4.1

Adjusted Signal

4.1

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

17.3K

Stars

Lua

Language

316.4K

Lines of Code

1.0K

Files

489

Pattern Hits

2026-10-31

Scan Date

0.20

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 271 finding(s).

Hallucinated Dependency & Supply Chain Risk 14.6/100 · LOW

Are imports declared and package/API names verified? 212 finding(s).

Agent Over-Engineering Ratio 0.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 16 finding(s).

PR Review Velocity Impact 21.7/100 · LOW

Which changes need focused human review? 489 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 206MEDIUM 13LOW 270

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 489 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Magic Placeholder Names205 hits · 990 pts

Severity	File	Line	Snippet	Context
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	71	export OPENAI_API_KEY=<your-api-key>	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	187	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	255	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	402	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	470	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	622	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	690	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	751	"Authorization": "Bearer <your-api-key>"	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	791	Authorization: "Bearer <your-api-key>"	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	841	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-request-rewrite.md	910	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-prompt-guard.md	187	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-prompt-guard.md	247	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-prompt-guard.md	484	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-prompt-guard.md	546	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-prompt-template.md	196	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-prompt-template.md	261	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-prompt-template.md	455	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-prompt-template.md	526	Authorization: "Bearer your-api-key"	CODE
HIGH⚡	docs/zh/latest/plugins/ai-rag.md	246	api_key: "Bearer your-api-key"	CODE
HIGH⚡	docs/zh/latest/plugins/ai-rag.md	250	api_key: "Bearer your-api-key"	CODE
HIGH⚡	docs/zh/latest/plugins/ai-rag.md	256	api-key: "Bearer your-api-key"	CODE
HIGH⚡	docs/zh/latest/plugins/ai-rag.md	310	api_key: "Bearer your-api-key"	CODE
HIGH⚡	docs/zh/latest/plugins/ai-rag.md	314	api_key: "Bearer your-api-key"	CODE
HIGH⚡	docs/zh/latest/plugins/ai-rag.md	321	api-key: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	302	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	310	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	365	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	373	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	581	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	590	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	655	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	664	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	1168	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	1176	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	1235	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	1243	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	1585	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	1594	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	1650	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	1659	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2014	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2024	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2081	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2091	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2305	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2313	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2379	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2387	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2576	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2584	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2650	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-proxy-multi.md	2658	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/datadog.md	110	-e DD_API_KEY=<your-api-key> \	CODE
HIGH	docs/zh/latest/plugins/ai-rate-limiting.md	170	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-rate-limiting.md	228	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-rate-limiting.md	417	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-rate-limiting.md	425	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-rate-limiting.md	486	Authorization: "Bearer your-api-key"	CODE
HIGH	docs/zh/latest/plugins/ai-rate-limiting.md	494	Authorization: "Bearer your-api-key"	CODE
145 more matches not shown…

Over-Commented Block243 hits · 243 pts

Severity	File	Line	Snippet	Context
LOW	.asf.yaml	1	#	COMMENT
LOW	CODE_OF_CONDUCT.md	1	<!--	COMMENT
LOW	powered-by.md	1	---	COMMENT
LOW	CHANGELOG.md	1	---	COMMENT
LOW	Vision-and-Milestones.md	1	<!--	COMMENT
LOW	README.md	1	<!--	COMMENT
LOW	CODE_STYLE.md	1	---	COMMENT
LOW	CONTRIBUTING.md	1	<!--	COMMENT
LOW	.licenserc.yaml	1	#	COMMENT
LOW	THREAT_MODEL.md	1	<!--	COMMENT
LOW	.markdownlint.yml	1	#	COMMENT
LOW	MAINTAIN.md	1	<!--	COMMENT
LOW	benchmark/run.sh	1	#! /bin/bash -x	COMMENT
LOW	docker/compose/docker-compose-master.yaml	1	#	COMMENT
LOW	docker/compose/apisix_conf/master/config.yaml	1	#	COMMENT
LOW	docker/debian-dev/docker-entrypoint.sh	1	#!/usr/bin/env bash	COMMENT
LOW	docker/debian-dev/install-brotli.sh	1	#!/usr/bin/env bash	COMMENT
LOW	autodocs/generate.sh	1	#!/usr/bin/env bash	COMMENT
LOW	apisix/plugins/grpc-transcode/proto.lua	181	// server that maps type URLs to message definitions as follows:	COMMENT
LOW	apisix/plugins/grpc-transcode/proto.lua	201	// Must be a valid serialized protocol buffer of the above specified type.	COMMENT
LOW	apisix/cli/ngx_tpl.lua	381	# `handle_trusted_x_forwarded_headers` in apisix/init.lua.	COMMENT
LOW	apisix/cli/ngx_tpl.lua	1021	# derives from them -- the upstream headers come from `r->headers_in`	COMMENT
LOW	ci/linux-install-etcd-client.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/linux-install-openresty.sh	1	#!/usr/bin/env bash	COMMENT
LOW	…ux_apisix_current_luarocks_in_customed_nginx_runner.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/common.sh	1	#	COMMENT
LOW	ci/init-common-test-service.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/free_disk_space.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/init-last-test-service.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/init-plugin-test-service.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/linux_openresty_tongsuo_runner.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/tars-ci.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/backup-docker-images.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/kubernetes-ci.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/check_changelog_prs.ts	61	// fully reverted by 13449 within this release, so they net to a no-op and are	COMMENT
LOW	ci/linux_openresty_runner.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/linux_apisix_current_luarocks_runner.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/linux_openresty_common_runner.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/redhat-ci.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/pod/docker-compose.common.yml	1	#	COMMENT
LOW	ci/pod/docker-compose.first.yml	1	#	COMMENT
LOW	ci/pod/docker-compose.plugin.yml	1	#	COMMENT
LOW	ci/pod/docker-compose.last.yml	1	#	COMMENT
LOW	ci/pod/nacos/healthcheck/nacos-server-healthcheck.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/pod/nacos/healthcheck/nacos-service-healthcheck.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/pod/openfunction/build-function-image.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/pod/otelcol-contrib/config.yaml	1	#	COMMENT
LOW	ci/pod/openldap/enable-anon-bind.sh	1	#!/bin/bash	COMMENT
LOW	ci/pod/keycloak/kcadm_configure_cas.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/pod/keycloak/kcadm_configure_saml.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/pod/keycloak/kcadm_configure_basic.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/pod/keycloak/kcadm_configure_university.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ci/pod/vector/vector.toml	1	#	COMMENT
LOW	utils/check-test-code-style.sh	1	#!/usr/bin/env bash	COMMENT
LOW	utils/gen-vote-contents.sh	1	#!/bin/sh	COMMENT
LOW	utils/check-version.sh	1	#!/bin/sh	COMMENT
LOW	utils/requirements-admin-api.txt	1	# Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	utils/validate-admin-api.py	1	#!/usr/bin/env python3	COMMENT
LOW	utils/fix-zh-doc-segment.py	1	#!/usr/bin/env python3	COMMENT
LOW	utils/check-plugins-code.sh	1	#!/bin/bash	COMMENT
183 more matches not shown…

Self-Referential Comments7 hits · 21 pts

Severity	File	Line	Snippet	Context
MEDIUM	t/fuzzing/simple_http.py	20	# This file provides a fuzzing test with most common plugins via plain HTTP request	COMMENT
MEDIUM	t/fuzzing/http_upstream.py	20	# This file provides a fuzzing test with different upstreams	COMMENT
MEDIUM	t/cli/test_stream_port_range.sh	417	# Create a stream route targeting the inline upstream	COMMENT
MEDIUM	t/cli/test_standalone.sh	148	## Create a symlink to change the link count and as a result `st_ctime`	COMMENT
MEDIUM	t/cli/test_limit_conn_redis_ttl.sh	50	# Create a route with limit-conn and redis policy	COMMENT
MEDIUM	t/cli/test_limit_req_redis_ttl.sh	50	# Create a route with limit-req and redis policy	COMMENT
MEDIUM	t/cli/test_ci_only.sh	20	# This file is like other test_*.sh, but requires extra dependencies which	COMMENT

Hyper-Verbose Identifiers10 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	ci/check_changelog_prs.ts	88	function extractVersionsFromChangelog(): Version[] {	CODE
LOW	ci/check_changelog_prs.ts	132	function shouldIgnoreCommitMessage(message: string): boolean {	CODE
LOW	t/fuzzing/public.py	79	def get_linear_regression_sloped(samples):	CODE
LOW	t/openapi/test_validator.py	40	def test_unresolved_reference(self):	CODE
LOW	t/openapi/test_validator.py	46	def test_duplicate_operation_and_missing_path_parameter(self):	CODE
LOW	t/openapi/test_validator.py	57	def test_invalid_default_and_response_example(self):	CODE
LOW	t/openapi/test_validator.py	67	def test_version_and_release_schema_drift(self):	CODE
LOW⚡	t/openapi/test_validator.py	79	def test_malformed_operation_id(self):	CODE
LOW⚡	t/openapi/test_validator.py	84	def test_missing_collection_put(self):	CODE
LOW⚡	t/openapi/test_validator.py	89	def test_graphql_cost_decoration_schema_drift(self):	CODE

Modern AI Meta-Vocabulary3 hits · 8 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/zh/latest/plugins/ai-rag.md	140	### 与 Azure 集成以获得 RAG 增强响应	COMMENT
MEDIUM	docs/en/latest/plugins/ai-lakera-guard.md	42	The `ai-lakera-guard` Plugin integrates with the [Lakera Guard API (v2)](https://docs.lakera.ai/docs/api) to perform ML-	CODE
MEDIUM	docs/en/latest/plugins/ai-rag.md	140	### Integrate with Azure for RAG-Enhanced Responses	COMMENT

Deep Nesting7 hits · 7 pts

Severity	File	Line	Context
LOW	utils/validate-admin-api.py	43	CODE
LOW	utils/validate-admin-api.py	92	CODE
LOW	utils/validate-admin-api.py	223	CODE
LOW	utils/fix-zh-doc-segment.py	39	CODE
LOW	utils/check-category.py	31	CODE
LOW	t/plugin/openapi_to_mcp_harness.py	97	CODE
LOW	t/cli/test_sse.py	58	CODE

Fake / Example Data7 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	docs/zh/latest/plugins/body-transformer.md	871	"user_name": "John Doe",	CODE
LOW	docs/zh/latest/plugins/body-transformer.md	895	"name": "John Doe",	CODE
LOW	docs/zh/latest/plugins/body-transformer.md	917	"name": "John Doe",	CODE
LOW	docs/en/latest/plugins/body-transformer.md	873	"user_name": "John Doe",	CODE
LOW	docs/en/latest/plugins/body-transformer.md	897	"name": "John Doe",	CODE
LOW	docs/en/latest/plugins/body-transformer.md	919	"name": "John Doe",	CODE
LOW	t/plugin/lago.spec.ts	108	email: 'test@test.com',	CODE

Excessive Try-Catch Wrapping5 hits · 7 pts

Severity	File	Line	Snippet	Context
MEDIUM	t/fuzzing/public.py	48	print("Error in log: ", err)	CODE
LOW	t/plugin/openapi_to_mcp_harness.py	60	except Exception as exc: # noqa: BLE001	CODE
LOW	t/plugin/openapi_to_mcp_harness.py	115	except Exception as exc: # noqa: BLE001	CODE
LOW	t/plugin/openapi_to_mcp_harness.py	177	except Exception: # noqa: BLE001	CODE
MEDIUM	t/plugin/openapi_to_mcp_harness.py	97	def _read(self):	CODE

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	t/plugin/openapi_to_mcp_harness.py	164	except OSError:	CODE

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	conf/config.yaml	28	# To configure via environment variables, you can use `${{VAR}}` syntax. For instance:	COMMENT

apache/apisix

Open-Source Code Quality, Security and Technical Debt Review