1.0

Adjusted Signal

1.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

4.4K

Stars

Language

443.6K

Lines of Code

2.6K

Files

375

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 339 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.8/100 · LOW

Are imports declared and package/API names verified? 26 finding(s).

Agent Over-Engineering Ratio 0.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 12 finding(s).

PR Review Velocity Impact 5.5/100 · LOW

Which changes need focused human review? 375 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 3HIGH 1MEDIUM 47LOW 324

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 375 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block281 hits · 228 pts

Severity	File	Line	Snippet	Context
LOW	reporting/doc.go	1	package reporting	COMMENT
LOW	reporting/doc.go	21		COMMENT
LOW	crypto/root.go	21	// 1. Self signed mode - means that Velociraptor will only trust it's	COMMENT
LOW	crypto/server/manager.go	41	common_name := csr.Subject.CommonName	COMMENT
LOW	artifacts/definitions/Demo/Plugins/Fifo.yaml	61	// This is the fifo which holds the last 5 failed logon attempts	COMMENT
LOW	vql/tools/packaging/templates.go	41	#!/bin/bash	COMMENT
LOW	vql/golang/profile.pb.go	1	// Copyright 2016 Google Inc. All Rights Reserved.	COMMENT
LOW	vql/golang/profile.pb.go	21	// set with their default value.	COMMENT
LOW	vql/golang/profile.pb.go	61		COMMENT
LOW	vql/golang/profile.pb.go	81	Sample []*Sample `protobuf:"bytes,2,rep,name=sample,proto3" json:"sample,omitempty"`	COMMENT
LOW	vql/golang/profile.pb.go	301	return 0	COMMENT
LOW	vql/golang/profile.pb.go	601		COMMENT
LOW	vql/networking/tls.go	121	// Short circuit if the thumbprint matches	COMMENT
LOW	vql/materializer/materialize.go	181		COMMENT
LOW	vql/materializer/materialize.go	201	// LET X <= SELECT ...	COMMENT
LOW	vql/server/azure_monitor.go	81	const azureMonitorDefaultMaxBuffer = uint64(900 * 1024)	COMMENT
LOW	vql/server/elastic.go	1	// This module addes a dependency on go-elasticsearch which turns out to be	COMMENT
LOW	vql/server/downloads/downloads.go	441	}	COMMENT
LOW	vql/server/downloads/downloads.go	461		COMMENT
LOW	vql/server/downloads/downloads.go	501	//Remove the prefix in the file store where the files	COMMENT
LOW	vql/server/downloads/downloads.go	521	// "Windows",	COMMENT
LOW	vql/server/flows/results.go	61	// 3. If an event Artifact is specified we read from the monitoring	COMMENT
LOW	vql/server/flows/results.go	101	// The source plugin works by providing direct arguments and	COMMENT
LOW	vql/lsp/diagnostics.go	41	// It reports:	COMMENT
LOW	vql/sigma/evaluator/modifiers/modifiers.go	21	// set. The modifier may be used to expand the input set (e.g. the	COMMENT
LOW	vql/common/yarax.go	321		COMMENT
LOW	vql/psutils/host_darwin_cgo.go	1	//go:build darwin && cgo	COMMENT
LOW	vql/readers/paged.go	41	"www.velocidex.com/golang/velociraptor/accessors"	COMMENT
LOW	vql/windows/win32_windows_32.go	361	PagefileUsage uintptr	COMMENT
LOW	vql/windows/win32_windows.go	381	//sys LookupPrivilegeValue(lpSystemName uintptr, lpName uintptr, out uintptr) (err error) = Advapi32.LookupPrivilegeValu	COMMENT
LOW	vql/windows/wmi/events.c	1	// +build windows	COMMENT
LOW	vql/remapping/install.go	21	// - type: mount	COMMENT
LOW	vql/remapping/install.go	41	// permissions:	COMMENT
LOW	vql/protocols/lazy.go	1	package protocols	COMMENT
LOW	bin/offline.go	61	# credentialsSecret: ""	COMMENT
LOW	bin/offline.go	81	#TargetArgs:	COMMENT
LOW	bin/offline.go	121	# Where we actually write the collection to. You can specify this as a	COMMENT
LOW	bin/vql.go	301	if strings.HasPrefix(item.Doc, "Unimplemented") {	COMMENT
LOW	bin/debian.go	1	//go:build !aix	COMMENT
LOW	bin/lsp.go	201	const maxWireLogPayload = 4096	COMMENT
LOW	config/default.yaml	1	###<Begin Embedded Config>	COMMENT
LOW	config/default.yaml	21	#############################################################################	COMMENT
LOW	config/default.yaml	41	#############################################################################	COMMENT
LOW	config/default.yaml	61	#############################################################################	COMMENT
LOW	config/default.yaml	81	#############################################################################	COMMENT
LOW	config/default.yaml	101	#############################################################################	COMMENT
LOW	config/default.yaml	121	#############################################################################	COMMENT
LOW	config/default.yaml	141	#############################################################################	COMMENT
LOW	config/default.yaml	161	#############################################################################	COMMENT
LOW	config/default.yaml	181	#############################################################################	COMMENT
LOW	config/default.yaml	201	#############################################################################	COMMENT
LOW	config/default.yaml	221	#############################################################################	COMMENT
LOW	config/default.yaml	241	#############################################################################	COMMENT
LOW	config/default.yaml	261	#############################################################################	COMMENT
LOW	config/default.yaml	281	#############################################################################	COMMENT
LOW	config/default.yaml	301	#############################################################################	COMMENT
LOW	config/default.yaml	321	#############################################################################	COMMENT
LOW	config/default.yaml	341	#############################################################################	COMMENT
LOW	config/default.yaml	361	#############################################################################	COMMENT
LOW	config/default.yaml	381	#############################################################################	COMMENT
221 more matches not shown…

Self-Referential Comments28 hits · 84 pts

Severity	File	Line	Snippet	Context
MEDIUM	artifacts/testdata/server/testcases/index.in.yaml	13	# Create the index.	COMMENT
MEDIUM	artifacts/testdata/server/testcases/clients.in.yaml	5	# Create a new client	COMMENT
MEDIUM	artifacts/testdata/server/testcases/execve.in.yaml	16	# Define a secret that allows calling the velociraptor binary only	COMMENT
MEDIUM	artifacts/testdata/server/testcases/execve.out.yaml	19	# Define a secret that allows calling the velociraptor binary only	COMMENT
MEDIUM	artifacts/testdata/server/testcases/secrets.out.yaml	1	# Define a HTTP secret	COMMENT
MEDIUM	artifacts/testdata/server/testcases/secrets.out.yaml	58	# Create a suborg	COMMENT
MEDIUM	artifacts/testdata/server/testcases/collections.in.yaml	45	# This file contains a complex filename with illegal characters. We	COMMENT
MEDIUM	artifacts/testdata/server/testcases/users.in.yaml	22	# Create a new org	COMMENT
MEDIUM	…estdata/server/testcases/required_permissions.out.yaml	1	# Create a reader user with the collect_server permission - they are	COMMENT
MEDIUM	…facts/testdata/server/testcases/user_messages.out.yaml	1	# Create a new user to play with	COMMENT
MEDIUM	…tifacts/testdata/server/testcases/collections.out.yaml	33	# This file contains a complex filename with illegal characters. We	COMMENT
MEDIUM	artifacts/testdata/server/testcases/secrets.in.yaml	2	# Define a HTTP secret	COMMENT
MEDIUM	artifacts/testdata/server/testcases/secrets.in.yaml	28	# Create a suborg	COMMENT
MEDIUM	…facts/testdata/server/testcases/util_sendmail.out.yaml	168	# Create a boundary for the main multipart in order to distinguish from the	COMMENT
MEDIUM	…testdata/server/testcases/required_permissions.in.yaml	16	# Create a reader user with the collect_server permission - they are	COMMENT
MEDIUM	artifacts/testdata/server/testcases/reformat.in.yaml	1	# This file contains the same tests that are in services/repository/reformat_test.go	COMMENT
MEDIUM	artifacts/testdata/server/testcases/csv.in.yaml	28	# Create a pipe for pre-processing the file's lines - replace date	COMMENT
MEDIUM	…ifacts/testdata/server/testcases/user_messages.in.yaml	2	# Create a new user to play with	COMMENT
MEDIUM	artifacts/testdata/server/testcases/csv.out.yaml	135	# Create a pipe for pre-processing the file's lines - replace date	COMMENT
MEDIUM	artifacts/testdata/server/testcases/index.out.yaml	4	# Create the index.	COMMENT
MEDIUM	…ifacts/testdata/server/testcases/util_sendmail.in.yaml	60	# Create a boundary for the main multipart in order to distinguish from the	COMMENT
MEDIUM	artifacts/testdata/server/testcases/clients.out.yaml	1	# Create a new client	COMMENT
MEDIUM	artifacts/testdata/server/testcases/users.out.yaml	91	# Create a new org	COMMENT
MEDIUM	vql/tools/s3_upload_test.go	36	# Create the velociraptor bucket	COMMENT
MEDIUM	docs/references/vql.yaml	5559	### Creating a link to a new collection	COMMENT
MEDIUM	.github/workflows/windows.yml	69	# Creating a second service - in the end we have	COMMENT
MEDIUM	.github/workflows/windows.yml	101	# Create a second VSS right before testing - in most cases the	COMMENT
MEDIUM	services/notebook/initial.go	4	# Creating an initial notebook	COMMENT

Hallucination Indicators3 hits · 45 pts

Severity	File	Line	Snippet	Context
CRITICAL⚡	actions/vql_test.go	83	VQL: "SELECT * FROM Artifact.Custom.Foo.Bar.Baz.A()",	CODE
CRITICAL⚡	actions/vql_test.go	91	Query: "SELECT * FROM Artifact.Custom.Foo.Bar.Baz.B()",	CODE
CRITICAL⚡	actions/vql_test.go	99	Query: "SELECT * FROM Artifact.Custom.Foo.Bar.Baz.C()",	CODE

Slop Phrases8 hits · 21 pts

Severity	File	Line	Snippet	Context
MEDIUM	artifacts/definitions/Windows/Sigma/EventLogs.yaml	6	NOTE: This is a very simple artifact for demonstration purposes	CODE
LOW	tools/fuse/accessors.go	31	logger.Info("Fuse: Exiting! Don't forget to unmount the filesystem")	CODE
MEDIUM	bin/gui.go	203	// client. It is useful for demonstration purposes and	COMMENT
MEDIUM	docs/references/server.config.yaml	195	## you can change the location of the writeback to be inside the	COMMENT
MEDIUM	docs/references/server.config.yaml	599	# minimum roles the user can have - you can add more roles via the	COMMENT
MEDIUM	docs/references/server.config.yaml	893	## represent the set of tunable parameters you can use to optimize	COMMENT
MEDIUM	docs/references/server.config.yaml	1405	## By default hunts expire in 7 days but you can change this using	COMMENT
MEDIUM	docs/references/server.config.yaml	1469	# default this happens daily but you can change it here (set to -1)	COMMENT

Decorative Section Separators6 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	.vale.ini	9	## -----------------------------------------------------------------	COMMENT
MEDIUM	.vale.ini	11	## -----------------------------------------------------------------	COMMENT
MEDIUM	.vale.ini	25	# ------------------------------------------------------------------	COMMENT
MEDIUM	.vale.ini	39	# # ------------------------------------------------------------------	COMMENT
MEDIUM	.vale.ini	53	# ------------------------------------------------------------------	COMMENT
MEDIUM	.vale.ini	75	# ------------------------------------------------------------------	COMMENT

AI Slop Vocabulary6 hits · 16 pts

Severity	File	Line	Snippet	Context
MEDIUM	artifacts/testdata/server/testcases/fat.in.yaml	2	# accessor. More comprehensive tests are available in the go-fat	COMMENT
MEDIUM	artifacts/testdata/server/testcases/ext4.in.yaml	2	# accessor. More comprehensive tests are available in the go-ext4	COMMENT
MEDIUM	…facts/definitions/Windows/Detection/Impersonation.yaml	31	mimikatz # token::elevate	CODE
MEDIUM	utils/file_unix.go	31	// Like io/utils but more robust - return as many files as we can. See	COMMENT
MEDIUM	docs/references/server.config.yaml	1339	## client. NOTE: This is currently not very robust - i.e. it does not	COMMENT
LOW	docs/references/server.config.yaml	752	# If you don't want to allow outbound connections, just set this to	COMMENT

Fake / Example Data17 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	artifacts/testdata/server/testcases/notepad.out.yaml	35	"Content": "Saved file with large copy paste\r\rLorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusm	CODE
LOW	artifacts/testdata/server/testcases/notepad.out.yaml	35	"Content": "Saved file with large copy paste\r\rLorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusm	CODE
LOW	artifacts/testdata/server/testcases/notepad.out.yaml	90	"AddedChars": "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore	CODE
LOW	artifacts/testdata/server/testcases/notepad.out.yaml	90	"AddedChars": "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore	CODE
LOW	artifacts/definitions/Generic/Utils/SendEmail.yaml	28	default: '["noone@example.org"]'	CODE
LOW	docs/references/vql.yaml	5974	to="user@example.com",	STRING
LOW	docs/references/vql.yaml	11130	strip(string=">> lorem ipsum <<", prefix=">>", suffix="<<") -> " lorem ipsum "	STRING
LOW	docs/references/vql.yaml	11134	strip(string=" lorem ipsum ") -> "lorem ipsum"	STRING
LOW	api/authenticators/claims_test.go	90	"email": "user@example.com",	CODE
LOW	api/authenticators/claims_test.go	126	"email": "user@example.com",	CODE
LOW	api/authenticators/claims_test.go	186	"email": "user@example.com",	CODE
LOW	api/authenticators/claims_test.go	224	"email": "user@example.com",	CODE
LOW	api/authenticators/claims_test.go	260	"SomeWeirdClaim": "user@example.com"	CODE
LOW	api/authenticators/claims_test.go	294	"email": "user@example.com",	CODE
LOW	api/authenticators/claims_test.go	359	"mail":"user@example.com",	CODE
LOW	api/authenticators/claims_test.go	364	"userPrincipalName":"user@example.com",	CODE
LOW	api/authenticators/claims_test.go	506	Name: "user@example.com",	CODE

Verbosity Indicators5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	vql/windows/wmi/events.c	151	// Step 1: --------------------------------------------------	COMMENT
LOW	vql/windows/wmi/events.c	159	// Step 2: --------------------------------------------------	COMMENT
LOW	vql/windows/wmi/events.c	179	// Step 3: ---------------------------------------------------	COMMENT
LOW	vql/windows/wmi/events.c	213	// Step 5: --------------------------------------------------	COMMENT
LOW	vql/windows/wmi/events.c	231	// Step 6: -------------------------------------------------	COMMENT

Redundant / Tautological Comments4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	artifacts/testdata/server/testcases/zip.out.yaml	160	# Read the file with messed up casing.	COMMENT
LOW	artifacts/testdata/server/testcases/zip.in.yaml	102	# Read the file with messed up casing.	COMMENT
LOW	artifacts/definitions/Windows/Collectors/Remapping.yaml	99	# Check if the collection container has file uploads	COMMENT
LOW	vql/tools/packaging/templates.go	193	## Set it to start at boot	COMMENT

Unused Imports6 hits · 6 pts

Severity	File	Line	Context
LOW	scripts/check_versions.py	10	CODE
LOW	scripts/find_i8n_translations.py	10	CODE
LOW	scripts/find_i8n_translations.py	13	CODE
LOW	scripts/api_checker.py	13	CODE
LOW	scripts/api_checker.py	14	CODE
LOW	scripts/api_checker.py	15	CODE

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	scripts/sync_artifact_paths.py	39	except: pass	CODE

Excessive Try-Catch Wrapping3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	scripts/check_versions.py	118	except Exception:	CODE
LOW	scripts/find_i8n_translations.py	37	except Exception as e:	CODE
MEDIUM	scripts/find_i8n_translations.py	34	def Decode(k):	CODE

Deep Nesting3 hits · 3 pts

Severity	File	Line	Context
LOW	scripts/sync_artifact_paths.py	14	CODE
LOW	scripts/find_i8n_translations.py	18	CODE
LOW	scripts/api_checker.py	73	CODE

Hyper-Verbose Identifiers2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	gui/velociraptor/src/components/core/api-service.jsx	94	function isNetworkOrIdempotentRequestError(error) {	CODE
LOW	…elociraptor/src/components/flows/offline-collector.jsx	775	function getDefaultCollectionParameters() {	CODE

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	artifacts/definitions/Windows/Forensics/Lnk.yaml	1226	# TODO: implement Flag select for FontPitch	COMMENT

Structural Annotation Overuse1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	services/hunt_dispatcher/storage.go	52	// NOTE: This function is very slow! It should only be used by the GUI!	COMMENT

Velocidex/velociraptor

Open-Source Code Quality, Security and Technical Debt Review