1.6

Adjusted Signal

1.6

Raw Pattern Score

100%

Time Factor

2026-10-29

Last Push

9.4K

Stars

JavaScript

Language

114.8K

Lines of Code

773

Files

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 30 finding(s).

Hallucinated Dependency & Supply Chain Risk 4.9/100 · LOW

Are imports declared and package/API names verified? 33 finding(s).

Agent Over-Engineering Ratio 2.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 31 finding(s).

PR Review Velocity Impact 7.3/100 · LOW

Which changes need focused human review? 74 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 8HIGH 1MEDIUM 11LOW 54

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 74 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators8 hits · 90 pts

Severity	File	Line	Snippet	Context
CRITICAL	…esources/webgoat/static/js/jquery/jquery-1.10.2.min.js	5	}({});var B=/(?:\{[\s\S]\}\|\[[\s\S]\])$/,P=/([A-Z])/g;function R(e,n,r,i){if(x.acceptData(e)){var o,a,s=x.expando,l=e.	CODE
CRITICAL	…ebgoat/static/js/jquery/jquery-ui-1.10.4.custom.min.js	6	(function(e,t){function i(t,i){var a,n,r,o=t.nodeName.toLowerCase();return"area"===o?(a=t.parentNode,n=a.name,t.href&&n&	CODE
CRITICAL⚡	…main/resources/webgoat/static/js/libs/jquery-ui.min.js	6	(function(t){"function"==typeof define&&define.amd?define(["jquery"],t):t(jQuery)})(function(t){function e(t){for(var e=	CODE
CRITICAL⚡	…main/resources/webgoat/static/js/libs/jquery-ui.min.js	9	}},_updateDatepicker:function(e){this.maxRows=4,m=e,e.dpDiv.empty().append(this._generateHTML(e)),this._attachHandlers(e	CODE
CRITICAL	src/main/resources/webgoat/static/js/libs/jquery.min.js	2	!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):f	CODE
CRITICAL	…n/resources/webgoat/static/js/libs/jquery-2.1.4.min.js	4	void 0===c?d&&"get"in d&&null!==(e=d.get(a,b))?e:(e=n.find.attr(a,b),null==e?void 0:e):null!==c?d&&"set"in d&&void 0!==(	CODE
CRITICAL	…main/java/org/owasp/webgoat/lessons/xxe/SimpleXXE.java	72	success \|= org.apache.commons.lang3.StringUtils.contains(comment.getText(), directory);	CODE
CRITICAL	…g/owasp/webgoat/lessons/xxe/ContentTypeAssignment.java	90	success \|= org.apache.commons.lang3.StringUtils.contains(comment.getText(), directory);	CODE

Decorative Section Separators11 hits · 33 pts

Severity	File	Line	Snippet	Context
MEDIUM	…owasp/webgoat/container/users/AdminControllerTest.java	86	// ── List users ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…owasp/webgoat/container/users/AdminControllerTest.java	145	// ── User detail – lesson data ───────────────────────────────────────────────	COMMENT
MEDIUM	…owasp/webgoat/container/users/AdminControllerTest.java	192	// ── Category percentage accuracy ────────────────────────────────────────────	COMMENT
MEDIUM	…owasp/webgoat/container/users/AdminControllerTest.java	235	// ── Password reset ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/resources/webgoat/static/js/goatApp/view/AdminView.js	48	// ── Detail view ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…/resources/webgoat/static/js/goatApp/view/AdminView.js	109	// ── Password reset ───────────────────────────────────────────────────	COMMENT
MEDIUM	…org/owasp/webgoat/container/users/AdminController.java	49	// ── User list ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…org/owasp/webgoat/container/users/AdminController.java	78	// ── User detail ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…org/owasp/webgoat/container/users/AdminController.java	149	// ── Password reset ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	…org/owasp/webgoat/container/users/AdminController.java	171	// ── Helpers ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…org/owasp/webgoat/container/users/AdminController.java	181	// ── DTOs ───────────────────────────────────────────────────────────────────	COMMENT

Fake / Example Data25 hits · 25 pts

Severity	File	Line	Snippet	Context
LOW	…p/webgoat/container/mailbox/MailboxRepositoryTest.java	35	email.setSender("test@test.com");	CODE
LOW	…p/webgoat/container/mailbox/MailboxRepositoryTest.java	46	email.setSender("test@test.com");	CODE
LOW	…ns/pathtraversal/ProfileUploadRemoveUserInputTest.java	38	.param("fullNameFix", "John Doe"))	CODE
LOW	…ns/pathtraversal/ProfileUploadRemoveUserInputTest.java	54	.param("fullNameFix", "John Doe"))	CODE
LOW	…p/webgoat/lessons/pathtraversal/ProfileUploadTest.java	90	.param("fullName", "John Doe"))	CODE
LOW	…p/webgoat/lessons/pathtraversal/ProfileUploadTest.java	96	"PathTraversal\\" + File.separator + "test\\" + File.separator + "John Doe")))	CODE
LOW	…ebgoat/lessons/pathtraversal/ProfileUploadFixTest.java	54	.param("fullNameFix", "John Doe"))	CODE
LOW	…ebgoat/lessons/pathtraversal/ProfileUploadFixTest.java	58	"$.feedback", CoreMatchers.containsString("test\\" + File.separator + "John Doe")))	CODE
LOW	…playwright/webgoat/lessons/HttpBasicsLessonUITest.java	57	lessonPage.getEnterYourName().fill("John Doe");	CODE
LOW	…playwright/webgoat/lessons/HttpBasicsLessonUITest.java	164	lessonPage.getEnterYourName().fill("John Doe");	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	4218	* wysihtml5.dom.copyAttributes(["spellcheck", "value", "placeholder"]).from(textarea).to(div).andTo(anotherDiv);	COMMENT
LOW⚡	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	8343	hasPlaceholder = textareaElement.hasAttribute("placeholder"),	CODE
LOW⚡	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	8344	originalPlaceholder = hasPlaceholder && textareaElement.getAttribute("placeholder");	CODE
LOW⚡	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	8350	textareaElement.removeAttribute("placeholder");	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	3486	return "placeholder" in element;	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	5593	var CLASS_NAME = "placeholder",	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	8016	return this.getTextContent() == this.textarea.element.getAttribute("placeholder");	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	8087	: this.textarea.element.getAttribute("placeholder");	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	8385	textareaElement.setAttribute("placeholder", originalPlaceholder);	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	8737	placeholderText = this.element.getAttribute("placeholder") \|\| null,	CODE
LOW⚡	…main/resources/webgoat/static/js/libs/jquery-ui.min.js	6	(function(t){"function"==typeof define&&define.amd?define(["jquery"],t):t(jQuery)})(function(t){function e(t){for(var e=	CODE
LOW	…esources/lessons/pathtraversal/html/PathTraversal.html	44	placeholder="Enter Your Email" value="test@test.com"/>	CODE
LOW	…esources/lessons/pathtraversal/html/PathTraversal.html	98	placeholder="Enter Your Email" value="test@test.com"/>	CODE
LOW	…esources/lessons/pathtraversal/html/PathTraversal.html	155	placeholder="Enter Your Email" value="test@test.com"/>	CODE
LOW	…esources/lessons/pathtraversal/html/PathTraversal.html	251	placeholder="Enter Your Email" value="test@test.com"/>	CODE

Hyper-Verbose Identifiers20 hits · 20 pts

Severity	File	Line	Snippet	Context
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	80	function createMultiplePropertyTest(testFunc) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	709	function isNonTextPartiallySelected(node, range) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	1066	function assertNoDocTypeNotationEntityAncestor(node, allowSelf) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	1090	function assertSameDocumentOrFragment(node1, node2) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	1543	function copyComparisonConstantsToObject(obj) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	1560	function createRangeContentRemover(remover, boundaryUpdater) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	1594	function createBeforeAfterNodeSetter(isBefore, isStart) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	1829	function updateCollapsedAndCommonAncestor(range) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	1919	function getTextRangeContainerElement(textRange) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	1941	function getTextRangeBoundaryPosition(textRange, wholeRangeContainerElement, isStart, isCollapsed) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	2599	function updateAnchorAndFocusFromRange(sel, range, backwards) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	2607	function updateAnchorAndFocusFromNativeSelection(sel) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	2645	function rangeContainsSingleElement(rangeNodes) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	2657	function getSingleElementFromRange(range) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	2705	function addRangeToControlSelection(sel, range) {	CODE
LOW	…atic/plugins/bootstrap-wysihtml5/js/wysihtml5-0.3.0.js	6366	function elementsHaveSameNonClassAttributes(el1, el2) {	CODE
LOW	src/main/resources/lessons/webauthn/js/webauthn.js	67	function webauthnBeginRegistration() {	CODE
LOW	src/main/resources/lessons/webauthn/js/webauthn.js	78	function webauthnTouchRegistrationKey() {	CODE
LOW	src/main/resources/lessons/webauthn/js/webauthn.js	166	function webauthnRegisterSecurityKey() {	CODE
LOW	src/main/resources/lessons/webauthn/js/webauthn.js	185	function webauthnSignInWithSecurityKey() {	CODE

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	…n/resources/webgoat/static/js/libs/jquery-ui-1.10.4.js	8908	// Format a name, short or long as requested	COMMENT

Over-Commented Block7 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	…g/owasp/webgoat/lessons/xss/StoredXssCommentsTest.java	61	// will fail build, but leaving in as positive Security Unit Test	COMMENT
LOW	…webgoat/lessons/authbypass/BypassVerificationTest.java	21	// public void testCheatingDetection() throws Exception {	COMMENT
LOW	…/org/owasp/webgoat/integration/XXEIntegrationTest.java	41	// @Test	COMMENT
LOW	src/main/resources/webgoat/static/css/layers.css	1	#lesson-title {position:absolute;left:94px;top:75px;width:690px;height:22px;z-index:1;float: right;font-size: 20px;color	COMMENT
LOW	…ain/resources/webgoat/static/js/libs/underscore-min.js	1	!function(n,r){var t,e;"object"==typeof exports&&"undefined"!=typeof module?module.exports=r():"function"==typeof define	COMMENT
LOW	…/main/resources/webgoat/static/js/libs/polyglot.min.js	1	// (c) 2012 Airbnb, Inc.	COMMENT
LOW	src/main/resources/lessons/csrf/js/csrf-review.js	1	$(document).ready(function () {	COMMENT

Verbosity Indicators1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…n/resources/webgoat/static/js/libs/jquery-ui-1.10.4.js	13435	// IE sets focus asynchronously, so we need to check if focus	COMMENT

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…bgoat/static/js/goatApp/controller/LessonController.js	73	//TODO: implement lesson not found or return to welcome page?	COMMENT

WebGoat/WebGoat

Open-Source Code Quality, Security and Technical Debt Review