	5872	# ─── Alpine Security Database ────────────────────────────────────────	COMMENT
MEDIUM	.github/workflows/docker.yml	408	# ---------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/docker.yml	433	# ---------------------------------------------------------------------	COMMENT
MEDIUM	.github/scripts/publish-changelog.sh	2	# =============================================================================	COMMENT
MEDIUM	.github/scripts/update-vcheck-dns.sh	2	# =============================================================================	COMMENT
MEDIUM⚡	…source-code/internal/agents/direct_host_auto_enroll.sh	10	# =============================================================================	COMMENT
MEDIUM⚡	…source-code/internal/agents/direct_host_auto_enroll.sh	12	# =============================================================================	COMMENT
MEDIUM	…source-code/internal/agents/direct_host_auto_enroll.sh	30	# =============================================================================	COMMENT
MEDIUM⚡	…ver-source-code/internal/agents/proxmox_auto_enroll.sh	10	# =============================================================================	COMMENT
MEDIUM⚡	…ver-source-code/internal/agents/proxmox_auto_enroll.sh	12	# =============================================================================	COMMENT
MEDIUM⚡	…ver-source-code/internal/agents/proxmox_auto_enroll.sh	24	# =============================================================================	COMMENT

Verbosity Indicators17 hits · 33 pts

Severity	File	Line	Snippet	Context
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	939	// Step 1: Detect OS	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	958	// Step 2: Install OpenSCAP packages	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	997	// Step 3: Verify installation and SSG content	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	1065	// Step 4: Docker Bench (if docker enabled)	COMMENT
LOW	agent-source-code/cmd/patchmon-agent/commands/serve.go	1105	// Step 5: Complete	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_remove.sh	74	# Step 1: Stop systemd/OpenRC service if it exists	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_remove.sh	260	# Step 2: Remove crontab entries	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_remove.sh	270	# Step 3: Remove agent binaries and scripts	COMMENT
LOW	server-source-code/internal/agents/patchmon_remove.sh	308	# Step 4: Remove configuration directory and files	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_remove.sh	328	# Step 5: Remove log files	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_remove.sh	338	# Step 6: Clean up backup files	COMMENT
LOW	server-source-code/internal/agents/patchmon_remove.sh	436	# Step 7: Final verification	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_install.sh	531	# Step 1: Handle existing configuration directory	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_install.sh	580	# Step 2: Create configuration files	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_install.sh	655	# Step 3: Download the PatchMon agent binary using API credentials	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_install.sh	740	# Step 4: Test the configuration	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_install.sh	748	# Step 5: Setup service for WebSocket connection	COMMENT

Fake / Example Data23 hits · 32 pts

Severity	File	Line	Snippet	Context
LOW	docs/patchmon-operator-guide.md	3198	Fixed in 2.1.3. Two separate defects produced the same message. ADFS sends single-valued claims as a JSON array (`"email	CODE
LOW	docs/patchmon-operator-guide.md	3291	-c "UPDATE users SET oidc_sub = NULL, oidc_provider = NULL WHERE LOWER(email) = LOWER('admin@example.com');"	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	36	primary: map[string]interface{}{"email": "user@example.com"},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	37	want: "user@example.com",	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	41	primary: map[string]interface{}{"email": []interface{}{"user@example.com"}},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	42	want: "user@example.com",	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	47	fallback: map[string]interface{}{"email": []interface{}{"user@example.com"}},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	48	want: "user@example.com",	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	53	fallback: map[string]interface{}{"email": []interface{}{"user@example.com"}},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	54	want: "user@example.com",	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	65	fallback: map[string]interface{}{"email": "user@example.com"},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	66	want: "user@example.com",	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	71	fallback: map[string]interface{}{"email": "user@example.com"},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	72	want: "user@example.com",	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	77	fallback: map[string]interface{}{"email": "user@example.com"},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	78	want: "user@example.com",	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	83	fallback: map[string]interface{}{"email": "user@example.com"},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	84	want: "user@example.com",	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	107	fallback: map[string]interface{}{"email": "user@example.com"},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	108	want: "user@example.com",	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	112	primary: map[string]interface{}{"email": map[string]interface{}{"value": "user@example.com"}},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	119	fallback: map[string]interface{}{"email": "user@example.com"},	CODE
LOW⚡	…er-source-code/internal/auth/oidc/string_claim_test.go	120	want: "user@example.com",	CODE

Redundant / Tautological Comments19 hits · 32 pts

Severity	File	Line	Snippet	Context
LOW	server-source-code/internal/agents/patchmon_remove.sh	23	# Check if backup files should be removed (default: preserve for safety)	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_remove.sh	66	# Check if running as root	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_remove.sh	84	# Check if service is active	COMMENT
LOW	server-source-code/internal/agents/patchmon_remove.sh	105	# Check if service is enabled	COMMENT
LOW	server-source-code/internal/agents/patchmon_remove.sh	233	# Check if processes still exist	COMMENT
LOW	…source-code/internal/agents/direct_host_auto_enroll.sh	178	# Check if running as root	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_install.sh	534	# Check if configuration directory already exists	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_install.sh	583	# Check if config file already exists	COMMENT
LOW⚡	server-source-code/internal/agents/patchmon_install.sh	664	# Check if agent binary already exists	COMMENT
LOW	server-source-code/internal/agents/patchmon_install.sh	38	# Check if running as root	COMMENT
LOW	server-source-code/internal/agents/patchmon_install.sh	58	# Check if we can read from stdin (interactive terminal)	COMMENT
LOW	server-source-code/internal/agents/patchmon_install.sh	209	# Check if --force flag is set (for bypassing broken packages)	COMMENT
LOW	server-source-code/internal/agents/patchmon_install.sh	549	# Check if agent is already configured and working (before we overwrite anything)	COMMENT
LOW	server-source-code/internal/agents/patchmon_install.sh	596	# Check if credentials file already exists	COMMENT
LOW	server-source-code/internal/agents/patchmon_install.sh	804	# Check if service started successfully	COMMENT
LOW	server-source-code/internal/agents/patchmon_install.sh	866	# Check if service started successfully	COMMENT
LOW	…ver-source-code/internal/agents/proxmox_auto_enroll.sh	93	# Check if running on Proxmox	COMMENT
LOW	…ver-source-code/internal/agents/proxmox_auto_enroll.sh	339	# Check if agent is already installed and working BEFORE enrollment	COMMENT
LOW	…ver-source-code/internal/agents/proxmox_auto_enroll.sh	612	# Check if it's a dpkg error	COMMENT

Magic Placeholder Names2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	frontend/src/pages/settings/Integrations.jsx	1496	{`echo -n "YOUR_API_KEY:YOUR_API_SECRET" \| base64`}	CODE
HIGH	frontend/src/pages/settings/Integrations.jsx	1499	Replace YOUR_API_KEY and YOUR_API_SECRET with your actual	CODE

Excessive Try-Catch Wrapping5 hits · 10 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/patchmon-api-integrations-guide.md	4904	print(f"Error: {response.status_code} - {response.json()}")	CODE
MEDIUM	docs/patchmon-api-integrations-guide.md	4984	print(f"Error: {response.status_code} - {response.json()}")	CODE
MEDIUM	docs/patchmon-api-integrations-guide.md	5037	print(f"Error fetching hosts: {response.status_code}")	CODE
MEDIUM	docs/patchmon-api-integrations-guide.md	5141	print("Error: PATCHMON_API_KEY and PATCHMON_API_SECRET must be set", file=sys.stderr)	CODE
MEDIUM	docs/patchmon-api-integrations-guide.md	5151	print(f"Error fetching inventory: {e}", file=sys.stderr)	CODE

Self-Referential Comments2 hits · 8 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	docker/docker-compose.dev.yml	4	# This file contains hardcoded credentials for LOCAL DEVELOPMENT ONLY.	COMMENT
MEDIUM	server-source-code/internal/agents/patchmon_install.sh	622	# Create main config file	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	server-source-code/internal/handler/rdp.go	712	// these fields are intentionally named as requested values rather than the	COMMENT

Example Usage Blocks3 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	docker/build.sh	13	# Usage:	COMMENT
LOW⚡	…source-code/internal/agents/direct_host_auto_enroll.sh	16	# Usage:	COMMENT
LOW⚡	…ver-source-code/internal/agents/proxmox_auto_enroll.sh	16	# Usage:	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	frontend/src/pages/hostdetail/WaitingForConnection.jsx	12	// Check multiple fields to be more robust - if any of these are populated, we have a report	COMMENT
MEDIUM	…urce-code/internal/integrations/compliance/openscap.go	1791	// Extract Rule elements using a more robust approach:	COMMENT

Hyper-Verbose Identifiers1 hit · 0 pts

Severity	File	Line	Snippet	Context
LOW	docs/patchmon-api-integrations-guide.md	5031	def generate_ansible_inventory():	CODE

PatchMon/PatchMon

Open-Source Code Quality, Security and Technical Debt Review