Home / apache / apisix
AI Slop Code RIsk Monitor

apache/apisix

The Cloud-Native API Gateway and AI Gateway

4.3 Low pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for apache/apisix, a Lua project with 17,209 GitHub stars. SynthScan examined 292,601 lines of code across 1029 source files, recording 465 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 4.3 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

4.3
Adjusted Signal
4.3
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
17.2K
Stars
Lua
Language
292.6K
Lines of Code
1.0K
Files
465
Pattern Hits
2026-10-12
Scan Date
0.19
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 4.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 254 finding(s).

Hallucinated Dependency & Supply Chain Risk 15.2/100 · LOW

Are imports declared and package/API names verified? 205 finding(s).

Agent Over-Engineering Ratio 0.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 9 finding(s).

PR Review Velocity Impact 22.4/100 · LOW

Which changes need focused human review? 465 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 199MEDIUM 13LOW 253

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 465 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Magic Placeholder Names198 hits · 955 pts
SeverityFileLineSnippetContext
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md71export OPENAI_API_KEY=<your-api-key>CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md187 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md255 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md402 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md470 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md622 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md690 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md751 "Authorization": "Bearer <your-api-key>"CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md791 Authorization: "Bearer <your-api-key>"CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md841 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-request-rewrite.md910 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-prompt-guard.md183 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-prompt-guard.md243 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-prompt-guard.md480 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-prompt-guard.md542 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-prompt-template.md196 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-prompt-template.md261 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-prompt-template.md455 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-prompt-template.md526 Authorization: "Bearer your-api-key"CODE
HIGH⚡docs/zh/latest/plugins/ai-rag.md246 api_key: "Bearer your-api-key"CODE
HIGH⚡docs/zh/latest/plugins/ai-rag.md250 api_key: "Bearer your-api-key"CODE
HIGH⚡docs/zh/latest/plugins/ai-rag.md256 api-key: "Bearer your-api-key"CODE
HIGH⚡docs/zh/latest/plugins/ai-rag.md310 api_key: "Bearer your-api-key"CODE
HIGH⚡docs/zh/latest/plugins/ai-rag.md314 api_key: "Bearer your-api-key"CODE
HIGH⚡docs/zh/latest/plugins/ai-rag.md321 api-key: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md302 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md310 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md365 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md373 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md581 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md590 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md655 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md664 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md1168 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md1176 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md1235 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md1243 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md1585 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md1594 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md1650 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md1659 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2014 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2024 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2081 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2091 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2305 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2313 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2379 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2387 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2576 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2584 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2650 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-proxy-multi.md2658 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/datadog.md110 -e DD_API_KEY=<your-api-key> \CODE
HIGHdocs/zh/latest/plugins/ai-rate-limiting.md170 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-rate-limiting.md228 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-rate-limiting.md417 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-rate-limiting.md425 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-rate-limiting.md486 Authorization: "Bearer your-api-key"CODE
HIGHdocs/zh/latest/plugins/ai-rate-limiting.md494 Authorization: "Bearer your-api-key"CODE
138 more matches not shown…
Over-Commented Block236 hits · 236 pts
SeverityFileLineSnippetContext
LOW.asf.yaml1#COMMENT
LOWCODE_OF_CONDUCT.md1<!--COMMENT
LOWpowered-by.md1---COMMENT
LOWCHANGELOG.md1---COMMENT
LOWVision-and-Milestones.md1<!--COMMENT
LOWREADME.md1<!--COMMENT
LOWCODE_STYLE.md1---COMMENT
LOWCONTRIBUTING.md1<!--COMMENT
LOW.licenserc.yaml1#COMMENT
LOWTHREAT_MODEL.md1<!--COMMENT
LOW.markdownlint.yml1#COMMENT
LOWMAINTAIN.md1<!--COMMENT
LOWbenchmark/run.sh1#! /bin/bash -xCOMMENT
LOWdocker/compose/docker-compose-master.yaml1#COMMENT
LOWdocker/compose/apisix_conf/master/config.yaml1#COMMENT
LOWdocker/debian-dev/docker-entrypoint.sh1#!/usr/bin/env bashCOMMENT
LOWdocker/debian-dev/install-brotli.sh1#!/usr/bin/env bashCOMMENT
LOWautodocs/generate.sh1#!/usr/bin/env bashCOMMENT
LOWapisix/plugins/grpc-transcode/proto.lua181 // server that maps type URLs to message definitions as follows:COMMENT
LOWapisix/plugins/grpc-transcode/proto.lua201 // Must be a valid serialized protocol buffer of the above specified type.COMMENT
LOWapisix/cli/ngx_tpl.lua1001 proxy_pass_header Date;COMMENT
LOWapisix/cli/ngx_tpl.lua1021 # are re-evaluated on every read, `$http_x_forwarded_for` is a dedicatedCOMMENT
LOWci/linux-install-etcd-client.sh1#!/usr/bin/env bashCOMMENT
LOWci/linux-install-openresty.sh1#!/usr/bin/env bashCOMMENT
LOW…ux_apisix_current_luarocks_in_customed_nginx_runner.sh1#!/usr/bin/env bashCOMMENT
LOWci/common.sh1#COMMENT
LOWci/init-common-test-service.sh1#!/usr/bin/env bashCOMMENT
LOWci/free_disk_space.sh1#!/usr/bin/env bashCOMMENT
LOWci/init-last-test-service.sh1#!/usr/bin/env bashCOMMENT
LOWci/init-plugin-test-service.sh1#!/usr/bin/env bashCOMMENT
LOWci/linux_openresty_tongsuo_runner.sh1#!/usr/bin/env bashCOMMENT
LOWci/tars-ci.sh1#!/usr/bin/env bashCOMMENT
LOWci/backup-docker-images.sh1#!/usr/bin/env bashCOMMENT
LOWci/kubernetes-ci.sh1#!/usr/bin/env bashCOMMENT
LOWci/check_changelog_prs.ts61 // fully reverted by 13449 within this release, so they net to a no-op and areCOMMENT
LOWci/linux_openresty_runner.sh1#!/usr/bin/env bashCOMMENT
LOWci/linux_apisix_current_luarocks_runner.sh1#!/usr/bin/env bashCOMMENT
LOWci/linux_openresty_common_runner.sh1#!/usr/bin/env bashCOMMENT
LOWci/redhat-ci.sh1#!/usr/bin/env bashCOMMENT
LOWci/pod/docker-compose.common.yml1#COMMENT
LOWci/pod/docker-compose.first.yml1#COMMENT
LOWci/pod/docker-compose.plugin.yml1#COMMENT
LOWci/pod/docker-compose.last.yml1#COMMENT
LOWci/pod/nacos/healthcheck/nacos-server-healthcheck.sh1#!/usr/bin/env bashCOMMENT
LOWci/pod/nacos/healthcheck/nacos-service-healthcheck.sh1#!/usr/bin/env bashCOMMENT
LOWci/pod/openfunction/build-function-image.sh1#!/usr/bin/env bashCOMMENT
LOWci/pod/otelcol-contrib/config.yaml1#COMMENT
LOWci/pod/openldap/enable-anon-bind.sh1#!/bin/bashCOMMENT
LOWci/pod/keycloak/kcadm_configure_cas.sh1#!/usr/bin/env bashCOMMENT
LOWci/pod/keycloak/kcadm_configure_saml.sh1#!/usr/bin/env bashCOMMENT
LOWci/pod/keycloak/kcadm_configure_basic.sh1#!/usr/bin/env bashCOMMENT
LOWci/pod/keycloak/kcadm_configure_university.sh1#!/usr/bin/env bashCOMMENT
LOWci/pod/vector/vector.toml1#COMMENT
LOWutils/check-test-code-style.sh1#!/usr/bin/env bashCOMMENT
LOWutils/gen-vote-contents.sh1#!/bin/shCOMMENT
LOWutils/check-version.sh1#!/bin/shCOMMENT
LOWutils/fix-zh-doc-segment.py1#!/usr/bin/env python3COMMENT
LOWutils/check-plugins-code.sh1#!/bin/bashCOMMENT
LOWutils/check-lua-code-style.sh1#!/bin/shCOMMENT
LOWutils/linux-install-luarocks.sh1#!/usr/bin/env bashCOMMENT
176 more matches not shown…
Self-Referential Comments7 hits · 21 pts
SeverityFileLineSnippetContext
MEDIUMt/fuzzing/simple_http.py20# This file provides a fuzzing test with most common plugins via plain HTTP requestCOMMENT
MEDIUMt/fuzzing/http_upstream.py20# This file provides a fuzzing test with different upstreamsCOMMENT
MEDIUMt/cli/test_stream_port_range.sh417# Create a stream route targeting the inline upstreamCOMMENT
MEDIUMt/cli/test_standalone.sh148## Create a symlink to change the link count and as a result `st_ctime`COMMENT
MEDIUMt/cli/test_limit_conn_redis_ttl.sh50# Create a route with limit-conn and redis policyCOMMENT
MEDIUMt/cli/test_limit_req_redis_ttl.sh50# Create a route with limit-req and redis policyCOMMENT
MEDIUMt/cli/test_ci_only.sh20# This file is like other test_*.sh, but requires extra dependencies whichCOMMENT
Modern AI Meta-Vocabulary3 hits · 8 pts
SeverityFileLineSnippetContext
MEDIUMdocs/zh/latest/plugins/ai-rag.md140### 与 Azure 集成以获得 RAG 增强响应COMMENT
MEDIUMdocs/en/latest/plugins/ai-lakera-guard.md42The `ai-lakera-guard` Plugin integrates with the [Lakera Guard API (v2)](https://docs.lakera.ai/docs/api) to perform ML-CODE
MEDIUMdocs/en/latest/plugins/ai-rag.md140### Integrate with Azure for RAG-Enhanced ResponsesCOMMENT
Fake / Example Data7 hits · 7 pts
SeverityFileLineSnippetContext
LOWdocs/zh/latest/plugins/body-transformer.md871 "user_name": "John Doe",CODE
LOWdocs/zh/latest/plugins/body-transformer.md895 "name": "John Doe",CODE
LOWdocs/zh/latest/plugins/body-transformer.md917 "name": "John Doe",CODE
LOWdocs/en/latest/plugins/body-transformer.md873 "user_name": "John Doe",CODE
LOWdocs/en/latest/plugins/body-transformer.md897 "name": "John Doe",CODE
LOWdocs/en/latest/plugins/body-transformer.md919 "name": "John Doe",CODE
LOWt/plugin/lago.spec.ts108 email: 'test@test.com',CODE
Excessive Try-Catch Wrapping5 hits · 7 pts
SeverityFileLineSnippetContext
MEDIUMt/fuzzing/public.py48 print("Error in log: ", err)CODE
LOWt/plugin/openapi_to_mcp_harness.py60 except Exception as exc: # noqa: BLE001CODE
LOWt/plugin/openapi_to_mcp_harness.py115 except Exception as exc: # noqa: BLE001CODE
LOWt/plugin/openapi_to_mcp_harness.py177 except Exception: # noqa: BLE001CODE
MEDIUMt/plugin/openapi_to_mcp_harness.py97def _read(self):CODE
Empty Error Handlers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHt/plugin/openapi_to_mcp_harness.py164except OSError:CODE
Deep Nesting4 hits · 4 pts
SeverityFileLineSnippetContext
LOWutils/fix-zh-doc-segment.py39CODE
LOWutils/check-category.py31CODE
LOWt/plugin/openapi_to_mcp_harness.py97CODE
LOWt/cli/test_sse.py58CODE
Hyper-Verbose Identifiers3 hits · 3 pts
SeverityFileLineSnippetContext
LOWci/check_changelog_prs.ts88function extractVersionsFromChangelog(): Version[] {CODE
LOWci/check_changelog_prs.ts132function shouldIgnoreCommitMessage(message: string): boolean {CODE
LOWt/fuzzing/public.py79def get_linear_regression_sloped(samples):CODE
Slop Phrases1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMconf/config.yaml28# To configure via environment variables, you can use `${{VAR}}` syntax. For instance:COMMENT