Reliable & unreliable messages over UDP. Robust message fragmentation & reassembly. P2P networking / NAT traversal. Encryption.
This report summarizes scanner evidence for ValveSoftware/GameNetworkingSockets, a C++ project with 9,971 GitHub stars. SynthScan examined 96,068 lines of code across 247 source files, recording 569 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 6.2 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 542 finding(s).
Are imports declared and package/API names verified? 3 finding(s).
Are wrappers, guards, and repeated structures necessary? 28 finding(s).
Which changes need focused human review? 569 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 569 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmake/apple/build-apple-deps.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | cmake/apple/make-xcframework.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | cmake/apple/make-xcframework.sh | 101 | COMMENT | |
| LOW | cmake/apple/run-ios-smoke-test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 1 | //========== Copyright (c) Valve Corporation. All Rights Reserved. ============ | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 21 | { | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 41 | virtual SteamNetworkingMessage_t *AllocateMessage( int cbAllocateBuffer ) = 0; | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 61 | /// relay network is anticipated. | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 81 | virtual ESteamNetworkingAvailability GetRelayNetworkStatus( SteamRelayNetworkStatus_t *pDetails ) = 0; | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 101 | /// Return location info for the current host. Returns the approximate | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 121 | /// | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 141 | /// GetLocalPingLocation with EstimatePingTimeBetweenTwoLocations. That's because | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 161 | /// user input to refresh this information.) Don't call it "just in case", | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 201 | /// | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 221 | /// problems with tech savvy end users. If you have a console or other log that customers | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 241 | /// Steamworks calls from within the handler. | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 261 | /// | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 281 | bool SetConnectionConfigValueString( HSteamNetConnection hConn, ESteamNetworkingConfigValue eValue, const char *val ); | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 301 | /// - pArg: Value to set it to. You can pass NULL to remove a non-global setting at this scope, | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 321 | /// - cbResult: IN: the size of your buffer. OUT: the number of bytes filled in or required. | COMMENT |
| LOW | include/steam/isteamnetworkingutils.h | 381 | COMMENT | |
| LOW | include/steam/isteamnetworkingutils.h | 401 | int m_bPingMeasurementInProgress; | COMMENT |
| LOW | include/steam/steam_api_common.h | 21 | #ifdef API_GEN | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 1 | //========== Copyright (c) Valve Corporation. All Rights Reserved. ============ | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 21 | /// the peer is identified by their address with each send/recv call, see | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 41 | /// easier to use, especially when porting existing UDP code. | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 61 | /// setting the options "immediately" after creation. | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 81 | /// casual eavesdropping. But note that without certificates (or a shared secret | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 101 | /// | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 121 | /// SteamNetworkingConfigValue_t for more about why this is preferable to | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 141 | /// delay taking action, from the client's perspective it is the same as the network | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 161 | /// notification being posted to the queue and when it is received by the application.) | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 181 | /// pszDebug is an optional human-readable diagnostic string that will be received | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 201 | /// (Which is a member of SteamNetConnectionStatusChangedCallback_t -- but see WARNINGS below!!!!) | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 221 | /// Fetch connection user data. Returns -1 if handle is invalid | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 241 | /// the sizes of the chunks that are returned by the reads on | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 261 | /// (See k_cbMaxSteamNetworkingSocketsMessageSizeSend) | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 281 | /// until the callback is executed. And also note that your callback can be | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 301 | /// | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 321 | /// to earlier failure on the same connection will be released immediately. | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 341 | /// If the connection handle is invalid, -1 is returned. | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 361 | /// | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 381 | /// 0 OK, your buffer was filled in and '\0'-terminated | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 401 | /// By default, internal buffers are used, completely bypassing the network, the chopping up of | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 421 | /// are always sent in the order they are queued, but messages from different | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 441 | /// other two lanes. Its weight value is irrelevant, since there are no other | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 461 | /// irrelevant in that case. | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 481 | /// - k_EResultInvalidParam - Invalid number of lanes, bad weights, or you tried to reduce the number of lanes | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 501 | /// certificates. (This includes a certificate for us, as well as any CA certificates | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 521 | /// Returns the current value that would be returned from GetAuthenticationStatus. | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 541 | /// You should destroy the poll group when you are done using DestroyPollGroup | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 561 | /// group at the time that the messages were received. | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 581 | /// other connections.) | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 601 | /// Typically this is useful just to confirm that you have a ticket, before you | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 621 | virtual HSteamNetConnection ConnectToHostedDedicatedServer( const SteamNetworkingIdentity &identityTarget, int nRemoteV | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 641 | /// and opaque routing information that can be used by the relays to send traffic | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 661 | /// - A non-localized diagnostic debug message will be placed in m_data that describes | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 681 | virtual HSteamListenSocket CreateHostedDedicatedServerListenSocket( int nLocalVirtualPort, int nOptions, const SteamNet | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 701 | /// - k_EResultNotLoggedOn: you are not logged in (yet) | COMMENT |
| LOW | include/steam/isteamnetworkingsockets.h | 721 | // | COMMENT |
| 454 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/stun_server.py | 96 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 98 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 134 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 136 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 185 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 187 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 233 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 235 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 396 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 398 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 413 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/stun_server.py | 415 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmake/apple/build-apple-deps.sh | 9 | # just use the Homebrew packages; see BUILDING.md. | COMMENT |
| MEDIUM | include/steam/isteamnetworkingsockets.h | 612 | /// here. The reason is to make reconnection to a gameserver robust, even if the client computer loses | COMMENT |
| MEDIUM | include/steam/steamnetworkingtypes.h | 448 | /// read it back. Typically this is not a problem, as application protocols that utilize | COMMENT |
| MEDIUM | examples/example_chat.cpp | 335 | // Check for known commands. None of this example code is secure or robust. | COMMENT |
| MEDIUM | src/common/crypto_sha1_wpa.cpp | 34 | // Absolutely nothing, but the places where we need to use the reference | COMMENT |
| MEDIUM | src/public/minbase/minbase_annotations.h | 21 | // Essentially the 'Hint' is that the condition specified is assumed to be true at | COMMENT |
| MEDIUM | …eamnetworkingsockets/steamnetworkingsockets_internal.h | 379 | /// mechanism for dealing with compatibility (e.g. using protobuf's robust mechanisms). | COMMENT |
| MEDIUM | …ckets/clientlib/steamnetworkingsockets_connections.cpp | 2781 | // robust code, at very little cost. | COMMENT |
| MEDIUM | …kets/clientlib/steamnetworkingsockets_socketthread.cpp | 2387 | // to reset the network stack, etc) we could make the code more robust by detecting this. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_p2p.py | 187 | except Exception: | CODE |
| HIGH | tests/test_p2p.py | 377 | except FileNotFoundError: | CODE |
| HIGH | examples/trivial_signaling_server.py | 93 | except OSError: | CODE |
| HIGH | examples/trivial_signaling_server.py | 72 | except OSError: | CODE |
| HIGH | examples/trivial_signaling_server.py | 122 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/stun_server.py | 375 | CODE | |
| LOW | tests/stun_server.py | 417 | CODE | |
| LOW | tests/test_p2p.py | 274 | CODE | |
| LOW | tests/test_p2p.py | 296 | CODE | |
| LOW | tests/test_p2p.py | 356 | CODE | |
| LOW | tests/test_p2p.py | 387 | CODE | |
| LOW | tests/test_p2p.py | 744 | CODE | |
| LOW | tests/test_p2p.py | 101 | CODE | |
| LOW | examples/trivial_signaling_server.py | 97 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/stun_server.py | 462 | except Exception as e: | CODE |
| MEDIUM | tests/stun_server.py | 463 | print("Error: %s" % e, file=sys.stderr, flush=True) | CODE |
| LOW | tests/test_p2p.py | 135 | except Exception as ex: | CODE |
| LOW | tests/test_p2p.py | 187 | except Exception: | CODE |
| LOW | examples/trivial_signaling_server.py | 122 | except Exception: | CODE |
| LOW | examples/trivial_signaling_server.py | 145 | except Exception: | CODE |
| LOW | examples/trivial_signaling_server.py | 169 | except Exception as ex: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cmake/apple/build-apple-deps.sh | 11 | # Usage: | COMMENT |
| LOW | cmake/apple/make-xcframework.sh | 11 | # Usage: | COMMENT |
| LOW | cmake/apple/run-ios-smoke-test.sh | 11 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/stun_server.py | 308 | def _handle_create_permission_request(sock, data, addr): | CODE |
| LOW | tests/make_test_certs.py | 24 | def run_cert_tool_with_ca_key( ca_key, args ): | CODE |
| LOW | examples/trivial_signaling_server.py | 80 | class SignalingRequestHandler(socketserver.StreamRequestHandler): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_p2p.py | 15 | CODE | |
| LOW | tests/test_p2p.py | 16 | CODE | |
| LOW | .github/run-single-config.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/build.sh | 3 | # CI build orchestration. This script may run multiple configurations, but each | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | include/steam/isteamnetworkingsockets.h | 811 | /// NOTE: This function is not actually supported on Steam! It is included | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_p2p.py | 120 | # Check if this is the ready message, then set requested event | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_p2p.py | 744 | CODE |