This report summarizes scanner evidence for VPN-Subcription-Links/ClashX-V2Ray-TopFreeProxy. SynthScan examined 6,690 lines of code across 39 source files, recording 41 pattern matches distributed across 3 syntactic categories. The legacy adjusted pattern signal is 8.4 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 40 finding(s).
Are imports declared and package/API names verified? 1 finding(s).
Are wrappers, guards, and repeated structures necessary? 37 finding(s).
Which changes need focused human review? 41 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 41 distinct pattern matches across 3 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | combine/tests/test_combine.py | 20 | def test_invalid_unicode_nodes_do_not_break_publication(self): | CODE |
| LOW⚡ | combine/tests/test_combine.py | 27 | def test_bad_sources_do_not_break_good_sources(self): | CODE |
| LOW⚡ | combine/tests/test_combine.py | 32 | def test_identity_preserves_distinct_credentials_and_stable_names(self): | CODE |
| LOW⚡ | combine/tests/test_combine.py | 38 | def test_readable_labels_are_bounded_and_disambiguated(self): | CODE |
| LOW⚡ | combine/tests/test_combine.py | 46 | def test_short_id_collision_is_resolved(self): | CODE |
| LOW⚡ | combine/tests/test_combine.py | 54 | def test_blacklist_and_empty_output(self): | CODE |
| LOW | combine/tests/test_combine.py | 67 | def test_invalid_ports_and_shapes(self): | CODE |
| LOW | combine/tests/test_download.py | 23 | def test_transient_http_error_recovers(self, get, sleep): | CODE |
| LOW⚡ | combine/tests/test_download.py | 37 | def test_timeouts_stop_after_three_attempts(self, get, sleep): | CODE |
| LOW⚡ | combine/tests/test_download.py | 45 | def test_permanent_http_error_does_not_retry(self, get): | CODE |
| LOW⚡ | combine/tests/test_download.py | 53 | def test_certificate_error_does_not_retry(self, get): | CODE |
| LOW⚡ | combine/tests/test_download.py | 59 | def test_streamed_size_limit_without_content_length(self, get): | CODE |
| LOW⚡ | combine/tests/test_download.py | 68 | def test_declared_oversized_response_is_not_read(self, get): | CODE |
| LOW | combine/tests/test_download.py | 83 | def test_diagnostics_reach_source_report_without_content(self, get): | CODE |
| LOW | combine/tests/test_validation.py | 27 | def test_clash_protocol_credentials_and_transport_shapes(self): | CODE |
| LOW | combine/tests/test_validation.py | 65 | def test_invalid_uri_payloads_ports_and_credentials_are_skipped(self): | CODE |
| LOW | combine/tests/test_validation.py | 78 | def test_relaxed_baseline_counts_previously_published_invalid_entries(self): | CODE |
| LOW | combine/tests/test_validation.py | 87 | def test_engine_rejection_timeout_and_missing_binary(self, execute, which): | CODE |
| LOW | combine/tests/test_validation.py | 98 | def test_failed_engine_preserves_outputs_timestamp_and_reports_failure(self): | CODE |
| LOW | combine/tests/test_validation.py | 119 | def test_checksum_mismatch_does_not_replace_executable(self, get, system, machine): | CODE |
| LOW⚡ | combine/tests/test_sources.py | 34 | def test_legacy_script_entry_point(self): | CODE |
| LOW⚡ | combine/tests/test_sources.py | 41 | def test_registry_rejects_duplicate_ids_and_invalid_urls(self): | CODE |
| LOW⚡ | combine/tests/test_sources.py | 49 | def test_dated_feed_skips_http_success_with_unusable_content(self): | CODE |
| LOW⚡ | combine/tests/test_sources.py | 60 | def test_fallback_to_last_valid_daily_feed(self): | CODE |
| LOW⚡ | combine/tests/test_sources.py | 70 | def test_generated_links_are_consistent_and_preserve_other_sections(self): | CODE |
| LOW⚡ | combine/tests/test_sources.py | 80 | def test_partial_failure_preserves_both_outputs_and_timestamp(self): | CODE |
| LOW | combine/tests/test_sources.py | 92 | def test_success_and_later_failure_keep_last_publication(self): | CODE |
| LOW | combine/tests/test_sources.py | 102 | def test_disabled_sources_are_not_generated_or_fetched(self): | CODE |
| LOW | combine/tests/test_sources.py | 116 | def test_mixed_provider_skips_only_disabled_format(self): | CODE |
| LOW | combine/tests/test_sources.py | 135 | def test_invalid_format_enabled_flag_is_rejected(self): | CODE |
| LOW | combine/tests/test_sources.py | 142 | def test_removed_links_are_archived_without_duplicates(self): | CODE |
| LOW | combine/tests/test_sources.py | 160 | def test_large_drop_keeps_both_outputs_and_can_be_overridden(self): | CODE |
| LOW | combine/tests/test_sources.py | 182 | def test_retention_guard_uses_published_files_after_failed_attempt(self): | CODE |
| LOW | combine/tests/test_sources.py | 193 | def test_exactly_half_the_published_count_is_allowed(self): | CODE |
| LOW | combine/tests/test_sources.py | 205 | def test_invalid_retained_ratio_is_rejected_before_fetching(self): | CODE |
| LOW | combine/tests/test_sources.py | 210 | def test_isolated_live_check_does_not_change_guides(self): | CODE |
| LOW | combine/tests/test_publish.py | 12 | def test_publication_races_and_conflicts(self): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | combine/tests/test_combine.py | 28 | result = yaml.safe_load(merge_clash([None, '<html>error</html>', '[]', 'proxies: [null]', config()], TEMPLATE)) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | combine/download.py | 19 | CODE | |
| LOW | combine/sources.py | 19 | CODE | |
| LOW | combine/tests/test_publish.py | 12 | CODE |