1.5

Adjusted Signal

1.5

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

10.9K

Stars

Language

459.3K

Lines of Code

1.6K

Files

422

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 312 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.8/100 · LOW

Are imports declared and package/API names verified? 48 finding(s).

Agent Over-Engineering Ratio 1.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 65 finding(s).

PR Review Velocity Impact 6.9/100 · LOW

Which changes need focused human review? 422 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 11HIGH 1MEDIUM 65LOW 345

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 422 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block201 hits · 196 pts

Severity	File	Line	Snippet	Context
LOW	.golangci.dev.yml	1	version: "2"	COMMENT
LOW	.golangci.yml	1	version: "2"	COMMENT
LOW	.golangci.yml	121	# or some structurally known areas like testutil and test	COMMENT
LOW	config/config.go	121	// to `file` or an empty string. If `policies.policy_path` is not set, then Tyk will load policies	COMMENT
LOW	config/config.go	181	Timeout int `json:"timeout"`	COMMENT
LOW	config/config.go	201	TLSMinVersion string `json:"tls_min_version"`	COMMENT
LOW	config/config.go	221	// Note: The maximum decompressed size is controlled by `max_decompressed_size`.	COMMENT
LOW	config/config.go	241	Enabled bool `json:"enabled"`	COMMENT
LOW	config/config.go	261	//	COMMENT
LOW	config/config.go	341		COMMENT
LOW	config/config.go	361	// - `circuit_breaker_state` will include the circuit breaker state when applicable.	COMMENT
LOW	config/config.go	381	// - `upstream_latency` will include the upstream latency of the request.	COMMENT
LOW	config/config.go	581	// Enable HTTP2 protocol handling	COMMENT
LOW	config/config.go	601	// For patterns that start with `^`, the gateway will already perform prefix matching so EnablePathPrefixMatching will	COMMENT
LOW	config/config.go	621	// This option allows for more specific and controlled routing of API requests, potentially reducing unintended matches	COMMENT
LOW	config/config.go	641	// The string value in the array can be two of the following options:	COMMENT
LOW	config/config.go	661		COMMENT
LOW	config/config.go	681	// - If the API Request contains the `Content-Length` header, this is directly compared against `MaxRequestBodySize`.	COMMENT
LOW	config/config.go	1021	// If Tyk is being used in its standard configuration (Open Source installations), then API definitions are stored in t	COMMENT
LOW	config/config.go	1041		COMMENT
LOW	config/config.go	1061		COMMENT
LOW	config/config.go	1081	// "monitor": {	COMMENT
LOW	config/config.go	1141		COMMENT
LOW	config/config.go	1201	// Tyk is capable of recording every hit to your API to a database with various filtering parameters. Set this value to	COMMENT
LOW	config/config.go	1221	// "enabled": true, //Turned off by default	COMMENT
LOW	config/config.go	1241	// cache (no size eviction). Only safe when the distinct-pattern keyspace	COMMENT
LOW	config/config.go	1261	// Example:	COMMENT
LOW	config/config.go	1301	// Ignore the case of any endpoints for APIs managed by Tyk. Setting this to `true` will override any individual API an	COMMENT
LOW	config/config.go	1321	// Allowed values are `text`, `json`, `legacy` or an array of log sinks.	COMMENT
LOW	config/config.go	1341		COMMENT
LOW	config/config.go	1421	//	COMMENT
LOW	config/config.go	1441	// Sample Override Message Setting	COMMENT
LOW	config/config.go	1461	// "500": [{	COMMENT
LOW	config/external_service.go	21	}	COMMENT
LOW	config/development.go	1	//go:build dev	COMMENT
LOW	config/opentracing_custom_env_loader.go	21	BatchSize int `json:"batch_size"`	COMMENT
LOW	config/opentracing_custom_env_loader.go	61	b, err := yaml.Marshal(src)	COMMENT
LOW	config/opentracing_custom_env_loader.go	101	//	COMMENT
LOW	ci/images/plugin-compiler/data/build.sh	1	#!/bin/bash	COMMENT
LOW	ci/images/plugin-compiler-ng/scripts/loadtest-gate.sh	1	#!/usr/bin/env bash	COMMENT
LOW	…mages/plugin-compiler-ng/data/sysroot-2.17-digests.txt	1	# manylinux2014 image digests = the glibc-2.17 (RHEL 7 / CentOS 7 ABI) sysroot sources.	COMMENT
LOW	ci/images/plugin-compiler-ng/data/build.sh	1	#!/bin/bash	COMMENT
LOW	ci/images/plugin-compiler-ng/data/validate-plugin.sh	1	#!/bin/bash	COMMENT
LOW	internal/rate/smoothing.go	21	}	COMMENT
LOW	internal/graphengine/transport.go	21	transportType GraphQLEngineTransportType	COMMENT
LOW	internal/graphengine/credential_isolation_test.go	701	}	COMMENT
LOW	internal/graphengine/credential_isolation_test.go	1221	assert.ElementsMatch(t, credentials, upstream.headerValues(dynamicUpstreamHeader))	COMMENT
LOW	internal/graphengine/engine_v1_test.go	421		COMMENT
LOW	internal/crypto/helpers.go	41	// and returns the result as a hexadecimal string.	COMMENT
LOW	internal/crypto/helpers.go	161		COMMENT
LOW	internal/crypto/testutil.go	81	//	COMMENT
LOW	internal/crypto/testutil.go	121	// Encode the server certificate to PEM format	COMMENT
LOW	internal/crypto/testutil.go	141	// Returns:	COMMENT
LOW	internal/crypto/testutil.go	201	var clientKeyPEM bytes.Buffer	COMMENT
LOW	internal/jwkcompat/jwkcompat.go	1	// Package jwkcompat parses JSON Web Key Sets exactly the way go-jose v3 did,	COMMENT
LOW	internal/jsonrpc/vem.go	1	// Package jsonrpc provides utilities for JSON-RPC 2.0 protocol handling.	COMMENT
LOW	internal/reflect/reflect.go	61	// later, as a default value doesn't makes sense here.	COMMENT
LOW	internal/reflect/reflect.go	81	// }	COMMENT
LOW	internal/otel/mcp_trace_context.go	101	// SetDefaults fills an omitted read-source list with the canonical default. An	COMMENT
LOW	internal/otel/config.go	41	// Defaults to true when metrics are enabled.	COMMENT
141 more matches not shown…

Decorative Section Separators53 hits · 148 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1265	# -----------------------------------------------------------------------------	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1267	# -----------------------------------------------------------------------------	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1274	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1276	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1309	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1311	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1321	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1323	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1342	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1344	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1354	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1356	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1366	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1368	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1373	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1375	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1380	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1382	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1387	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1389	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1394	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1396	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1401	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1403	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1423	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1425	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1427	# ==========================================================================	COMMENT
MEDIUM⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	1429	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	8	# =============================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	28	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	30	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	75	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	77	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	210	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	212	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1241	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1243	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1549	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1551	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1596	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1598	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1623	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1625	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1646	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1648	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1722	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1724	# ==========================================================================	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1765	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1767	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1792	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	1794	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	gateway/sse_hook_mcp_list_filter_test.go	565	// ── Out-of-Order Frame Tests ────────────────────────────────────────────────	COMMENT
MEDIUM	gateway/sse_hook_mcp_list_filter_test.go	1035	// ── Benchmarks ──────────────────────────────────────────────────────────────	COMMENT

Hallucination Indicators11 hits · 125 pts

Severity	File	Line	Snippet	Context
CRITICAL	coprocess/bindings/java/CoprocessCommon.java	622	com.google.protobuf.AbstractMessageLite.Builder.addAll(	CODE
CRITICAL	coprocess/bindings/java/CoprocessSessionState.java	637	com.google.protobuf.AbstractMessageLite.Builder.addAll(	CODE
CRITICAL	coprocess/bindings/java/CoprocessSessionState.java	1598	com.google.protobuf.AbstractMessageLite.Builder.addAll(	CODE
CRITICAL	coprocess/bindings/java/CoprocessSessionState.java	1768	com.google.protobuf.AbstractMessageLite.Builder.addAll(	CODE
CRITICAL	coprocess/bindings/java/CoprocessSessionState.java	3532	com.google.protobuf.AbstractMessageLite.Builder.addAll(	CODE
CRITICAL	coprocess/bindings/java/CoprocessSessionState.java	6972	com.google.protobuf.AbstractMessageLite.Builder.addAll(	CODE
CRITICAL	coprocess/bindings/java/CoprocessMiniRequestObject.java	1853	com.google.protobuf.AbstractMessageLite.Builder.addAll(	CODE
CRITICAL	coprocess/bindings/java/CoprocessMiniRequestObject.java	2442	com.google.protobuf.AbstractMessageLite.Builder.addAll(	CODE
CRITICAL⚡	gateway/analytics.go	247	a.Path = globalConfig.AnalyticsConfig.NormaliseUrls.CompiledPatternSet.UUIDs.ReplaceAllString(a.Path, "{uuid}")	CODE
CRITICAL⚡	gateway/analytics.go	251	a.Path = globalConfig.AnalyticsConfig.NormaliseUrls.CompiledPatternSet.ULIDs.ReplaceAllString(a.Path, "{ulid}")	CODE
CRITICAL⚡	gateway/analytics.go	255	a.Path = globalConfig.AnalyticsConfig.NormaliseUrls.CompiledPatternSet.IDs.ReplaceAllString(a.Path, "/{id}")	CODE

Structural Annotation Overuse43 hits · 71 pts

Severity	File	Line	Snippet	Context
LOW	ci/tests/metrics/metrics_test.go	1409	// Step 1: Send initialize request.	COMMENT
LOW	ci/tests/metrics/metrics_test.go	1426	// Step 2: Send initialized notification (no id field = notification).	COMMENT
LOW⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	825	# Step 3: Verify token works	COMMENT
LOW⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	832	# Step 4: Delete the OAuth client	COMMENT
LOW⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	839	# Step 5: Try to use the token from the deleted client	COMMENT
LOW	ci/tests/error-overrides/scripts/run-override-tests.sh	785	# Step 1: Create an OAuth client	COMMENT
LOW	ci/tests/error-overrides/scripts/run-override-tests.sh	804	# Step 2: Get an access token	COMMENT
LOW⚡	apidef/oas/servers_regeneration.go	53	// Step 1: Compute old Tyk URLs from old state (regenerate what they were)	COMMENT
LOW⚡	apidef/oas/servers_regeneration.go	63	// Step 2: Remove old Tyk-generated servers (preserves user-provided servers)	COMMENT
LOW⚡	apidef/oas/servers_regeneration.go	66	// Step 3: Generate new Tyk servers	COMMENT
LOW⚡	apidef/oas/servers_regeneration.go	69	// Step 4: Add Tyk servers first	COMMENT
LOW	apidef/oas/servers_regeneration.go	81	// Step 5: Add user servers back, deduplicating by normalized URL	COMMENT
LOW⚡	apidef/oas/upstream_test.go	1379	// Step 1: Start with OAS structure	COMMENT
LOW⚡	apidef/oas/upstream_test.go	1385	// Step 2: ExtractTo API definition (weight=0 should be excluded from Proxy.Targets)	COMMENT
LOW	apidef/oas/upstream_test.go	1399	// Step 3: Fill back into OAS (should preserve weight=0 from original)	COMMENT
LOW	apidef/oas/README.md	17	### Step 1: Add the OAS Schema File	COMMENT
LOW	apidef/oas/README.md	29	### Step 2: Understand Schema Structure Differences	COMMENT
LOW	apidef/oas/README.md	44	### Step 3: Update Code (if needed)	COMMENT
LOW	apidef/oas/README.md	69	### Step 4: Add Tests	COMMENT
LOW	apidef/oas/README.md	188	### Step 5: Run Tests	COMMENT
LOW	apidef/oas/README.md	201	### Step 6: Update Default Version (Optional)	COMMENT
LOW	apidef/oas/README.md	229	### Step 7: Document Breaking Changes	COMMENT
LOW	gateway/mw_jwt_test.go	4884	// Step 1: Create session with valid scope	COMMENT
LOW	gateway/mw_jwt_test.go	4906	// Step 2: SECURITY TEST - Try to access with token that has NO scope and NO base policy	COMMENT
LOW	gateway/mw_jwt_test.go	4924	// Step 3: Verify session can still be accessed with valid token	COMMENT
LOW	gateway/mw_jwt_test.go	4987	// Step 1: Create session with valid policy in token	COMMENT
LOW	gateway/mw_jwt_test.go	5009	// Step 2: SECURITY TEST - Token without policy claim on existing session should be REJECTED	COMMENT
LOW	gateway/mw_jwt_test.go	5027	// Step 3: Verify session can still be accessed with valid token (with policy)	COMMENT
LOW	gateway/mw_jwt_test.go	5043	// Step 4: First-time request with no policy should also be rejected	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	33	// Step 1: Create API KEY without POLICY	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	41	// Step 2: Send traffic - should succeed	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	48	// Step 3: Update key to set is_inactive: true	COMMENT
LOW	gateway/mw_key_expired_check_test.go	61	// Step 4: Send traffic - should be rejected with 403 Forbidden	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	89	// Step 1: Create API KEY without POLICY	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	97	// Step 2: Send traffic - should succeed (this also caches the session)	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	104	// Step 3: Update key to set is_inactive: true	COMMENT
LOW	gateway/mw_key_expired_check_test.go	125	// Step 4: Send traffic - should be rejected with 403 Forbidden	COMMENT
LOW	gateway/oauth_manager_test.go	1093	// Step 2 - invalidate the refresh token	COMMENT
LOW	gateway/oauth_manager_test.go	1118	// Step 3 - try to refresh	COMMENT
LOW	gateway/mw_protected_resource_test.go	1035	// Step 1: Client requests a protected endpoint without credentials.	COMMENT
LOW	gateway/mw_protected_resource_test.go	1048	// Step 2: Extract resource_metadata URL from WWW-Authenticate header.	COMMENT
LOW	gateway/mw_protected_resource_test.go	1061	// Step 3: Client fetches the PRM well-known endpoint using the extracted URL path.	COMMENT
LOW	gateway/mw_protected_resource_test.go	1074	// Step 4: Parse the PRM response and validate all fields.	COMMENT

Verbosity Indicators34 hits · 57 pts

Severity	File	Line	Snippet	Context
LOW	ci/tests/metrics/metrics_test.go	1409	// Step 1: Send initialize request.	COMMENT
LOW	ci/tests/metrics/metrics_test.go	1426	// Step 2: Send initialized notification (no id field = notification).	COMMENT
LOW⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	825	# Step 3: Verify token works	COMMENT
LOW⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	832	# Step 4: Delete the OAuth client	COMMENT
LOW⚡	ci/tests/error-overrides/scripts/run-override-tests.sh	839	# Step 5: Try to use the token from the deleted client	COMMENT
LOW	ci/tests/error-overrides/scripts/run-override-tests.sh	785	# Step 1: Create an OAuth client	COMMENT
LOW	ci/tests/error-overrides/scripts/run-override-tests.sh	804	# Step 2: Get an access token	COMMENT
LOW⚡	apidef/oas/servers_regeneration.go	53	// Step 1: Compute old Tyk URLs from old state (regenerate what they were)	COMMENT
LOW⚡	apidef/oas/servers_regeneration.go	63	// Step 2: Remove old Tyk-generated servers (preserves user-provided servers)	COMMENT
LOW⚡	apidef/oas/servers_regeneration.go	66	// Step 3: Generate new Tyk servers	COMMENT
LOW⚡	apidef/oas/servers_regeneration.go	69	// Step 4: Add Tyk servers first	COMMENT
LOW	apidef/oas/servers_regeneration.go	81	// Step 5: Add user servers back, deduplicating by normalized URL	COMMENT
LOW⚡	apidef/oas/upstream_test.go	1379	// Step 1: Start with OAS structure	COMMENT
LOW⚡	apidef/oas/upstream_test.go	1385	// Step 2: ExtractTo API definition (weight=0 should be excluded from Proxy.Targets)	COMMENT
LOW	apidef/oas/upstream_test.go	1399	// Step 3: Fill back into OAS (should preserve weight=0 from original)	COMMENT
LOW	gateway/mw_jwt_test.go	4884	// Step 1: Create session with valid scope	COMMENT
LOW	gateway/mw_jwt_test.go	4906	// Step 2: SECURITY TEST - Try to access with token that has NO scope and NO base policy	COMMENT
LOW	gateway/mw_jwt_test.go	4924	// Step 3: Verify session can still be accessed with valid token	COMMENT
LOW	gateway/mw_jwt_test.go	4987	// Step 1: Create session with valid policy in token	COMMENT
LOW	gateway/mw_jwt_test.go	5009	// Step 2: SECURITY TEST - Token without policy claim on existing session should be REJECTED	COMMENT
LOW	gateway/mw_jwt_test.go	5027	// Step 3: Verify session can still be accessed with valid token (with policy)	COMMENT
LOW	gateway/mw_jwt_test.go	5043	// Step 4: First-time request with no policy should also be rejected	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	33	// Step 1: Create API KEY without POLICY	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	41	// Step 2: Send traffic - should succeed	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	48	// Step 3: Update key to set is_inactive: true	COMMENT
LOW	gateway/mw_key_expired_check_test.go	61	// Step 4: Send traffic - should be rejected with 403 Forbidden	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	89	// Step 1: Create API KEY without POLICY	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	97	// Step 2: Send traffic - should succeed (this also caches the session)	COMMENT
LOW⚡	gateway/mw_key_expired_check_test.go	104	// Step 3: Update key to set is_inactive: true	COMMENT
LOW	gateway/mw_key_expired_check_test.go	125	// Step 4: Send traffic - should be rejected with 403 Forbidden	COMMENT
LOW	gateway/mw_protected_resource_test.go	1035	// Step 1: Client requests a protected endpoint without credentials.	COMMENT
LOW	gateway/mw_protected_resource_test.go	1048	// Step 2: Extract resource_metadata URL from WWW-Authenticate header.	COMMENT
LOW	gateway/mw_protected_resource_test.go	1061	// Step 3: Client fetches the PRM well-known endpoint using the extracted URL path.	COMMENT
LOW	gateway/mw_protected_resource_test.go	1074	// Step 4: Parse the PRM response and validate all fields.	COMMENT

Unused Imports22 hits · 22 pts

Severity	File	Line	Context
LOW	ci/tests/python-plugins/src/middleware.py	1	CODE
LOW	ci/tests/python-plugins/src/middleware.py	2	CODE
LOW	coprocess/python/dispatcher.py	1	CODE
LOW	coprocess/python/dispatcher.py	2	CODE
LOW	coprocess/python/dispatcher.py	2	CODE
LOW	coprocess/python/dispatcher.py	2	CODE
LOW	coprocess/python/tyk/event.py	1	CODE
LOW	coprocess/python/tyk/event.py	4	CODE
LOW	coprocess/python/tyk/object.py	1	CODE
LOW	coprocess/python/tyk/object.py	7	CODE
LOW	coprocess/python/tyk/object.py	8	CODE
LOW	coprocess/python/tyk/object.py	9	CODE
LOW	coprocess/python/tyk/middleware.py	3	CODE
LOW	coprocess/python/tyk/middleware.py	6	CODE
LOW	coprocess/bindings/python/coprocess_grpc_pb2.py	7	CODE
LOW	coprocess/bindings/python/coprocess_grpc_pb2.py	8	CODE
LOW	coprocess/bindings/python/coprocess_grpc_pb2.py	10	CODE
LOW	…s/bindings/python/coprocess_mini_request_object_pb2.py	15	CODE
LOW	coprocess/bindings/python/coprocess_object_pb2.py	15	CODE
LOW	coprocess/bindings/python/coprocess_object_pb2.py	16	CODE
LOW	coprocess/bindings/python/coprocess_object_pb2.py	17	CODE
LOW	coprocess/bindings/python/coprocess_object_pb2.py	18	CODE

Self-Referential Comments7 hits · 20 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker/services/docker-compose.yml	2	# This file is intended only to start the docker compose services that	COMMENT
MEDIUM	ci/tests/error-overrides/docker-compose.yml	295	# Create a body larger than 4KB (maxBodySizeForMatching)	COMMENT
MEDIUM	ci/tests/error-overrides/scripts/run-override-tests.sh	632	# Create a session/key via Gateway Admin API	COMMENT
MEDIUM	coprocess/bindings/python/coprocess_object_pb2_grpc.py	93	# This class is part of an EXPERIMENTAL API.	COMMENT
MEDIUM	.github/zizmor.yml	2	# This file is managed by gromit, do not edit by hand.	COMMENT
MEDIUM	.github/workflows/drift-check.yml	2	# This file is managed by gromit, do not edit by hand.	COMMENT
MEDIUM	.github/workflows/zizmor.yml	2	# This file is managed by gromit, do not edit by hand.	COMMENT

Fake / Example Data15 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	internal/crypto/helpers_test.go	31	cert: &tls.Certificate{Leaf: PrefixPublicKeyCommonName([]byte("dummy-value"))},	CODE
LOW	internal/reflect/clone_test.go	34	Name: "John Doe",	CODE
LOW	internal/reflect/clone_test.go	49	Name: "John Doe",	CODE
LOW	internal/iamtest/iamtest.go	32	if _, err := w.Write([]byte(`{"access_token":"fake-token","token_type":"Bearer","expires_in":3600}`)); err != nil {	CODE
LOW	user/session_test.go	1166	"email": "user@example.com",	CODE
LOW	gateway/mw_js_plugin_test.go	691	decodedJwtPayload := `{"sub":"1234567890","name":"John Doe","iat":1516239022}`	CODE
LOW	gateway/mw_js_plugin_goja_test.go	413	`{"sub":"1234567890","name":"John Doe","iat":1516239022}`},	CODE
LOW	gateway/mw_jwt_nested_claims_test.go	126	"name": "John Doe",	CODE
LOW	gateway/proxy_muxer_test.go	49	input: strings.NewReader("lorem ipsum dolor sit amet"),	CODE
LOW	gateway/proxy_muxer_test.go	49	input: strings.NewReader("lorem ipsum dolor sit amet"),	CODE
LOW	gateway/cert_old_test.go	213	EmailAddresses: []string{"test@test.com"},	CODE
LOW	gateway/oauth_manager_test.go	1278	"username": "test@test.com",	CODE
LOW	gateway/oauth_manager_test.go	1448	Member: fmt.Sprintf("dummy-value-%d", k),	CODE
LOW	gateway/oauth_manager_test.go	1456	Member: fmt.Sprintf("dummy-value-%d", k),	CODE
LOW	gateway/cert_test.go	1315	EmailAddresses: []string{"test@test.com"},	CODE

Redundant / Tautological Comments11 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	ci/tests/error-overrides/docker-compose.yml	469	# Set SO_LINGER to send RST instead of FIN	COMMENT
LOW	ci/tests/error-overrides/scripts/run-override-tests.sh	956	# Check if actual flag matches expected OR alternative	COMMENT
LOW	ci/tests/error-overrides/scripts/run-override-tests.sh	1067	# Check if we got override response OR empty (client disconnected before response)	COMMENT
LOW	ci/tests/error-overrides/scripts/run-override-tests.sh	1141	# Check if we got CBO override in any of the recent requests	COMMENT
LOW	.github/workflows/release.yml	259	# Check if any layer does NOT end in gzip/tar+gzip/tar.gzip	COMMENT
LOW	.github/workflows/release.yml	338	# Check if any layer does NOT end in gzip/tar+gzip/tar.gzip	COMMENT
LOW	.github/workflows/release.yml	415	# Check if any layer does NOT end in gzip/tar+gzip/tar.gzip	COMMENT
LOW	.github/workflows/release.yml	493	# Check if any layer does NOT end in gzip/tar+gzip/tar.gzip	COMMENT
LOW	.github/workflows/release.yml	568	# Check if any layer does NOT end in gzip/tar+gzip/tar.gzip	COMMENT
LOW	.github/workflows/release.yml	645	# Check if any layer does NOT end in gzip/tar+gzip/tar.gzip	COMMENT
LOW	.github/workflows/release.yml	739	# Check if any changed files are in relevant packages	COMMENT

Excessive Try-Catch Wrapping8 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	ci/tests/error-overrides/docker-compose.yml	473	except Exception as e:	CODE
LOW	ci/tests/error-overrides/docker-compose.yml	546	except Exception as e:	CODE
LOW	ci/tests/error-overrides/docker-compose.yml	580	except Exception as e:	CODE
LOW	coprocess/python/dispatcher.py	16	except Exception as e:	CODE
LOW	coprocess/python/dispatcher.py	68	except Exception as e:	CODE
LOW	coprocess/python/dispatcher.py	78	except Exception as e:	CODE
MEDIUM	coprocess/python/dispatcher.py	72	def dispatch_event(self, event_json):	CODE
LOW	coprocess/python/tyk/middleware.py	43	except Exception as e:	CODE

Slop Phrases5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	gateway/mw_jwt_test.go	2600	// Don't forget to validate the alg is what you expect:	COMMENT
LOW	gateway/mw_jwt_test.go	2631	// Don't forget to validate the alg is what you expect:	COMMENT
LOW	gateway/mw_jwt_test.go	2661	// Don't forget to validate the alg is what you expect:	COMMENT
LOW	gateway/mw_external_oauth.go	135	// don't forget to validate the alg is what you expect:	COMMENT
LOW	gateway/mw_jwt.go	1315	// Don't forget to validate the alg is what you expect:	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	apidef/oas/servers_regeneration.go	373	// It uses URL normalization for robust matching and preserves all other servers.	COMMENT
MEDIUM	gateway/cert_test.go	1857	//configure server so we can useSSL and utilize the logic, but skip verification in the clients	COMMENT

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	coprocess/python/tyk/object.py	17	except:	CODE

Modern AI Meta-Vocabulary2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	README.md	105	Tyk Gateway governs MCP traffic from AI agents, applying authentication, rate limiting and per-tool access control to ev	CODE
MEDIUM	README.md	116	[Open API Standards:](https://tyk.io/docs/getting-started/using-oas-definitions/import-an-oas-api/) Import your Swagger	CODE

Deep Nesting3 hits · 3 pts

Severity	File	Line	Context
LOW	coprocess/python/tyk/object.py	13	CODE
LOW	coprocess/python/tyk/middleware.py	47	CODE
LOW	coprocess/python/tyk/middleware.py	74	CODE

AI Structural Patterns2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	coprocess/bindings/python/coprocess_object_pb2_grpc.py	99		CODE
LOW	coprocess/bindings/python/coprocess_object_pb2_grpc.py	126		CODE

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	coprocess/python/tyk/object.py	18	# TODO: add error handling	COMMENT

Hyper-Verbose Identifiers1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	coprocess/python/tyk/middleware.py	60	def build_hooks_and_event_handlers(self):	CODE

TykTechnologies/tyk

Open-Source Code Quality, Security and Technical Debt Review