REST API for any Postgres database
This report summarizes scanner evidence for PostgREST/postgrest, a Haskell project with 27,701 GitHub stars. SynthScan examined 10,961 lines of code across 88 source files, recording 135 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 14.7 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 125 finding(s).
Are imports declared and package/API names verified? 5 finding(s).
Are wrappers, guards, and repeated structures necessary? 115 finding(s).
Which changes need focused human review? 135 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 135 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/io/test_admin.py | 27 | def test_admin_ready_w_channel(defaultenv): | CODE |
| LOW | test/io/test_admin.py | 40 | def test_admin_ready_wo_channel(defaultenv): | CODE |
| LOW | test/io/test_admin.py | 53 | def test_admin_ready_includes_schema_cache_state(defaultenv, metapostgrest): | CODE |
| LOW | test/io/test_admin.py | 92 | def test_admin_ready_dependent_on_main_app(defaultenv): | CODE |
| LOW | test/io/test_admin.py | 111 | def test_admin_does_not_wait_for_a_pool_connection(path, defaultenv): | CODE |
| LOW | test/io/test_admin.py | 134 | def test_admin_live_dependent_on_main_app(defaultenv): | CODE |
| LOW | test/io/test_admin.py | 145 | def test_admin_works_with_host_special_values(specialhostvalue, defaultenv): | CODE |
| LOW | test/io/test_admin.py | 171 | def test_admin_metrics_include_ghc_runtime_metrics(defaultenv): | CODE |
| LOW | test/io/test_admin.py | 185 | def test_admin_metrics_exclude_ghc_runtime_metrics_by_default(defaultenv): | CODE |
| LOW | test/io/test_admin.py | 195 | def test_admin_metrics_include_schema_cache_fails(defaultenv, metapostgrest): | CODE |
| LOW | test/io/config.py | 36 | def get_admin_host_and_port_from_config(config): | CODE |
| LOW | test/io/test_pg_internal.py | 5 | def test_listener_query_is_visible_in_pg_stat_activity(defaultenv): | CODE |
| LOW | test/io/util.py | 64 | def parse_server_timings_header(header): | CODE |
| LOW | test/io/test_connection.py | 23 | def test_fail_with_invalid_password(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 45 | def test_get_pgrst_version_with_uri_connection_string(dburi_type, dburi, defaultenv): | CODE |
| LOW | test/io/test_connection.py | 67 | def test_get_pgrst_version_with_keyval_connection_string(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 85 | def test_fail_with_invalid_dbname_and_automatic_recovery_disabled(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 100 | def test_fail_with_automatic_recovery_disabled_and_terminated_using_query(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 120 | def test_read_dburi_from_stdin_without_eol(dburi, defaultenv): | CODE |
| LOW | test/io/test_connection.py | 133 | def test_read_dburi_from_stdin_with_eol(dburi, defaultenv): | CODE |
| LOW | test/io/test_connection.py | 146 | def test_flush_pool_no_interrupt(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 168 | def test_no_pool_connection_required_on_bad_http_logic(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 183 | def test_no_pool_connection_required_on_options(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 200 | def test_no_pool_connection_required_on_bad_jwt_claim(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 213 | def test_no_pool_connection_required_on_bad_embedding(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 223 | def test_pool_acquisition_timeout(level, defaultenv, metapostgrest): | CODE |
| LOW | test/io/test_connection.py | 254 | def test_pool_acquisition_timeout_logs_are_debounced(defaultenv): | CODE |
| LOW | test/io/test_connection.py | 302 | def test_positive_pool_metric(defaultenv): | CODE |
| LOW | test/io/test_zero_downtime.py | 11 | def test_so_reuseport_zero_downtime_handover(defaultenv): | CODE |
| LOW | test/io/test_big_schema.py | 11 | def test_schema_cache_load_max_duration(defaultenv): | CODE |
| LOW | test/io/test_big_schema.py | 46 | def test_openapi_in_big_schema(defaultenv): | CODE |
| LOW | test/io/test_big_schema.py | 61 | def test_stackoverflow_is_logged(level, defaultenv): | CODE |
| LOW | test/io/test_big_schema.py | 88 | def test_should_not_fail_with_stack_overflow(defaultenv): | CODE |
| LOW | test/io/test_big_schema.py | 105 | def test_second_request_for_non_existent_table_should_be_quick(defaultenv): | CODE |
| LOW | test/io/test_log.py | 203 | def test_schema_cache_log_query(level, log_query, defaultenv): | CODE |
| LOW | test/io/test_log.py | 232 | def test_log_lacks_role_with_empty_anon_role(defaultenv): | CODE |
| LOW | test/io/test_log.py | 254 | def test_log_postgrest_version(defaultenv): | CODE |
| LOW | test/io/test_log.py | 278 | def test_log_postgrest_host_and_port(host, defaultenv): | CODE |
| LOW | test/io/test_log.py | 306 | def test_log_postgrest_admin_server_host_and_port(host, defaultenv): | CODE |
| LOW | test/io/test_log.py | 337 | def test_log_error_when_schema_cache_load_error_on_startup_to_stderr(defaultenv): | CODE |
| LOW | test/io/test_log.py | 366 | def test_log_pool_req_observation(level, defaultenv): | CODE |
| LOW | test/io/test_log.py | 392 | def test_log_listener_connection_errors(defaultenv): | CODE |
| LOW | test/io/test_log.py | 410 | def test_log_listener_connection_start(defaultenv): | CODE |
| LOW | test/io/test_log.py | 430 | def test_db_error_logging_to_stderr(level, defaultenv, metapostgrest): | CODE |
| LOW | test/io/test_log.py | 467 | def test_schema_cache_query_sleep_logs(defaultenv): | CODE |
| LOW | test/io/test_log.py | 493 | def test_schema_cache_query_timings_log(level, defaultenv): | CODE |
| LOW | test/io/test_log.py | 516 | def test_empty_schema_cache_log_contains_jwt_role(defaultenv): | CODE |
| LOW | test/io/test_log.py | 543 | def test_expired_jwt_log_lacks_role(defaultenv): | CODE |
| LOW | test/io/test_log.py | 562 | def test_schema_cache_error_observation(defaultenv): | CODE |
| LOW | test/io/test_log.py | 583 | def test_invalid_rpc_method_log_contains_role(defaultenv): | CODE |
| LOW | test/io/test_log.py | 618 | def test_termination_unix_signal_logging(defaultenv): | CODE |
| LOW | test/io/test_log.py | 636 | def test_options_request_logs_but_cors_preflight_does_not(defaultenv): | CODE |
| LOW | test/io/test_graceful_shutdown.py | 7 | def test_graceful_shutdown_waits_for_in_flight_request(defaultenv): | CODE |
| LOW | test/io/test_reloading.py | 21 | def test_db_schema_notify_reload(defaultenv): | CODE |
| LOW | test/io/test_reloading.py | 73 | def test_invalid_role_claim_key_notify_reload(defaultenv): | CODE |
| LOW | test/io/test_reloading.py | 126 | def test_max_rows_notify_reload(defaultenv): | CODE |
| LOW | test/io/test_reloading.py | 157 | def test_no_double_schema_cache_reload_on_empty_schema(defaultenv): | CODE |
| LOW | test/io/test_reloading.py | 183 | def test_notify_reloading_catalog_cache(defaultenv): | CODE |
| LOW | test/io/test_reloading.py | 223 | def test_schema_cache_concurrent_notifications(slow_schema_cache_env): | CODE |
| LOW | test/io/test_reloading.py | 281 | def test_jwt_secret_external_file_reload(tmp_path, defaultenv): | CODE |
| 49 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/io/test_log.py | 360 | log_err_message = '{"code":"PGRST002","details":null,"hint":null,"message":"Could not query the database for the | CODE |
| HIGH | test/io/test_log.py | 613 | log_message = '{"code":"PGRST001","details":"no connection to the server\\n","hint":null,"message":"Database cli | CODE |
| HIGH⚡ | test/io/test_settings.py | 299 | == '{"code":"57014","details":null,"hint":null,"message":"canceling statement due to statement timeout"}' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/io/test_zero_downtime.py | 21 | failures = [] | COMMENT |
| LOW | docs/conf.py | 1 | # -*- coding: utf-8 -*- | COMMENT |
| LOW | docs/conf.py | 61 | # The language for content autogenerated by Sphinx. Refer to documentation | COMMENT |
| LOW | docs/conf.py | 81 | # default_role = None | COMMENT |
| LOW | docs/conf.py | 121 | # The name for this set of Sphinx documents. | COMMENT |
| LOW | docs/conf.py | 141 | COMMENT | |
| LOW | docs/conf.py | 161 | # html_additional_pages = {} | COMMENT |
| LOW | docs/conf.py | 181 | # If true, an OpenSearch description file will be output, and all pages will | COMMENT |
| LOW | docs/conf.py | 201 | # implements a search results scorer. If empty, the default will be used. | COMMENT |
| LOW | docs/conf.py | 221 | # (source start file, target name, title, | COMMENT |
| LOW | docs/conf.py | 241 | # Documents to append as an appendix to all manuals. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/io/postgrest.py | 283 | except requests.exceptions.ReadTimeout: | CODE |
| HIGH | test/io/postgrest.py | 264 | except (requests.ConnectionError, requests.ReadTimeout): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/io/util.py | 18 | except Exception as e: | CODE |
| MEDIUM | test/io/util.py | 15 | def run(self): | CODE |
| LOW | test/io/test_zero_downtime.py | 49 | except Exception as exc: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docs/conf.py | 6 | # This file is execfile()d with the current directory set to its | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/io/test_log.py | 28 | CODE | |
| LOW | test/io/test_log.py | 91 | CODE | |
| LOW | test/io/postgrest.py | 92 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/load/put.json | 3 | "name": "John Doe", | CODE |
| LOW | test/load/fixtures.sql | 16 | INSERT INTO test.actors VALUES (1, 'John Doe'); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/io/postgrest.py | 92 | CODE |