AI Slop Code RIsk Monitor

apache/casbin

Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

5.2 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for apache/casbin, a Go project with 20,441 GitHub stars. SynthScan examined 26,950 lines of code across 128 source files, recording 131 pattern matches distributed across 4 syntactic categories. The legacy adjusted pattern signal is 5.2 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

5.2
Adjusted Signal
5.2
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
20.4K
Stars
Go
Language
26.9K
Lines of Code
128
Files
131
Pattern Hits
2026-10-12
Scan Date
0.01
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 22.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 129 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2 finding(s).

PR Review Velocity Impact 22.6/100 · LOW

Which changes need focused human review? 131 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 1LOW 129

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 131 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block127 hits · 127 pts
SeverityFileLineSnippetContext
LOWmodel_b_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOW.asf.yaml1# Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrbac_api_with_domains_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrbac_api_with_domains_synced.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_cached_gfunction_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_backslash_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_transactional.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWfilter_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWinternal_api.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWmodel_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrbac_api_with_domains_context.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWmanagement_api_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWtransaction_adapter_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWwatcher_ex_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWai_api.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWtransaction_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWorbac_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWwatcher_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_cached.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWblp_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWutil_log.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWtransaction_conflict.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWfrontend.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_json_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_synced.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWmanagement_api_b_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer.go81COMMENT
LOWenforcer_context_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_cached_synced_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWfrontend_old.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWtransaction_buffer.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrbac_api_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWtransaction.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrbac_api.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrbac_api.go301// GetImplicitPermissionsForUser gets implicit permissions for a user or role.COMMENT
LOWfrontend_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWfrontend_old_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_distributed.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_context.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrbac_api_with_domains.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_cached_b_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWpbac_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWmanagement_api.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrole_manager_b_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrbac_api_synced.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWrbac_api_synced.go161 return e.Enforcer.GetImplicitRolesForUser(name, domain...)COMMENT
LOWrbac_api_synced.go181// For example:COMMENT
LOWtransaction_commit.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_synced_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_interface.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWsyntax_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWerror_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWai_api_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_cached_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWconstraint_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWenforcer_cached_synced.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWwatcher_update_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
LOWlbac_test.go1// Licensed to the Apache Software Foundation (ASF) under oneCOMMENT
67 more matches not shown…
Synthetic Comment Markers1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHai_api.go74// Explain returns an AI-generated explanation of why Enforce returned a particular result.COMMENT
Excessive Try-Catch Wrapping2 hits · 3 pts
SeverityFileLineSnippetContext
LOW.github/scripts/benchmark_formatter.py246except Exception as e:CODE
MEDIUM.github/scripts/benchmark_formatter.py247 print(f"Error post-processing comparison.md: {e}")CODE
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOW.github/scripts/benchmark_formatter.py100 # Check if it has an existing percentage we might move/alignCOMMENT