1.0

Adjusted Signal

1.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

14.1K

Stars

Java

Language

2.3M

Lines of Code

11.5K

Files

567

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 401 finding(s).

Hallucinated Dependency & Supply Chain Risk 3.6/100 · LOW

Are imports declared and package/API names verified? 158 finding(s).

Agent Over-Engineering Ratio 0.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 206 finding(s).

PR Review Velocity Impact 4.1/100 · LOW

Which changes need focused human review? 567 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 143HIGH 2MEDIUM 34LOW 388

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 567 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators143 hits · 1680 pts

Severity	File	Line	Snippet	Context
CRITICAL	…rg/apache/druid/indexing/common/task/AbstractTask.java	171	if (org.apache.commons.lang3.StringUtils.isNotBlank(errorMessage)) {	CODE
CRITICAL	…ommon/task/batch/parallel/PartialSegmentMergeTask.java	185	org.apache.commons.io.FileUtils.deleteQuietly(persistDir);	CODE
CRITICAL	…ommon/task/batch/parallel/PartialSegmentMergeTask.java	216	org.apache.commons.io.FileUtils.deleteQuietly(tempDir);	CODE
CRITICAL	…ommon/task/batch/parallel/PartialSegmentMergeTask.java	225	final File partitionDir = org.apache.commons.io.FileUtils.getFile(	CODE
CRITICAL	…pache/druid/indexing/common/tasklogs/FileTaskLogs.java	136	org.apache.commons.io.FileUtils.forceDelete(file);	CODE
CRITICAL	…rg/apache/druid/indexing/worker/WorkerTaskManager.java	346	org.apache.commons.io.FileUtils.cleanDirectory(tmpDir);	CODE
CRITICAL	…exing/worker/shuffle/LocalIntermediaryDataManager.java	198	for (File eachFile : org.apache.commons.io.FileUtils.listFiles(supervisorTaskDir, null, true)) {	CODE
CRITICAL	…exing/worker/shuffle/LocalIntermediaryDataManager.java	287	org.apache.commons.io.FileUtils.forceDelete(taskTempDir);	CODE
CRITICAL	…exing/worker/shuffle/LocalIntermediaryDataManager.java	347	org.apache.commons.io.FileUtils.deleteQuietly(destFile);	CODE
CRITICAL	…exing/worker/shuffle/LocalIntermediaryDataManager.java	408	for (File eachFile : org.apache.commons.io.FileUtils.listFiles(supervisorTaskPath, null, true)) {	CODE
CRITICAL	…exing/worker/shuffle/LocalIntermediaryDataManager.java	416	org.apache.commons.io.FileUtils.forceDelete(supervisorTaskPath);	CODE
CRITICAL	…/org/apache/druid/query/filter/BloomDimFilterTest.java	352	org.apache.hive.common.util.BloomKFilter.build(1500);	CODE
CRITICAL	…/org/apache/druid/query/filter/BloomDimFilterTest.java	355	org.apache.hive.common.util.BloomKFilter.serialize(byteArrayOutputStream, hiveFilter);	CODE
CRITICAL	…/org/apache/druid/query/filter/BloomDimFilterTest.java	369	org.apache.hive.common.util.BloomKFilter.build(1500);	CODE
CRITICAL	…/org/apache/druid/query/filter/BloomDimFilterTest.java	373	org.apache.hive.common.util.BloomKFilter.serialize(byteArrayOutputStream, hiveFilter);	CODE
CRITICAL	…/org/apache/druid/query/filter/BloomDimFilterTest.java	388	org.apache.hive.common.util.BloomKFilter.build(1500);	CODE
CRITICAL	…/org/apache/druid/query/filter/BloomDimFilterTest.java	392	org.apache.hive.common.util.BloomKFilter.serialize(byteArrayOutputStream, hiveFilter);	CODE
CRITICAL	…/org/apache/druid/query/filter/BloomDimFilterTest.java	406	org.apache.hive.common.util.BloomKFilter.build(1500);	CODE
CRITICAL	…/org/apache/druid/query/filter/BloomDimFilterTest.java	410	org.apache.hive.common.util.BloomKFilter.serialize(byteArrayOutputStream, hiveFilter);	CODE
CRITICAL	…org/apache/druid/data/input/parquet/ParquetReader.java	90	reader = closer.register(org.apache.parquet.hadoop.ParquetReader.builder(new GroupReadSupport(), path)	CODE
CRITICAL	…org/apache/druid/storage/s3/ObjectSummaryIterator.java	182	* Adapted from org.jets3t.service.model.StorageObject.isDirectoryPlaceholder(). Does not include the check for	COMMENT
CRITICAL	…src/main/java/org/apache/druid/storage/s3/S3Utils.java	467	if (org.apache.commons.lang3.StringUtils.isNotEmpty(endpointUrl)) {	CODE
CRITICAL	…src/main/java/org/apache/druid/storage/s3/S3Utils.java	491	if (org.apache.commons.lang3.StringUtils.isEmpty(endpointUrl)) {	CODE
CRITICAL	…src/main/java/org/apache/druid/storage/s3/S3Utils.java	502	if (org.apache.commons.lang3.StringUtils.isEmpty(proxyConfig.getHost())) {	CODE
CRITICAL	…src/main/java/org/apache/druid/storage/s3/S3Utils.java	513	if (org.apache.commons.lang3.StringUtils.isNotEmpty(proxyConfig.getUsername())) {	CODE
CRITICAL	…src/main/java/org/apache/druid/storage/s3/S3Utils.java	516	if (org.apache.commons.lang3.StringUtils.isNotEmpty(proxyConfig.getPassword())) {	CODE
CRITICAL	…e/druid/storage/s3/output/RetryableS3OutputStream.java	244	org.apache.commons.io.FileUtils.forceDelete(chunkStorePath);	CODE
CRITICAL	…g/apache/druid/storage/hdfs/HdfsDataSegmentKiller.java	105	org.apache.druid.java.util.common.StringUtils.format(	CODE
CRITICAL	…org/apache/druid/inputsource/hdfs/HdfsInputSource.java	160	final String[] splitPaths = org.apache.hadoop.util.StringUtils.split(inputPath);	CODE
CRITICAL	…druid/k8s/overlord/taskadapter/K8sTaskAdapterTest.java	367	Mockito.when(mockTestLogs.streamTaskPayload("ID")).thenReturn(com.google.common.base.Optional.of(	CODE
CRITICAL⚡	…che/druid/k8s/overlord/taskadapter/K8sTaskAdapter.java	460	javaOpts.add(org.apache.druid.java.util.common.StringUtils.format(	CODE
CRITICAL⚡	…che/druid/k8s/overlord/taskadapter/K8sTaskAdapter.java	463	javaOpts.add(org.apache.druid.java.util.common.StringUtils.format("-Ddruid.port=%d", DruidK8sConstants.PORT));	CODE
CRITICAL⚡	…che/druid/k8s/overlord/taskadapter/K8sTaskAdapter.java	464	javaOpts.add(org.apache.druid.java.util.common.StringUtils.format(	CODE
CRITICAL⚡	…che/druid/k8s/overlord/taskadapter/K8sTaskAdapter.java	468	javaOpts.add(org.apache.druid.java.util.common.StringUtils.format(	CODE
CRITICAL⚡	…che/druid/k8s/overlord/taskadapter/K8sTaskAdapter.java	474	javaOpts.add(org.apache.druid.java.util.common.StringUtils.format(	CODE
CRITICAL⚡	…che/druid/k8s/overlord/taskadapter/K8sTaskAdapter.java	478	javaOpts.add(org.apache.druid.java.util.common.StringUtils.format(	CODE
CRITICAL	…urity/kerberos/DruidKerberosAuthenticationHandler.java	155	.substring(org.apache.hadoop.security.authentication.client.KerberosAuthenticator.NEGOTIATE.length())	CODE
CRITICAL	…apache/druid/storage/azure/AzureDataSegmentPusher.java	113	boolean prefixIsNullOrEmpty = org.apache.commons.lang3.StringUtils.isEmpty(prefix);	CODE
CRITICAL	…apache/druid/segment/serde/cell/RandomStringUtils.java	40	return org.apache.commons.lang3.RandomStringUtils.random(length, 0, 0, true, true, null, random);	CODE
CRITICAL	…apache/druid/segment/serde/cell/RandomStringUtils.java	47	return org.apache.commons.lang3.RandomStringUtils.random(length, 0, 0, true, true, null, random);	CODE
CRITICAL	…ache/druid/collections/spatial/ImmutableRTreeTest.java	677	org.junit.jupiter.api.Assertions.assertEquals(Bytes.asList(bytes1), Bytes.asList(bytes2));	CODE
CRITICAL	…ache/druid/collections/spatial/ImmutableRTreeTest.java	702	org.junit.jupiter.api.Assertions.assertTrue(((FluentIterable) points).toList().size() == 100);	CODE
CRITICAL⚡	…test/java/org/apache/druid/indexer/TaskStatusTest.java	32	+ "\tat org.apache.druid.indexing.common.task.AbstractBatchIndexTask.tryTimeChunkLock(AbstractBatchIndexTask.java:	CODE
CRITICAL⚡	…test/java/org/apache/druid/indexer/TaskStatusTest.java	33	+ "\tat org.apache.druid.indexing.common.task.batch.parallel.PartialHashSegmentGenerateTask.isReady(PartialHashSeg	CODE
CRITICAL⚡	…test/java/org/apache/druid/indexer/TaskStatusTest.java	34	+ "\tat org.apache.druid.indexing.overlord.TaskQueue.manageInternalCritical(TaskQueue.java:420) [druid-indexing-se	CODE
CRITICAL⚡	…test/java/org/apache/druid/indexer/TaskStatusTest.java	35	+ "\tat org.apache.druid.indexing.overlord.TaskQueue.manageInternal(TaskQueue.java:373) [druid-indexing-service-20	CODE
CRITICAL⚡	…test/java/org/apache/druid/indexer/TaskStatusTest.java	36	+ "\tat org.apache.druid.indexing.overlord.TaskQueue.manage(TaskQueue.java:356) [druid-indexing-service-2024.03.0-	CODE
CRITICAL	…test/java/org/apache/druid/indexer/TaskStatusTest.java	47	+ "\tat org.apache.druid.indexing.common.task.AbstractBatchIndexTask.tryTimeChunkLock(AbstractBatchIndexTask.java:	CODE
CRITICAL	…test/java/org/apache/druid/indexer/TaskStatusTest.java	48	+ "\tat org.apache.druid.indexing.common.task.batch.parallel.PartialHashSegmentGenerateTask.isReady(PartialHashSeg	CODE
CRITICAL⚡	…/java/org/apache/druid/java/util/common/Stopwatch.java	37	return new Stopwatch(com.google.common.base.Stopwatch.createStarted());	CODE
CRITICAL⚡	…/java/org/apache/druid/java/util/common/Stopwatch.java	42	return new Stopwatch(com.google.common.base.Stopwatch.createUnstarted());	CODE
CRITICAL⚡	…/java/org/apache/druid/java/util/common/Stopwatch.java	47	return new Stopwatch(com.google.common.base.Stopwatch.createStarted(ticker));	CODE
CRITICAL	…/java/org/apache/druid/java/util/common/FileUtils.java	88	com.google.common.io.Files.asByteSink(outFile),	CODE
CRITICAL	…/java/org/apache/druid/java/util/common/FileUtils.java	524	org.apache.commons.io.FileUtils.deleteDirectory(directory);	CODE
CRITICAL	…apache/druid/query/search/FragmentSearchQuerySpec.java	88	if (!org.apache.commons.lang3.StringUtils.containsIgnoreCase(dimVal, search)) {	CODE
CRITICAL	…apache/druid/query/search/ContainsSearchQuerySpec.java	71	return org.apache.commons.lang3.StringUtils.containsIgnoreCase(dimVal, value);	CODE
CRITICAL	…va/org/apache/druid/query/expression/ContainsExpr.java	99	return s -> org.apache.commons.lang3.StringUtils.containsIgnoreCase(s, searchString);	CODE
CRITICAL	…/main/java/org/apache/druid/data/input/TextReader.java	139	if (com.google.common.base.Strings.isNullOrEmpty(parsedLine.get(i))) {	CODE
CRITICAL	…erver/coordination/SegmentManagerThreadSafetyTest.java	220	org.apache.commons.io.FileUtils.copyDirectory(sourceFile, dir);	CODE
CRITICAL	…org/apache/druid/server/log/FileRequestLoggerTest.java	94	com.google.common.io.Files.asCharSink(oldLogFile, StandardCharsets.UTF_8).write("testOldLogContent");	CODE
83 more matches not shown…

Hyper-Verbose Identifiers198 hits · 204 pts

Severity	File	Line	Snippet	Context
LOW	…worker/shuffle/DeepStorageIntermediaryDataManager.java	37	public class DeepStorageIntermediaryDataManager implements IntermediaryDataManager	CODE
LOW	…exing/worker/shuffle/LocalIntermediaryDataManager.java	86	public class LocalIntermediaryDataManager implements IntermediaryDataManager	CODE
LOW	…g/apache/druid/security/basic/CommonCacheNotifier.java	208	private static class ResponseHandler implements HttpResponseHandler<StatusResponseHolder, StatusResponseHolder>	CODE
LOW	…urity/kerberos/RetryIfUnauthorizedResponseHandler.java	29	public class RetryIfUnauthorizedResponseHandler<Intermediate, Final>	CODE
LOW	…e/druid/java/util/http/client/NettyHttpClientTest.java	55	private static class ThrowingResponseHandler implements HttpResponseHandler<Object, Object>	CODE
LOW	…ache/druid/segment/nested/StructuredDataProcessor.java	33	public abstract class StructuredDataProcessor	CODE
LOW	…l/http/client/response/InputStreamResponseHandler.java	31	public class InputStreamResponseHandler implements HttpResponseHandler<AppendableByteArrayInputStream, InputStream>	CODE
LOW	…lient/response/SequenceInputStreamResponseHandler.java	49	public class SequenceInputStreamResponseHandler implements HttpResponseHandler<InputStream, InputStream>	CODE
LOW	…il/http/client/response/StringFullResponseHandler.java	31	public class StringFullResponseHandler	CODE
LOW	…tp/client/response/InputStreamFullResponseHandler.java	30	public class InputStreamFullResponseHandler implements HttpResponseHandler<InputStreamFullResponseHolder, InputStreamFul	CODE
LOW	…http/client/response/ObjectOrErrorResponseHandler.java	32	public class ObjectOrErrorResponseHandler<IntermediateType, FinalType>	CODE
LOW	…a/util/http/client/response/StatusResponseHandler.java	25	public class StatusResponseHandler implements HttpResponseHandler<StatusResponseHolder, StatusResponseHolder>	CODE
LOW	…til/http/client/response/BytesFullResponseHandler.java	30	public class BytesFullResponseHandler implements HttpResponseHandler<BytesFullResponseHolder, BytesFullResponseHolder>	CODE
LOW	…che/druid/frame/file/FrameFileHttpResponseHandler.java	48	public class FrameFileHttpResponseHandler implements HttpResponseHandler<FrameFilePartialFetch, FrameFilePartialFetch>	CODE
LOW	distribution/bin/generate-binary-notice.py	35	def normalize_module_for_output(module):	CODE
LOW	distribution/bin/find-missing-backports.py	28	def extract_pr_title_from_commit_message(commit_msg):	CODE
LOW	distribution/bin/find-missing-backports.py	36	def extract_pr_numbers_from_commit_message(commit_msg):	CODE
LOW	distribution/bin/generate-binary-license.py	47	def normalize_module_for_output(module):	CODE
LOW	distribution/bin/generate-binary-license.py	151	def print_license_name_underbar(license_name):	CODE
LOW	distribution/bin/check-licenses.py	235	def build_compatible_license_names():	CODE
LOW⚡	distribution/bin/test_check_licenses.py	45	def test_registered_under_released_module(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	48	def test_unregistered_is_missing(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	51	def test_registered_only_under_excluded_module_is_missing_when_shipped(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	54	def test_registered_only_under_excluded_module_is_fine_when_not_shipped(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	57	def test_skipped_dependency_is_not_missing(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	68	def test_reported_by_released_module(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	71	def test_reported_only_by_excluded_modules_is_ignored(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	74	def test_reported_by_released_and_excluded_modules(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	77	def test_known_and_unspecified_licenses_are_ignored(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	81	def test_skipped_dependency_is_ignored(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	86	def test_maps_report_dirs_to_module_tags(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	117	def test_updates_only_the_version_line_when_all_libraries_moved(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	125	def test_does_not_split_documents_at_indented_dashes(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	130	def test_keeps_quotes_and_does_not_quote_versions_that_look_like_numbers(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	139	def test_leaves_current_entries_alone(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	143	def test_flags_libraries_that_moved_to_different_versions(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	147	def test_flags_entries_where_only_some_libraries_moved(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	151	def test_updates_the_same_library_in_every_module(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	176	def test_updates_an_entry_whose_old_version_only_ships_in_another_module(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	184	def test_leaves_entries_whose_library_is_only_reported_at_another_entry_version(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	191	def test_takes_a_version_an_entry_of_another_module_registers(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	203	def test_flags_entries_of_one_module_that_move_to_the_same_version(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	210	def test_flags_moved_entries_with_libraries_in_no_report(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	214	def test_flags_moved_entries_with_libraries_another_entry_registers(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	221	def test_flags_a_library_with_several_new_versions(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	225	def test_prefers_the_version_reported_in_the_entry_module(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	233	def test_skips_flagged_entries_and_modules_without_a_report(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	260	def test_known_license_is_normalized(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	263	def test_unknown_license_is_unset_and_its_name_is_kept(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	266	def test_unknown_license_is_fine_when_another_license_is_known(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	269	def test_gpl_only_license_is_unset(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	272	def test_gpl_license_does_not_override_a_compatible_one(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	275	def test_known_license_mentioning_gpl_is_normalized(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	278	def test_separators_are_not_license_names(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	281	def test_unspecified_license_is_kept(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	284	def test_first_compatible_license_is_kept(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	289	def test_every_normalized_name_is_a_name(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	295	def test_versions_that_look_like_numbers_are_loaded_as_strings(self):	CODE
LOW⚡	distribution/bin/test_check_licenses.py	299	def test_booleans_are_still_loaded_as_booleans(self):	CODE
LOW	distribution/bin/test_check_licenses.py	163	def test_does_not_take_a_version_another_entry_registers(self):	CODE
138 more matches not shown…

Over-Commented Block123 hits · 122 pts

Severity	File	Line	Snippet	Context
LOW	.lgtm.yml	1	# Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	rewrite.yml	1	# Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	upload.sh	1	#!/bin/bash -e	COMMENT
LOW	licenses.yaml	1	# Licensed to the Apache Software Foundation (ASF) under one	COMMENT
LOW	…/druid/indexing/common/task/CompactionTaskRunBase.java	841		COMMENT
LOW	…/druid/indexing/common/task/CompactionTaskRunBase.java	961	{	COMMENT
LOW	…a/org/apache/druid/indexing/overlord/OverlordMode.java	21		COMMENT
LOW	…druid/indexing/overlord/hrtr/HttpRemoteTaskRunner.java	1141	).emit();	COMMENT
LOW	…dexing/common/task/batch/parallel/TombstoneHelper.java	221	// Generate a tombstone interval covering eternity.	COMMENT
LOW	…xing/seekablestream/SeekableStreamIndexTaskRunner.java	181	private final ConcurrentMap<PartitionIdType, SequenceOffsetType> currOffsets = new ConcurrentHashMap<>();	COMMENT
LOW	…/query/aggregation/histogram/ApproximateHistogram.java	1541		COMMENT
LOW	…segment/nested/NestedFieldColumnIndexSupplierTest.java	1781	// 10 rows	COMMENT
LOW	…aggregation/ExpressionLambdaAggregatorFactoryTest.java	1061	// string because fold type equals finalized type, even though merge type is array	COMMENT
LOW	…/druid/segment/PartialQueryableIndexCursorFactory.java	181	runDownloads.add(submitRunFetch(bundle.bundleName(), fetch, holdRelease));	COMMENT
LOW	…rg/apache/druid/guice/GuiceAnnotationIntrospector.java	121	* while {Value.forIgnoredProperties("")} for {@code injected} because the later does not have {@code JsonProperty}.	COMMENT
LOW	…va/org/apache/druid/concurrent/TaskThreadPriority.java	21		COMMENT
LOW	…apache/druid/query/context/QueryContextParameters.java	61	/// {@link org.apache.druid.query.context.docs.ParameterDocumentationGenerator} generates a table row	COMMENT
LOW	…ava/org/apache/druid/query/groupby/GroupingEngine.java	241	final String timestampResultField = queryContext.get(QueryContextParameters.TIMESTAMP_RESULT_FIELD);	COMMENT
LOW	…ruid/query/groupby/epinephelinae/ParallelCombiner.java	61	* ParallelCombiner builds a combining tree which asynchronously aggregates input entries. Each node of the combining	COMMENT
LOW	…ruid/query/groupby/epinephelinae/ParallelCombiner.java	321	final List<CloseableIterator<Entry<KeyType>>> childIteratorsOfNextLevel = new ArrayList<>();	COMMENT
LOW	…uid/query/groupby/epinephelinae/HashVectorGrouper.java	421	* into them.	COMMENT
LOW	publications/radstack/src/druid_tables.R	221	ylab("Cluster Scan Rate (billion rows/sec.)")	COMMENT
LOW	publications/whitepaper/src/druid_tables.R	221	ylab("Cluster Scan Rate (billion rows/sec.)")	COMMENT
LOW	website/mise.toml	1	#	COMMENT
LOW	distribution/docker/druid.sh	1	#!/bin/sh	COMMENT
LOW	distribution/docker/druid.sh	21		COMMENT
LOW	distribution/docker/deduplicate_jars.sh	1	#!/bin/bash	COMMENT
LOW	distribution/docker/docker-compose.yml	1	#	COMMENT
LOW	distribution/docker/peon.sh	1	#!/bin/sh	COMMENT
LOW	distribution/docker/peon.sh	21		COMMENT
LOW	distribution/bin/generate-binary-notice.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/get-milestone-prs.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/build-textfile-readme.sh	1	#!/bin/bash	COMMENT
LOW	distribution/bin/find-missing-backports.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/jar-notice-lister.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/web-console-dep-lister.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/generate-binary-license.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/generate-license-dependency-reports.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/refresh-license-versions.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/get-milestone-contributors.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/make-linkable-release-notes.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/check-licenses.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/test_check_licenses.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/tag-missing-milestones.py	1	#!/usr/bin/env python3	COMMENT
LOW	distribution/bin/licenses_yaml.py	1	#!/usr/bin/env python3	COMMENT
LOW	…metadata/IndexerSQLMetadataStorageCoordinatorTest.java	3261	maxVersion,	COMMENT
LOW	…/segment/loading/PartialSegmentMetadataCacheEntry.java	141		COMMENT
LOW	…che/druid/server/coordinator/duty/CompactSegments.java	361	// the flag is null, or it is false. It is needed when it is null to avoid the	COMMENT
LOW	…/development/extensions-contrib/spectator-histogram.md	141	The result of the aggregation is a histogram that is built by ingesting numeric values from	COMMENT
LOW	…rg/apache/druid/msq/exec/MSQCompactionTaskRunTest.java	341	)	COMMENT
LOW	…rg/apache/druid/msq/exec/MSQCompactionTaskRunTest.java	361	// four rows in hour 02:	COMMENT
LOW	…rg/apache/druid/msq/indexing/error/MSQErrorReport.java	221	@Nullable final ColumnMappings columnMappings	COMMENT
LOW	hooks/install-hooks.sh	1	#!/bin/bash -eu	COMMENT
LOW	hooks/uninstall-hooks.sh	1	#!/bin/bash -eu	COMMENT
LOW	hooks/run-all-in-dir.py	1	#!/usr/bin/env python3	COMMENT
LOW	examples/bin/broker.sh	1	#!/bin/bash -eu	COMMENT
LOW	examples/bin/jconsole.sh	1	#!/bin/bash	COMMENT
LOW	examples/bin/router.sh	1	#!/bin/bash -eu	COMMENT
LOW	examples/bin/node.sh	1	#!/bin/bash -eu	COMMENT
LOW	examples/bin/overlord.sh	1	#!/bin/bash -eu	COMMENT
63 more matches not shown…

Self-Referential Comments12 hits · 40 pts

Severity	File	Line	Snippet	Context
MEDIUM	distribution/docker/deduplicate_jars.sh	46	# This file is a duplicate, replace it with a symlink to the canonical file	COMMENT
MEDIUM⚡	…edded-tests/tls/generate-server-certs-and-keystores.sh	74	# Create a Java keystore containing the generated certificate in PKCS12 format	COMMENT
MEDIUM⚡	…edded-tests/tls/generate-server-certs-and-keystores.sh	77	# Create a Java truststore with the druid test cluster root CA	COMMENT
MEDIUM⚡	…edded-tests/tls/generate-server-certs-and-keystores.sh	83	# Create the CRL	COMMENT
MEDIUM	…d-tests/tls/generate-incorrect-hostname-client-cert.sh	53	# Create a Java keystore containing the generated certificate	COMMENT
MEDIUM	…d-tests/tls/generate-valid-intermediate-client-cert.sh	92	# Create a Java keystore containing the generated certificate	COMMENT
MEDIUM	…tests/tls/generate-invalid-intermediate-client-cert.sh	92	# Create a Java keystore containing the generated certificate	COMMENT
MEDIUM	embedded-tests/tls/generate-expired-client-cert.sh	125	# Create a Java keystore containing the generated certificate	COMMENT
MEDIUM	embedded-tests/tls/generate-good-client-cert.sh	57	# Create a Java keystore containing the generated certificate	COMMENT
MEDIUM	embedded-tests/tls/generate-good-client-cert.sh	61	# Create a Java truststore with the druid test cluster root CA	COMMENT
MEDIUM	…bedded-tests/tls/generate-to-be-revoked-client-cert.sh	59	# Create a Java keystore containing the generated certificate	COMMENT
MEDIUM	…edded-tests/tls/generate-untrusted-root-client-cert.sh	57	# Create a Java keystore containing the generated certificate	COMMENT

AI Slop Vocabulary11 hits · 33 pts

Severity	File	Line	Snippet	Context
MEDIUM	…eekablestream/supervisor/SeekableStreamSupervisor.java	2539	// seamless schema migration.	COMMENT
MEDIUM	…che/druid/storage/google/GoogleSegmentRangeReader.java	121	// range successfully, which shouldn't happen in practice. Returning empty keeps us robust either way.	COMMENT
MEDIUM	…/org/apache/druid/storage/s3/S3SegmentRangeReader.java	126	// range successfully, which shouldn't happen in practice. Returning empty keeps us robust either way.	COMMENT
MEDIUM	…pache/druid/storage/azure/AzureSegmentRangeReader.java	133	// range successfully, which shouldn't happen in practice. Returning empty keeps us robust either way.	COMMENT
MEDIUM	…java/org/apache/druid/frame/processor/SuperSorter.java	593	// Definitely the penultimate level. Channels per merger may be less than maxChannelsPerMerger.	COMMENT
MEDIUM	…g/apache/druid/timeline/VersionedIntervalTimeline.java	70	* #lookup} because they are overshadowed by some other object. This can be used in conjunction with the {@link #add}	COMMENT
MEDIUM	distribution/bin/check-licenses.py	453	# Build a dictionary to facilitate comparing reported licenses and registered ones.	COMMENT
MEDIUM	web-console/src/utils/sampler.ts	688	// The Druid expressions are very close to SQL so try parsing them as SQL, if it parses then this is a more robust way	COMMENT
MEDIUM	…ole/src/druid-models/ingestion-spec/ingestion-spec.tsx	473	// This does not match the type of IngestionSpec but this dialog is robust enough to deal with anything but spec mus	COMMENT
MEDIUM	…odules/grouping-table-module/grouping-table-module.tsx	45	// when ordering on non __time is more robust	COMMENT
MEDIUM	web-console/src/helpers/execution/sql-task-execution.ts	186	// This whole catch block is a hack, and we should make the detail route more robust	COMMENT

Verbosity Indicators16 hits · 33 pts

Severity	File	Line	Snippet	Context
LOW	…sql/HllSketchApproxCountDistinctUtf8SqlAggregator.java	40	* Currently undocumented. Only accepts strings, not sketches. The purpose of this function is to allow us to experiment	COMMENT
LOW⚡	…d/k8s/overlord/MultipleKubernetesTaskRunnerConfig.java	275	// Step 1: Parse properties to JsonNode (tree model)	COMMENT
LOW⚡	…d/k8s/overlord/MultipleKubernetesTaskRunnerConfig.java	278	// Step 2: If we have JSON labels or annotations, merge them into the tree	COMMENT
LOW⚡	…d/k8s/overlord/MultipleKubernetesTaskRunnerConfig.java	287	// Step 3: Deserialize the tree to final config object	COMMENT
LOW⚡	…g/apache/druid/frame/processor/FrameChannelMerger.java	310	// Step 1: Ensure there is a pending row.	COMMENT
LOW⚡	…g/apache/druid/frame/processor/FrameChannelMerger.java	320	// Step 2: Fold in subsequent rows with the same sort key.	COMMENT
LOW	…g/apache/druid/frame/processor/FrameChannelMerger.java	337	// Step 3: Check whether the pending row crosses a partition boundary.	COMMENT
LOW⚡	…g/apache/druid/frame/processor/FrameChannelMerger.java	350	// Step 4: Flush the completed group to the frame writer.	COMMENT
LOW⚡	…g/apache/druid/frame/processor/FrameChannelMerger.java	355	// Step 5: Check the row limit.	COMMENT
LOW	…ava/org/apache/druid/query/groupby/GroupingEngine.java	981	// cardinality. We need to check if a virtual column exists with the same name, since virtual columns can shadow	COMMENT
LOW	…y/groupby/epinephelinae/collection/HashTableUtils.java	111	* The purpose of this function is to be faster than {@link Memory#equalTo} for the small memory ranges that	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	289	// Step 1: Issue the query asynchronously.	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	293	// Step 2: Get the report.	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	319	// Step 3: Cancel the query	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	323	// Step 4: Wait for the sqlQuery/time metric to be emitted (signals query completion)	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	330	// Step 5: Fetch the report again - should now be in FAILED state	COMMENT

Structural Annotation Overuse14 hits · 30 pts

Severity	File	Line	Snippet	Context
LOW⚡	…d/k8s/overlord/MultipleKubernetesTaskRunnerConfig.java	275	// Step 1: Parse properties to JsonNode (tree model)	COMMENT
LOW⚡	…d/k8s/overlord/MultipleKubernetesTaskRunnerConfig.java	278	// Step 2: If we have JSON labels or annotations, merge them into the tree	COMMENT
LOW⚡	…d/k8s/overlord/MultipleKubernetesTaskRunnerConfig.java	287	// Step 3: Deserialize the tree to final config object	COMMENT
LOW⚡	…g/apache/druid/frame/processor/FrameChannelMerger.java	310	// Step 1: Ensure there is a pending row.	COMMENT
LOW⚡	…g/apache/druid/frame/processor/FrameChannelMerger.java	320	// Step 2: Fold in subsequent rows with the same sort key.	COMMENT
LOW	…g/apache/druid/frame/processor/FrameChannelMerger.java	337	// Step 3: Check whether the pending row crosses a partition boundary.	COMMENT
LOW⚡	…g/apache/druid/frame/processor/FrameChannelMerger.java	350	// Step 4: Flush the completed group to the frame writer.	COMMENT
LOW⚡	…g/apache/druid/frame/processor/FrameChannelMerger.java	355	// Step 5: Check the row limit.	COMMENT
LOW	…uid/server/http/security/ResourceFilterTestHelper.java	200	// Step 3 - Merge all the Objects arrays for each endpoints	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	289	// Step 1: Issue the query asynchronously.	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	293	// Step 2: Get the report.	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	319	// Step 3: Cancel the query	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	323	// Step 4: Wait for the sqlQuery/time metric to be emitted (signals query completion)	COMMENT
LOW⚡	…id/testing/embedded/msq/EmbeddedDartReportApiTest.java	330	// Step 5: Fetch the report again - should now be in FAILED state	COMMENT

Fake / Example Data14 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	…egment/loading/HdfsFileTimestampVersionFinderTest.java	52	private static String pathContents = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i	CODE
LOW	…egment/loading/HdfsFileTimestampVersionFinderTest.java	52	private static String pathContents = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i	CODE
LOW	…ache/druid/storage/hdfs/HdfsDataSegmentPullerTest.java	56	private static String pathContents = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i	CODE
LOW	…ache/druid/storage/hdfs/HdfsDataSegmentPullerTest.java	56	private static String pathContents = "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor i	CODE
LOW	…/org/apache/druid/segment/ConcatenatingCursorTest.java	117	new Object[]{"placeholder"}	CODE
LOW	…/org/apache/druid/segment/ConcatenatingCursorTest.java	172	new Object[]{"placeholder"}	CODE
LOW	…ruid/segment/vector/ConcatenatingVectorCursorTest.java	125	new Object[]{"placeholder"}	CODE
LOW	…ruid/segment/vector/ConcatenatingVectorCursorTest.java	180	new Object[]{"placeholder"}	CODE
LOW⚡	…enchmark/query/SqlMultiValueStringFilterBenchmark.java	207	"Foo", "placeholder",	CODE
LOW⚡	…enchmark/query/SqlMultiValueStringFilterBenchmark.java	208	"Bar", "placeholder",	CODE
LOW⚡	…enchmark/query/SqlMultiValueStringFilterBenchmark.java	209	"Baz", "placeholder"	CODE
LOW	…g/embedded/server/EmbeddedBrokerDynamicConfigTest.java	235	.set(BrokerDynamicConfig.CONFIG_KEY, config, new AuditInfo("test", "test@test.com", "Testing", "127.0.0.1	CODE
LOW	…s/WhiteListBasedDruidToTimelineEventConverterTest.java	137	new ServiceMetricEvent.Builder().setDimension("id", "dummy_id")	CODE
LOW	…ruid/emitter/graphite/WhiteListBasedConverterTest.java	144	new ServiceMetricEvent.Builder().setDimension("id", "dummy_id")	CODE

Modern AI Meta-Vocabulary8 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	…apache/druid/query/context/QueryContextParameters.java	289	See [Broker configuration](../configuration/index.md#broker) and [subquery guardrails](../configuration/in	STRING
MEDIUM	…apache/druid/query/context/QueryContextParameters.java	309	See [Broker configuration](../configuration/index.md#broker) and [subquery guardrails](../configuration/in	STRING
MEDIUM	docs/operations/metrics.md	84	\|`subquery/bytes`\|Number of bytes materialized by the subquery's results. This metric is only emitted if the query uses	CODE
MEDIUM	docs/operations/metrics.md	84	\|`subquery/bytes`\|Number of bytes materialized by the subquery's results. This metric is only emitted if the query uses	CODE
MEDIUM	docs/release-info/migr-subquery-limit.md	64	- [Broker configuration reference](../configuration#guardrails-for-materialization-of-subqueries) for more information o	CODE
MEDIUM	docs/querying/sql-window-functions.md	236	#### Window frame guardrails	COMMENT
MEDIUM	docs/querying/query-context-reference.md	60	\|`maxSubqueryRows`\| `druid.server.http.maxSubqueryRows` \| Upper limit on the number of rows a subquery can generate. See	CODE
MEDIUM	docs/querying/query-context-reference.md	61	\|`maxSubqueryBytes`\| `druid.server.http.maxSubqueryBytes` \| Upper limit on the number of bytes a subquery can generate.	CODE

Deep Nesting12 hits · 12 pts

Severity	File	Line	Context
LOW	distribution/bin/generate-binary-notice.py	46	CODE
LOW	distribution/bin/generate-binary-license.py	91	CODE
LOW	distribution/bin/generate-binary-license.py	176	CODE
LOW	distribution/bin/refresh-license-versions.py	76	CODE
LOW	distribution/bin/make-linkable-release-notes.py	33	CODE
LOW	distribution/bin/check-licenses.py	428	CODE
LOW	distribution/bin/check-licenses.py	452	CODE
LOW	distribution/bin/check-licenses.py	61	CODE
LOW	distribution/bin/check-licenses.py	192	CODE
LOW	examples/bin/start-druid-main.py	249	CODE
LOW	examples/bin/start-druid-main.py	391	CODE
LOW	examples/bin/start-druid-main.py	547	CODE

Excessive Try-Catch Wrapping7 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	distribution/bin/get-milestone-prs.py	78	except Exception as e:	CODE
MEDIUM	distribution/bin/jar-notice-lister.py	89	print("Error while grabbing NOTICE file: " + jar_file)	CODE
LOW	distribution/bin/generate-license-dependency-reports.py	44	except Exception as e:	CODE
LOW	distribution/bin/tag-missing-milestones.py	69	except Exception as e:	CODE
LOW	examples/bin/start-druid-main.py	385	except Exception:	CODE
LOW	examples/bin/start-druid-main.py	408	except Exception:	CODE
MEDIUM	examples/bin/start-druid-main.py	391	def convert_total_memory_string(memory):	CODE

AI Response Leakage1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	docs/development/extensions-core/datasketches-hll.md	71	It is very common to use `HLLSketchBuild` in combination with [rollup](../../ingestion/rollup.md) to create a [metric](	CODE

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	examples/bin/start-druid-main.py	385	except Exception:	CODE

Redundant / Tautological Comments3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	distribution/docker/deduplicate_jars.sh	24	# Check if an argument is provided	COMMENT
LOW	distribution/docker/deduplicate_jars.sh	41	# Check if this is the first occurrence of this file	COMMENT
LOW	…-contrib/druid-opa-authorizer/example/ldap/run-ldap.sh	20	# Check if the bootstrap.ldif file exists on the host	COMMENT

Slop Phrases2 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	…/org/apache/druid/segment/join/table/IndexedTable.java	75	* {@link #rowSignature()}. Don't forget to close your {@link Reader} when finished reading, to clean up any	COMMENT
MEDIUM	…/org/apache/druid/msq/util/MultiStageQueryContext.java	921	" Please use [%s] key in the context parameter and use one of the TaskLock types as mentioned earlier or "	CODE

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	.github/scripts/static-checks-maven.sh	36	# TODO: consider adding pmd:cpd-check	COMMENT

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…ke-extensions/src/test/resources/create_delta_table.py	21		CODE

apache/druid

Open-Source Code Quality, Security and Technical Debt Review