Home / SonarSource / sonarqube
AI Slop Code Risk Monitor

SonarSource/sonarqube

SlopCodeMonitor badge for SonarSource/sonarqube Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Continuous Inspection

1.4 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for SonarSource/sonarqube, a Java project with 11,133 GitHub stars. SynthScan examined 981,096 lines of code across 8294 source files, recording 220 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 1.4 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.4
Adjusted Signal
1.4
Raw Pattern Score
100%
Time Factor
2026-10-30
Last Push
11.1K
Stars
Java
Language
981.1K
Lines of Code
8.3K
Files
220
Pattern Hits
2026-10-31
Scan Date
0.01
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 0.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 62 finding(s).

Hallucinated Dependency & Supply Chain Risk 5.9/100 · LOW

Are imports declared and package/API names verified? 146 finding(s).

Agent Over-Engineering Ratio 0.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 15 finding(s).

PR Review Velocity Impact 6.1/100 · LOW

Which changes need focused human review? 220 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 106HIGH 6MEDIUM 17LOW 91

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 220 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators106 hits · 1150 pts
SeverityFileLineSnippetContext
CRITICAL…c/main/java/org/sonar/xoo/rule/XooRulesDefinition.java502 .context(new org.sonar.api.server.rule.Context(contextName, contextName))CODE
CRITICAL…java/org/sonar/education/EducationRulesDefinition.java185 var ruleContext = new org.sonar.api.server.rule.Context(context, context);CODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java241 org.sonar.alm.client.bitbucketserver.Repository repository = new org.sonar.alm.client.bitbucketserver.Repository()CODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java245 .setLinks(new org.sonar.alm.client.bitbucketserver.Repository.Links(CODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java246 java.util.List.of(new org.sonar.alm.client.bitbucketserver.Repository.Link("https://bitbucket.example.com/projecCODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java267 org.sonar.alm.client.bitbucket.bitbucketcloud.Repository repository = new org.sonar.alm.client.bitbucket.bitbucketclCODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java269 .setLinks(new org.sonar.alm.client.bitbucket.bitbucketcloud.Repository.Links(CODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java270 new org.sonar.alm.client.bitbucket.bitbucketcloud.Repository.Link("https://bitbucket.org/workspace/repo-slug")))CODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java292 org.sonar.alm.client.bitbucket.bitbucketcloud.Repository repository = new org.sonar.alm.client.bitbucket.bitbucketclCODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java294 .setLinks(new org.sonar.alm.client.bitbucket.bitbucketcloud.Repository.Links(CODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java295 new org.sonar.alm.client.bitbucket.bitbucketcloud.Repository.Link("https://bitbucket.org/workspace/repo-slug")))CODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java316 .thenAnswer(invocation -> new org.sonar.alm.client.bitbucket.bitbucketcloud.Repository(CODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java318 .setLinks(new org.sonar.alm.client.bitbucket.bitbucketcloud.Repository.Links(CODE
CRITICAL⚡…almsettings/ws/ProjectBindingsServiceServerImplIT.java319 new org.sonar.alm.client.bitbucket.bitbucketcloud.Repository.Link("https://bitbucket.org/workspace/" + invocatCODE
CRITICAL…src/it/java/org/sonar/server/rule/ws/TagsActionIT.java43 private final WsActionTester ws = new WsActionTester(new org.sonar.server.rule.ws.TagsAction(dbClient));CODE
CRITICAL…/it/java/org/sonar/server/issue/ws/SearchActionIT.java820 .setParam(PARAM_IMPACT_SEVERITIES, org.sonar.api.issue.impact.Severity.INFO.name())CODE
CRITICAL…c/main/java/org/sonar/server/rule/ws/SearchAction.java395 addMandatoryFacetValues(results, PARAM_IMPACT_SEVERITIES, enumToStringCollection(org.sonar.api.issue.impact.SeverityCODE
CRITICAL…/main/java/org/sonar/server/rule/ws/RuleWsSupport.java198 .setPossibleValues(org.sonar.api.issue.impact.Severity.values());CODE
CRITICAL…/main/java/org/sonar/server/rule/ws/RuleWsSupport.java204 .setPossibleValues(org.sonar.api.issue.impact.Severity.values());CODE
CRITICAL…c/main/java/org/sonar/server/rule/ws/CreateAction.java208 .map(e -> new NewCustomRule.Impact(SoftwareQuality.valueOf(e.getKey()), org.sonar.api.issue.impact.Severity.valuCODE
CRITICAL…sonar/server/qualityprofile/ws/ActivateRuleAction.java169 .stream().collect(Collectors.toMap(e -> SoftwareQuality.valueOf(e.getKey()), e -> org.sonar.api.issue.impact.SevCODE
CRITICAL…ygate/notification/EmailQGChangeEventListenerTest.java65 .setValueType(org.sonar.api.measures.Metric.ValueType.RATING.name()));CODE
CRITICAL…ygate/notification/EmailQGChangeEventListenerTest.java68 .setValueType(org.sonar.api.measures.Metric.ValueType.RATING.name()));CODE
CRITICAL…/v2/security/SpringSecurityIntegrationExampleTest.java64 AuthenticatedUser authenticatedUser = org.sonar.server.v2.security.SecurityContextUtils.requireAuthenticatedUser();CODE
CRITICAL…/v2/security/SpringSecurityIntegrationExampleTest.java100 AuthenticatedUser authenticatedUser = org.sonar.server.v2.security.SecurityContextUtils.requireAuthenticatedUser();CODE
CRITICAL…nar/server/v2/security/SpringSecurityAnnotationIT.java291 var authentication = org.springframework.security.core.context.SecurityContextHolder.getContext().getAuthenticatioCODE
CRITICAL…story/controller/ProjectCollectionContextLoaderIT.java228 ComponentDto applicationComponent = org.sonar.db.component.ComponentTesting.newSubPortfolio(portfolio)CODE
CRITICAL…il/config/DefaultEmailConfigurationControllerTest.java471 return org.sonar.server.v2.api.email.config.resource.EmailConfigurationSecurityProtocol.valueOf(securityProtocol.namSTRING
CRITICAL…il/config/DefaultEmailConfigurationControllerTest.java475 return org.sonar.server.v2.api.email.config.resource.EmailConfigurationAuthMethod.valueOf(authMethod.name());STRING
CRITICAL…api/onboarding/alm/OnboardingAlmConfigurationTest.java395 .thenReturn(new org.sonar.alm.client.bitbucket.bitbucketcloud.RepositoryList(null, repeatedBitbucketCloudRepos(1),CODE
CRITICAL…api/onboarding/alm/OnboardingAlmConfigurationTest.java447 .thenReturn(new org.sonar.alm.client.bitbucket.bitbucketcloud.RepositoryList(null, List.of(), 1, 1));CODE
CRITICAL…java/org/sonar/server/v2/common/DeprecatedHandler.java44 * {@link org.springframework.web.bind.annotation.RequestBody()}. This needs toCOMMENT
CRITICAL…g/controller/DefaultGithubConfigurationController.java148 return org.sonar.server.v2.api.model.ProvisioningType.valueOf(configuration.provisioningType().name());CODE
CRITICAL…ig/controller/DefaultEmailConfigurationController.java162 return org.sonar.server.v2.api.email.config.resource.EmailConfigurationSecurityProtocol.valueOf(securityProtocol.namCODE
CRITICAL…ig/controller/DefaultEmailConfigurationController.java166 return org.sonar.server.v2.api.email.config.resource.EmailConfigurationAuthMethod.valueOf(authMethod.name());CODE
CRITICAL…mmon/src/test/java/org/sonar/server/es/FacetsTest.java573 when(bucket1.key()).thenReturn(co.elastic.clients.elasticsearch._types.FieldValue.of(key1));CODE
CRITICAL…mmon/src/test/java/org/sonar/server/es/FacetsTest.java577 when(bucket2.key()).thenReturn(co.elastic.clients.elasticsearch._types.FieldValue.of(key2));CODE
CRITICAL…mmon/src/test/java/org/sonar/server/es/FacetsTest.java606 when(bucket.key()).thenReturn(co.elastic.clients.elasticsearch._types.FieldValue.of(key));CODE
CRITICAL…mmon/src/test/java/org/sonar/server/es/FacetsTest.java634 when(bucket.key()).thenReturn(co.elastic.clients.elasticsearch._types.FieldValue.of(key));CODE
CRITICAL…mon/src/it/java/org/sonar/server/es/BulkIndexerIT.java118 .query(Query.of(q -> q.range(r -> r.untyped(u -> u.field(FakeIndexDefinition.INT_FIELD).gte(co.elastic.clients.jsoCODE
CRITICAL…main/java/org/sonar/server/rule/DefaultRuleFinder.java136 org.sonar.api.rules.Rule apiRule = org.sonar.api.rules.Rule.create();CODE
CRITICAL…c/main/java/org/sonar/server/rule/index/RuleIndex.java220 co.elastic.clients.elasticsearch.core.SearchRequest.Builder sourceBuilder = new co.elastic.clients.elasticsearch.corCODE
CRITICAL…c/main/java/org/sonar/server/rule/index/RuleIndex.java672 for (org.sonar.api.issue.impact.Severity severity : org.sonar.api.issue.impact.Severity.values()) {CODE
CRITICAL…c/main/java/org/sonar/server/rule/index/RuleIndex.java733 for (org.sonar.api.issue.impact.Severity severity : org.sonar.api.issue.impact.Severity.values()) {CODE
CRITICAL…ain/java/org/sonar/server/issue/IssueStatsIndexer.java120 org.sonar.api.issue.impact.Severity.INFO.ordinal() + 1CODE
CRITICAL…ain/java/org/sonar/server/issue/IssueStatsIndexer.java121 : org.sonar.api.issue.impact.Severity.valueOf(issue.getMqrSeverity()).ordinal() + 1;CODE
CRITICAL⚡…/src/main/java/org/sonar/server/es/ES8QueryHelper.java179 return Query.of(q -> q.range(r -> r.untyped(u -> u.field(field).gte(co.elastic.clients.json.JsonData.of(value)))));CODE
CRITICAL⚡…/src/main/java/org/sonar/server/es/ES8QueryHelper.java183 return Query.of(q -> q.range(r -> r.untyped(u -> u.field(field).gt(co.elastic.clients.json.JsonData.of(value)))));CODE
CRITICAL⚡…/src/main/java/org/sonar/server/es/ES8QueryHelper.java187 return Query.of(q -> q.range(r -> r.untyped(u -> u.field(field).lt(co.elastic.clients.json.JsonData.of(value)))));CODE
CRITICAL⚡…/src/main/java/org/sonar/server/es/ES8QueryHelper.java191 return Query.of(q -> q.range(r -> r.untyped(u -> u.field(field).lte(co.elastic.clients.json.JsonData.of(value)))));CODE
CRITICAL…r-process/src/test/java/org/sonar/process/JmxTest.java76 Jmx.register(FAKE_NAME, new org.sonar.process.jmx.test.Fake());CODE
CRITICAL…ocess/src/test/java/org/sonar/process/LoggingRule.java72 ch.qos.logback.classic.Level l = ch.qos.logback.classic.Level.valueOf(level.name());CODE
CRITICAL…projects/test-requirenew-plugin/src/RequirePlugin.java29 new org.sonar.plugins.testbase.api.BaseApi().doNothing();CODE
CRITICAL…st/projects/test-require-plugin/src/RequirePlugin.java29 new org.sonar.plugins.testbase.api.BaseApi().doNothing();CODE
CRITICAL…java/org/sonar/server/plugins/PluginJarLoaderTest.java68 when(sonarRuntime.getApiVersion()).thenReturn(org.sonar.api.utils.Version.parse("5.2"));CODE
CRITICAL…java/org/sonar/server/plugins/PluginJarLoaderTest.java293 when(sonarRuntime.getApiVersion()).thenReturn(org.sonar.api.utils.Version.parse("1.0"));CODE
CRITICAL…in/java/org/sonar/server/plugins/PluginDownloader.java94 org.sonar.core.util.FileUtils.cleanDirectory(downloadDir);CODE
CRITICAL…/org/sonar/server/plugins/ServerPluginJarExploder.java52 org.sonar.core.util.FileUtils.cleanDirectory(toDir);CODE
CRITICAL…rg/sonar/server/plugins/UpdateCenterMatrixFactory.java47 org.sonar.api.utils.Version semanticVersion = org.sonar.api.utils.Version.create(fullVersion.major(), fullVersion.CODE
CRITICAL…org/sonar/server/issue/index/IssueIndexFacetsTest.java835 assertThatFacetHasOnly(IssueQuery.builder().impactSoftwareQualities(Set.of(MAINTAINABILITY.name())).impactSeveritiesCODE
46 more matches not shown…
Fake / Example Data40 hits · 46 pts
SeverityFileLineSnippetContext
LOW…java/org/sonar/education/EducationRulesDefinition.java50 private static final String HTML_LOREM_IPSUM = "<a href=\"https://google.com\">Lorem</a> ipsum dolor sit amet, consectCODE
LOW⚡…it/java/org/sonar/server/user/UserUpdaterCreateIT.java138 .setName("John Doe")CODE
LOW⚡…it/java/org/sonar/server/user/UserUpdaterCreateIT.java144 assertThat(dto.getName()).isEqualTo("John Doe");CODE
LOW⚡…it/java/org/sonar/server/user/UserUpdaterCreateIT.java153 .setName("John Doe")CODE
LOW⚡…it/java/org/sonar/server/user/UserUpdaterCreateIT.java159 assertThat(dto.getName()).isEqualTo("John Doe");CODE
LOW…g/sonar/server/authentication/UserRegistrarImplIT.java167 .setName("John Doe")CODE
LOW…g/sonar/server/authentication/UserRegistrarImplIT.java174 assertThat(user.getLogin()).isNotEqualTo("John Doe").startsWith("john-doe");CODE
LOW⚡…g/sonar/server/authentication/UserRegistrarImplIT.java394 UserDto janeDoe = insertUser("jane_login", "Jane Doe", "jane@company.com", "Jane Doe", "Jane Doe", samlProvider.getKCODE
LOW⚡…g/sonar/server/authentication/UserRegistrarImplIT.java395 insertUser("other_jane_login", "Jane Doe", "other-jane@company.com", "JANE DOE", "JANE DOE", samlProvider.getKey(), CODE
LOW⚡…g/sonar/server/authentication/UserRegistrarImplIT.java399 .setName("Jane Doe")CODE
LOW⚡…g/sonar/server/authentication/UserRegistrarImplIT.java413 UserDto janeDoe = insertUser("jane_login", "Jane Doe", "jane@company.com", "Jane Doe", "Jane Doe", samlProvider.getKCODE
LOW⚡…g/sonar/server/authentication/UserRegistrarImplIT.java414 UserDto otherJaneDoe = insertUser("other_jane_login", "Jane Doe", "other-jane@company.com", "JANE DOE", "JANE DOE", CODE
LOW⚡…g/sonar/server/authentication/UserRegistrarImplIT.java418 .setName("Jane Doe")CODE
LOW…org/sonar/server/authentication/UserRegistrarImpl.java151 * provider (e.g. "Jane Doe" and "JANE DOE"): if a login that doesn't exactly match any of them corroboratesCOMMENT
LOW…g/sonar/server/qualitygate/ws/SearchUsersActionIT.java168 UserDto user1 = db.users().insertUser(u -> u.setName("John Doe"));CODE
LOW…g/sonar/server/qualitygate/ws/SearchUsersActionIT.java169 UserDto user2 = db.users().insertUser(u -> u.setName("Jane Doe"));CODE
LOW…onar/server/qualityprofile/ws/SearchUsersActionIT.java182 UserDto user1 = db.users().insertUser(u -> u.setName("John Doe"));CODE
LOW…onar/server/qualityprofile/ws/SearchUsersActionIT.java183 UserDto user2 = db.users().insertUser(u -> u.setName("Jane Doe"));CODE
LOW…test/java/org/sonar/auth/bitbucket/GsonEmailsTest.java51 assertThat(emails.getEmails().get(0).getEmail()).isEqualTo("foo@bar.com");CODE
LOW…/v2/security/SecurityContextBackedUserSessionTest.java138 when(mockUserSession.getName()).thenReturn("John Doe");CODE
LOW…/v2/security/SecurityContextBackedUserSessionTest.java143 assertThat(name).isEqualTo("John Doe");CODE
LOW…er/v2/security/UserSessionBackwardCompatibilityIT.java156 .setName("John Doe");CODE
LOW…va/org/sonar/auth/ldap/DefaultLdapUsersProviderIT.java54 assertThat(details.getEmail()).isEqualTo("godin@example.org");CODE
LOW…va/org/sonar/auth/ldap/DefaultLdapUsersProviderIT.java77 assertThat(detailsExample.getEmail()).isEqualTo("tester@example.org");CODE
LOW…c/test/java/org/sonar/db/source/FileSourceDtoTest.java34 private static final String LOREM_IPSUM = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aliquam ac magna lCODE
LOW…c/test/java/org/sonar/db/source/FileSourceDtoTest.java34 private static final String LOREM_IPSUM = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aliquam ac magna lCODE
LOW…ar/db/qualitygate/QualityGateUserPermissionsDaoIT.java164 UserDto user1 = db.users().insertUser(u -> u.setLogin("user1").setName("John Doe"));CODE
LOW…ar/db/qualitygate/QualityGateUserPermissionsDaoIT.java166 UserDto user3 = db.users().insertUser(u -> u.setLogin("user3").setName("Jane Doe"));CODE
LOW…rg/sonar/db/qualityprofile/QProfileEditUsersDaoIT.java149 UserDto user1 = db.users().insertUser(u -> u.setLogin("user1").setName("John Doe"));CODE
LOW…rg/sonar/db/qualityprofile/QProfileEditUsersDaoIT.java151 UserDto user3 = db.users().insertUser(u -> u.setLogin("user3").setName("Jane Doe"));CODE
LOW…t/java/org/sonar/auth/saml/SamlIdentityProviderIT.java207 assertThat(callbackContext.userIdentity.getName()).isEqualTo("John Doe");CODE
LOW…t/java/org/sonar/auth/saml/SamlIdentityProviderIT.java268 assertThat(callbackContext.userIdentity.getName()).isEqualTo("John Doe");CODE
LOW…org/sonar/ce/task/projectexport/issue/rubbish_data.txt1Lorem ipsum dolor sit amet, consectetur adipiscing elit. Maecenas hendrerit sapien magna, eget ultrices sapien ornare etCODE
LOW…org/sonar/ce/task/projectexport/issue/rubbish_data.txt1Lorem ipsum dolor sit amet, consectetur adipiscing elit. Maecenas hendrerit sapien magna, eget ultrices sapien ornare etCODE
LOW…rg/sonar/core/sarif/unsupported-sarif-version-abc.json22 "text": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam hendrerit nisi sed sollicitudin peCODE
LOW…rg/sonar/core/sarif/unsupported-sarif-version-abc.json22 "text": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam hendrerit nisi sed sollicitudin peCODE
LOW…est/resources/org/sonar/core/sarif/valid-sarif210.json22 "text": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam hendrerit nisi sed sollicitudin peCODE
LOW…est/resources/org/sonar/core/sarif/valid-sarif210.json22 "text": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam hendrerit nisi sed sollicitudin peCODE
LOW…st/java/org/sonar/core/issue/tracking/TrackerTest.java318 " System.out.println(\"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Quisque vel diam purus. CurCODE
LOW…st/java/org/sonar/core/issue/tracking/TrackerTest.java318 " System.out.println(\"Lorem ipsum dolor sit amet, consectetur adipiscing elit. Quisque vel diam purus. CurCODE
Over-Commented Block38 hits · 38 pts
SeverityFileLineSnippetContext
LOWlogs.sh1#!/usr/bin/env bashCOMMENT
LOWstart.sh1#!/usr/bin/env bashCOMMENT
LOW…detector/original/OriginalCloneDetectionAlgorithm.java101 BlocksGroup[] sameHashBlocksGroups = createGroups(fileBlocks);COMMENT
LOW…detector/original/OriginalCloneDetectionAlgorithm.java121 if (sameHashBlocksGroups[i].size() < 2 || sameHashBlocksGroups[i].subsumedBy(sameHashBlocksGroups[i - 1], 1)) {COMMENT
LOW…detector/original/OriginalCloneDetectionAlgorithm.java141 // 11: for j := i + 1 to length(c) doCOMMENT
LOW…es/org/sonar/server/platform/ws/monitoring-metrics.txt1# HELP sonarqube_compute_engine_tasks_running_duration_seconds Compute engine task running time in secondsCOMMENT
LOW…es/org/sonar/server/platform/ws/monitoring-metrics.txt21# HELP sonarqube_health_integration_azuredevops_status Tells whether SonarQube instance has configured Azure integrationCOMMENT
LOW…es/org/sonar/server/platform/ws/monitoring-metrics.txt41sonarqube_elasticsearch_disk_space_free_bytes{node_name="sonarqube",} 9.00287975424E11COMMENT
LOW…sources/org/sonar/db/webhook/WebhookDeliveryMapper.xml81 name,COMMENT
LOW…ain/resources/org/sonar/db/source/FileSourceMapper.xml81 revisionCOMMENT
LOW…in/resources/org/sonar/db/component/SnapshotMapper.xml221 )COMMENT
LOW…n/resources/org/sonar/db/component/ComponentMapper.xml501 b_path,COMMENT
LOW…main/resources/org/sonar/db/component/BranchMapper.xml41 pull_request_binary,COMMENT
LOW…ao/src/main/resources/org/sonar/db/user/UserMapper.xml301 #{user.login,jdbcType=VARCHAR},COMMENT
LOW…esources/org/sonar/db/alm/setting/AlmSettingMapper.xml61 client_id,COMMENT
LOW…s/org/sonar/db/alm/setting/ProjectAlmSettingMapper.xml141 created_at,COMMENT
LOW…ao/src/main/resources/org/sonar/db/rule/RuleMapper.xml461 ad_hoc_description,COMMENT
LOW…ao/src/main/resources/org/sonar/db/rule/RuleMapper.xml481 #{isAdHoc,jdbcType=BOOLEAN},COMMENT
LOW…/main/resources/org/sonar/db/project/ProjectMapper.xml141 creation_method,COMMENT
LOW…/src/main/resources/org/sonar/db/issue/IssueMapper.xml221 #{ruleUuid,jdbcType=VARCHAR},COMMENT
LOW…n/resources/org/sonar/db/portfolio/PortfolioMapper.xml301 updated_atCOMMENT
LOW…rc/main/resources/org/sonar/db/ce/CeActivityMapper.xml201 #{isLast,jdbcType=BOOLEAN},COMMENT
LOW…o/src/main/resources/org/sonar/db/ce/CeQueueMapper.xml221 updated_at,COMMENT
LOW…n/java/org/sonar/application/command/EsJvmOptions.java61 // GC configurationCOMMENT
LOW…te_orphan_duplications_index_rows_without_component.rb1#COMMENT
LOW…/1236_populate_component_uuid_of_duplications_index.rb1#COMMENT
LOW…IT/v1/1235_add_component_uuid_to_duplications_index.rb1#COMMENT
LOW…pIT/v1/1239_add_analysis_uuid_to_duplications_index.rb1#COMMENT
LOW…1/1240_populate_analysis_uuid_of_duplications_index.rb1#COMMENT
LOW…2_make_analysis_uuid_not_null_on_duplications_index.rb1#COMMENT
LOW…ete_orphan_duplications_index_rows_without_analysis.rb1#COMMENT
LOW…_make_component_uuid_not_null_on_duplications_index.rb1#COMMENT
LOW…id_and_analysis_uuid_not_null_on_duplications_index.rb1#COMMENT
LOW…ponent_uuid_and_analysis_uuid_of_duplications_index.rb1#COMMENT
LOW…plications_index_rows_without_component_or_analysis.rb1#COMMENT
LOW…ponent_uuid_and_analysis_uuid_to_duplications_index.rb1#COMMENT
LOWscripts/logs.sh1#!/usr/bin/env bashCOMMENT
LOWscripts/start.sh1#!/usr/bin/env bashCOMMENT
Cross-File Repetition6 hits · 30 pts
SeverityFileLineSnippetContext
HIGH…response/GitlabConfigurationRestResponseForAdmins.java0when true with auto-provisioning, every group visible to the provisioning token is provisioned \ and the allowedgroups lSTRING
HIGH…nfig/request/GitlabConfigurationUpdateRestRequest.java0when true with auto-provisioning, every group visible to the provisioning token is provisioned \ and the allowedgroups lSTRING
HIGH…nfig/request/GitlabConfigurationCreateRestRequest.java0when true with auto-provisioning, every group visible to the provisioning token is provisioned \ and the allowedgroups lSTRING
HIGH…b/config/controller/GitlabConfigurationController.java0create a new email configuration. note that only a single configuration can exist at a time. requires 'administer systemSTRING
HIGH…b/config/controller/GithubConfigurationController.java0create a new email configuration. note that only a single configuration can exist at a time. requires 'administer systemSTRING
HIGH…il/config/controller/EmailConfigurationController.java0create a new email configuration. note that only a single configuration can exist at a time. requires 'administer systemSTRING
AI Slop Vocabulary8 hits · 22 pts
SeverityFileLineSnippetContext
MEDIUM⚡response.json1{"issues":[{"expand":"renderedFields,names,schema,operations,editmeta,changelog,versionedRepresentations","id":"365589",CODE
MEDIUM⚡response.json1{"issues":[{"expand":"renderedFields,names,schema,operations,editmeta,changelog,versionedRepresentations","id":"365589",CODE
MEDIUM⚡response.json1{"issues":[{"expand":"renderedFields,names,schema,operations,editmeta,changelog,versionedRepresentations","id":"365589",CODE
MEDIUM⚡response.json1{"issues":[{"expand":"renderedFields,names,schema,operations,editmeta,changelog,versionedRepresentations","id":"365589",CODE
MEDIUM⚡response.json1{"issues":[{"expand":"renderedFields,names,schema,operations,editmeta,changelog,versionedRepresentations","id":"365589",CODE
MEDIUM…e/builtin/BuiltInQPChangeNotificationTemplateTest.java246 .contains("\"Sonar way comprehensive\" - C#: " + server.getPublicRootUrl() + "/profiles/changelog?language=cs&nameSTRING
MEDIUM…ar/ce/task/projectanalysis/step/PersistIssuesStep.java53 // be a problem while making sure we leverage extensively the batch feature to speed up persistenceCOMMENT
MEDIUM…sk/projectanalysis/step/SendAnalysisTelemetryStep.java161 // plugin language keys), but we strip any non-telemetry-safe characters to be robust againstCOMMENT
Decorative Section Separators6 hits · 18 pts
SeverityFileLineSnippetContext
MEDIUM…api/onboarding/alm/OnboardingAlmConfigurationTest.java74 // ── GitHub ────────────────────────────────────────────────────────────────────COMMENT
MEDIUM…api/onboarding/alm/OnboardingAlmConfigurationTest.java158 // ── GitLab ──────────────────────────────────────────────────────────────────COMMENT
MEDIUM…api/onboarding/alm/OnboardingAlmConfigurationTest.java233 // ── Azure DevOps ────────────────────────────────────────────────────────────COMMENT
MEDIUM…api/onboarding/alm/OnboardingAlmConfigurationTest.java293 // ── Bitbucket Server ────────────────────────────────────────────────────────COMMENT
MEDIUM…api/onboarding/alm/OnboardingAlmConfigurationTest.java369 // ── Bitbucket Cloud ─────────────────────────────────────────────────────────COMMENT
MEDIUM…api/onboarding/alm/OnboardingAlmConfigurationTest.java478 // ── Fixtures ────────────────────────────────────────────────────────────────COMMENT
Modern AI Meta-Vocabulary2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUM…rg/sonar/server/platform/AbstractSystemInfoWriter.java33 // agenticCOMMENT
MEDIUM…stoken/controller/DefaultScmAccessTokenController.java45 // open a PR/MR on the bound repository. The agentic shared service has its own endpoint-scoped trustCOMMENT
Verbosity Indicators3 hits · 6 pts
SeverityFileLineSnippetContext
LOW⚡…projectanalysis/issue/PullRequestTrackerExecution.java49 // Step 1: only keep issues on changed linesCOMMENT
LOW⚡…projectanalysis/issue/PullRequestTrackerExecution.java53 // Step 2: remove issues that are resolved in the target branchCOMMENT
LOW…projectanalysis/issue/PullRequestTrackerExecution.java64 // Step 3: track issues with previous analysis of the current PRCOMMENT
Structural Annotation Overuse3 hits · 6 pts
SeverityFileLineSnippetContext
LOW⚡…projectanalysis/issue/PullRequestTrackerExecution.java49 // Step 1: only keep issues on changed linesCOMMENT
LOW⚡…projectanalysis/issue/PullRequestTrackerExecution.java53 // Step 2: remove issues that are resolved in the target branchCOMMENT
LOW…projectanalysis/issue/PullRequestTrackerExecution.java64 // Step 3: track issues with previous analysis of the current PRCOMMENT
Slop Phrases4 hits · 4 pts
SeverityFileLineSnippetContext
LOW…ken/notification/TokenExpirationEmailComposerTest.java74 + "Don't forget to update the token in the locations where it is in use. This may include the CI pipeline thatCODE
LOW…ken/notification/TokenExpirationEmailComposerTest.java95 + "Don't forget to update the token in the locations where it is in use. This may include the CI pipeline thatCODE
LOW…ertoken/notification/TokenExpirationEmailComposer.java80 .append("Don't forget to update the token in the locations where it is in use. "CODE
LOW…rg/sonar/server/common/component/ComponentUpdater.java120 * Don't forget to call commitAndIndex(...) when ready to commit.COMMENT
Hyper-Verbose Identifiers3 hits · 3 pts
SeverityFileLineSnippetContext
LOW…/azurebilling/service/AzureBillingResponseHandler.java29public class AzureBillingResponseHandler {CODE
LOW…/java/org/sonar/server/es/SynchronousEsHttpClient.java231 private static final class BufferingResponseHandler implements HttpClientResponseHandler<BufferedResponse> {CODE
LOW…-ce/src/main/java/org/sonar/ce/httpd/CeHttpServer.java103 private static class NotFoundHttpRequestHandler implements HttpRequestHandler {CODE
Self-Referential Comments1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUM…ao/src/test/java/org/sonar/db/dump/SQSchemaDumper.java39 "#### This file is autogenerated and stored in SCM to ####" + LINE_SEPARATOR +CODE