2.2

Adjusted Signal

2.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

8.3K

Stars

Java

Language

868.4K

Lines of Code

3.5K

Files

326

Pattern Hits

2026-10-31

Scan Date

0.04

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 147 finding(s).

Hallucinated Dependency & Supply Chain Risk 8.7/100 · LOW

Are imports declared and package/API names verified? 138 finding(s).

Agent Over-Engineering Ratio 0.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 41 finding(s).

PR Review Velocity Impact 9.4/100 · LOW

Which changes need focused human review? 326 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 138HIGH 6MEDIUM 55LOW 127

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 326 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators138 hits · 1585 pts

Severity	File	Line	Snippet	Context
CRITICAL⚡	webapps/docs/manager-howto.xml	978	at org.apache.tomcat.util.Diagnostics.getThreadDump(Diagnostics.java:440)	CODE
CRITICAL⚡	webapps/docs/manager-howto.xml	979	at org.apache.tomcat.util.Diagnostics.getThreadDump(Diagnostics.java:409)	CODE
CRITICAL⚡	webapps/docs/manager-howto.xml	980	at org.apache.catalina.manager.ManagerServlet.threadDump(ManagerServlet.java:557)	CODE
CRITICAL⚡	webapps/docs/manager-howto.xml	981	at org.apache.catalina.manager.ManagerServlet.doGet(ManagerServlet.java:371)	CODE
CRITICAL	webapps/docs/config/cluster-interceptor.xml	217	The report is logged to the <code>org.apache.juli.logging.LogFactory.getLog(ThroughputInterceptor.class)</code>	CODE
CRITICAL	webapps/docs/config/cluster-membership.xml	135	The <code>org.apache.catalina.tribes.Member.getDomain()</code> method returns the value specified here.	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	110	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	117	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	129	because o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	151	return null because o.a.t.util.buf.MessageBytes.toString() can return NULL	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	167	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	190	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	459	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	821	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	828	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	850	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	863	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	res/spotbugs/filter-false-positives.xml	1454	o.a.t.util.buf.MessageBytes.toString() can return NULL -->	CODE
CRITICAL	test/org/apache/juli/TestDateFormatCache.java	31	// org.apache.catalina.valves.TestAccessLogValve.testBug54044()	COMMENT
CRITICAL	test/org/apache/juli/TestFileHandlerNonRotatable.java	42	URLDecoder.decode(configLoggingPath, java.nio.charset.StandardCharsets.UTF_8.toString()));	CODE
CRITICAL	…che/catalina/valves/TestLoadBalancerDrainingValve.java	139	.andStubReturn(org.apache.juli.logging.LogFactory.getLog(LoadBalancerDrainingValve.class));	CODE
CRITICAL	…/org/apache/catalina/startup/TestTomcatStandalone.java	164	org.apache.catalina.startup.VersionLoggerListener.class.getName())) {	CODE
CRITICAL	…t/org/apache/catalina/storeconfig/TestStoreConfig.java	64	org.apache.tomcat.util.descriptor.web.ContextResource tc_ContextResource_12 = new org.apache.tomcat.util.descrip	CODE
CRITICAL	…t/org/apache/catalina/storeconfig/TestStoreConfig.java	89	org.apache.tomcat.util.net.SSLHostConfig tc_SSLHostConfig_22 = new org.apache.tomcat.util.net.SSLHostConfig();	CODE
CRITICAL	…t/org/apache/catalina/storeconfig/TestStoreConfig.java	94	new org.apache.tomcat.util.net.SSLHostConfigCertificate(tc_SSLHostConfig_22,	CODE
CRITICAL⚡	…t/org/apache/catalina/storeconfig/TestStoreConfig.java	108	org.apache.catalina.ha.tcp.SimpleTcpCluster tc_SimpleTcpCluster_51 = new org.apache.catalina.ha.tcp.SimpleTcpClu	CODE
CRITICAL⚡	…t/org/apache/catalina/storeconfig/TestStoreConfig.java	110	org.apache.catalina.tribes.group.GroupChannel tc_GroupChannel_52 = new org.apache.catalina.tribes.group.GroupCha	CODE
CRITICAL⚡	…t/org/apache/catalina/storeconfig/TestStoreConfig.java	114	new org.apache.catalina.tribes.membership.cloud.CloudMembershipService();	CODE
CRITICAL	…catalina/session/TestPersistentManagerIntegration.java	63	// Wait until o.a.c.connector.Request.recycle() completes,	COMMENT
CRITICAL	…e/catalina/session/TestPersistentManagerFileStore.java	59	// Wait until o.a.c.connector.Request.recycle() completes,	COMMENT
CRITICAL	…lina/session/TestPersistentManagerDataSourceStore.java	75	// Wait until o.a.c.connector.Request.recycle() completes,	COMMENT
CRITICAL	…rg/apache/coyote/http2/TestHttp2InitialConnection.java	133	int len = 196 + org.apache.catalina.util.TomcatCSS.TOMCAT_CSS.getBytes(StandardCharsets.UTF_8).length +	CODE
CRITICAL	…e/jasper/compiler/TesterNonstandardTagPerformance.java	70	// org.apache.taglibs.standard.tag.rt.core.SetTag _jspx_th_c_005fset_005f39 = new org.apache.taglibs.standard.tag	COMMENT
CRITICAL	…e/jasper/compiler/TesterNonstandardTagPerformance.java	88	// org.apache.jasper.runtime.JspRuntimeLibrary.releaseTag(_jspx_th_c_005fset_005f39,	COMMENT
CRITICAL	java/org/apache/catalina/core/StandardServer.java	411	utilityExecutorWrapper = new org.apache.tomcat.util.threads.ScheduledThreadPoolExecutor(utilityExecutor);	CODE
CRITICAL	java/org/apache/catalina/core/ApplicationContext.java	373	String uriToMap = org.apache.catalina.util.RequestUtil.stripPathParams(uri, null);	CODE
CRITICAL	java/org/apache/catalina/core/StandardWrapper.java	426	if (!jakarta.servlet.http.HttpServlet.class.isAssignableFrom(servletClazz)) {	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	129	if (org.apache.tomcat.jni.AprStatus.isInstanceCreated()) {	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	130	Lock writeLock = org.apache.tomcat.jni.AprStatus.getStatusLock().writeLock();	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	138	return org.apache.tomcat.jni.AprStatus.isAprAvailable();	CODE
CRITICAL	java/org/apache/catalina/core/AprLifecycleListener.java	234	org.apache.tomcat.jni.AprStatus.setInstanceCreated(true);	CODE
CRITICAL	java/org/apache/catalina/core/AprLifecycleListener.java	248	Lock writeLock = org.apache.tomcat.jni.AprStatus.getStatusLock().writeLock();	CODE
CRITICAL	java/org/apache/catalina/core/AprLifecycleListener.java	264	if (org.apache.tomcat.jni.AprStatus.isAprAvailable()) {	CODE
CRITICAL	java/org/apache/catalina/core/AprLifecycleListener.java	284	Lock writeLock = org.apache.tomcat.jni.AprStatus.getStatusLock().writeLock();	CODE
CRITICAL	java/org/apache/catalina/core/AprLifecycleListener.java	295	if (!org.apache.tomcat.jni.AprStatus.isAprAvailable()) {	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	313	org.apache.tomcat.jni.AprStatus.setAprInitialized(false);	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	314	org.apache.tomcat.jni.AprStatus.setAprAvailable(false);	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	323	if (org.apache.tomcat.jni.AprStatus.isAprInitialized()) {	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	326	org.apache.tomcat.jni.AprStatus.setAprInitialized(true);	CODE
CRITICAL	java/org/apache/catalina/core/AprLifecycleListener.java	406	org.apache.tomcat.jni.AprStatus.setAprAvailable(true);	CODE
CRITICAL	java/org/apache/catalina/core/AprLifecycleListener.java	436	org.apache.tomcat.jni.AprStatus.setOpenSSLVersion(SSL.version());	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	616	if (useOpenSSL != org.apache.tomcat.jni.AprStatus.getUseOpenSSL()) {	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	617	org.apache.tomcat.jni.AprStatus.setUseOpenSSL(useOpenSSL);	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	627	return org.apache.tomcat.jni.AprStatus.getUseOpenSSL();	CODE
CRITICAL⚡	java/org/apache/catalina/core/AprLifecycleListener.java	636	return org.apache.tomcat.jni.AprStatus.isInstanceCreated();	CODE
CRITICAL	…org/apache/catalina/valves/AbstractAccessLogValve.java	2090	if (org.apache.coyote.http11.Constants.CLOSE.equalsIgnoreCase(connStatus)) {	CODE
CRITICAL	…a/org/apache/catalina/valves/rewrite/RewriteValve.java	589	org.apache.catalina.util.RequestUtil.stripPathParams(urlStringRewriteEncoded, request);	CODE
CRITICAL	java/org/apache/catalina/util/RateLimiterBase.java	153	.getAttribute(org.apache.tomcat.util.threads.ScheduledThreadPoolExecutor.class.getName());	CODE
CRITICAL	java/org/apache/catalina/util/RequestUtil.java	162	urlPath = org.apache.tomcat.util.http.RequestUtil.normalize(urlPath);	CODE
CRITICAL	…tribes/group/interceptors/DomainFilterInterceptor.java	179	setDomain(org.apache.catalina.tribes.util.Arrays.fromString(domain));	CODE
78 more matches not shown…

Over-Commented Block119 hits · 118 pts

Severity	File	Line	Snippet	Context
LOW	build.xml	3061	# Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	build.xml	3081		COMMENT
LOW	build.xml	3101	# Java Name: ${java.vm.name}	COMMENT
LOW	build.xml	3121	# the License. You may obtain a copy of the License at	COMMENT
LOW	…amples/WEB-INF/classes/websocket/drawboard/Client.java	101	\|\| messagesToSendLength >= 1000000) {	COMMENT
LOW	res/scripts/check-mime.pl	1	#!/usr/bin/perl	COMMENT
LOW	res/scripts/check-mime.pl	21	# -----------------------------------------------------------------------------	COMMENT
LOW	res/scripts/check-mime.pl	41	# new web.xml. If you want to keep their Tomcat definition, add them	COMMENT
LOW	res/openssl/addlicense.sh	1	#!/bin/sh	COMMENT
LOW	res/openssl/openssl.h	21	#include <openssl/pem.h>	COMMENT
LOW	res/graal/graal-measure.sh	1	#!/bin/bash	COMMENT
LOW	res/graal/build-tomcat-native-image.sh	1	#!/bin/bash	COMMENT
LOW	test/org/apache/catalina/connector/test_content.txt	1	# Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	test/org/apache/catalina/startup/service-config.txt	1	# Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	…org/apache/tomcat/util/net/generate-longchain-certs.sh	1	# Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	test/org/apache/coyote/http2/TestHttp2Section_5_1.java	481	// Do this before sending the requests to ensure the connection window	COMMENT
LOW	test/org/apache/coyote/http2/TestCancelledUpload.java	61	}	COMMENT
LOW	test/org/apache/coyote/http2/TestHttp2Limits.java	281	break;	COMMENT
LOW	test/org/apache/coyote/http2/TestHttp2Security.java	81		COMMENT
LOW	test/org/apache/coyote/http2/TestHttp2Security.java	101	// This ordering matters: Stream.close() -> Stream.replace() swaps the	COMMENT
LOW	…st/org/apache/jasper/compiler/TestAttributeParser.java	121		COMMENT
LOW	…e/jasper/compiler/TesterNonstandardTagPerformance.java	61	* @param _jspx_page_context page context	COMMENT
LOW	test/webapp/bug5nnnn/bug57601.txt	1	# Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	test/webresources/dir2/d1/.ignore-me.txt	1	# -----------------------------------------------------------------------------	COMMENT
LOW	test/webresources/dir2/d2/.ignore-me.txt	1	# -----------------------------------------------------------------------------	COMMENT
LOW	test/webresources/dir3/.ignore-me.txt	1	# -----------------------------------------------------------------------------	COMMENT
LOW	test/conf/TesterRewriteMapB.txt	1	# -----------------------------------------------------------------------------	COMMENT
LOW	test/conf/TesterRewriteMapC.txt	1	# -----------------------------------------------------------------------------	COMMENT
LOW	bin/catalina.sh	1	#!/bin/sh	COMMENT
LOW	bin/catalina.sh	21	# For supported commands call "catalina.sh help" or see the usage section at	COMMENT
LOW	bin/catalina.sh	41	# process. If CATALINA_OUT_CMD is set, the value of	COMMENT
LOW	bin/catalina.sh	61	# JRE_HOME Must point at your Java Runtime installation.	COMMENT
LOW	bin/catalina.sh	81	#	COMMENT
LOW	bin/catalina.sh	101	#	COMMENT
LOW	bin/configtest.sh	1	#!/bin/sh	COMMENT
LOW	bin/makebase.sh	1	#!/bin/sh	COMMENT
LOW	bin/daemon.sh	1	#!/bin/sh	COMMENT
LOW	bin/migrate.sh	1	#!/bin/sh	COMMENT
LOW	bin/tool-wrapper.sh	1	#!/bin/sh	COMMENT
LOW	bin/tool-wrapper.sh	21	# Environment Variable Prerequisites	COMMENT
LOW	bin/setclasspath.sh	1	#!/bin/sh	COMMENT
LOW	bin/startup.sh	1	#!/bin/sh	COMMENT
LOW	bin/digest.sh	1	#!/bin/sh	COMMENT
LOW	bin/ciphers.sh	1	#!/bin/sh	COMMENT
LOW	bin/version.sh	1	#!/bin/sh	COMMENT
LOW	bin/shutdown.sh	1	#!/bin/sh	COMMENT
LOW	java/org/apache/catalina/filters/CorsFilter.java	381	// CORS requests (SIMPLE, ACTUAL, PRE_FLIGHT) set the following headers	COMMENT
LOW	…/apache/catalina/tribes/transport/nio/NioReceiver.java	561	socketTimeouts();	COMMENT
LOW	java/org/apache/catalina/tribes/util/StringManager.java	121	// bad: shouldn't mask an exception the following way:	COMMENT
LOW	…/org/apache/catalina/tribes/membership/MemberImpl.java	221	long alive = System.currentTimeMillis() - getServiceStartTime();	COMMENT
LOW	…che/catalina/webresources/AbstractFileResourceSet.java	161	if (!canPath.isEmpty() && canPath.charAt(0) != File.separatorChar) {	COMMENT
LOW	java/org/apache/catalina/webresources/Cache.java	141	} else {	COMMENT
LOW	java/org/apache/catalina/connector/InputBuffer.java	281	}	COMMENT
LOW	java/org/apache/catalina/connector/CoyoteAdapter.java	701		COMMENT
LOW	…a/org/apache/catalina/startup/WebappServiceLoader.java	121		COMMENT
LOW	java/org/apache/catalina/startup/HostConfig.java	1241	// The migrated application is in place. The previous application, if one was	COMMENT
LOW	java/org/apache/tomcat/websocket/Util.java	481	// extension-list = 1#extension	COMMENT
LOW	java/org/apache/tomcat/websocket/PerMessageDeflate.java	621	// Output and start new compressed part.	COMMENT
LOW	java/org/apache/tomcat/websocket/WsSession.java	901	// There is a small timing window that means the Future may have been	COMMENT
LOW	java/org/apache/tomcat/util/Diagnostics.java	21	// (http://docs.oracle.com/javase/7/docs/jre/api/management/extension/index.html)	COMMENT
59 more matches not shown…

Decorative Section Separators38 hits · 112 pts

Severity	File	Line	Snippet	Context
MEDIUM	build.xml	3060	<echo file="build.properties.release"># ----------------------------------------------------------------------------	CODE
MEDIUM	build.xml	3075	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	build.xml	3115	<echo file="res/maven/mvn.properties.release"># --------------------------------------------------------------------	CODE
MEDIUM	build.xml	3130	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	res/scripts/check-mime.pl	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	res/scripts/check-mime.pl	21	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/webresources/dir2/d1/.ignore-me.txt	1	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/webresources/dir2/d1/.ignore-me.txt	16	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/webresources/dir2/d2/.ignore-me.txt	1	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/webresources/dir2/d2/.ignore-me.txt	16	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/webresources/dir3/.ignore-me.txt	1	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/webresources/dir3/.ignore-me.txt	16	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/conf/TesterRewriteMapB.txt	1	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/conf/TesterRewriteMapB.txt	16	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/conf/TesterRewriteMapC.txt	1	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	test/conf/TesterRewriteMapC.txt	16	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/catalina.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/catalina.sh	112	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/configtest.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/configtest.sh	20	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/daemon.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/daemon.sh	20	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/migrate.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/migrate.sh	20	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/tool-wrapper.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/tool-wrapper.sh	35	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/setclasspath.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/setclasspath.sh	21	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/startup.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/startup.sh	20	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/digest.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/digest.sh	20	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/ciphers.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/ciphers.sh	20	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/version.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/version.sh	20	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/shutdown.sh	18	# -----------------------------------------------------------------------------	COMMENT
MEDIUM	bin/shutdown.sh	20	# -----------------------------------------------------------------------------	COMMENT

Self-Referential Comments7 hits · 30 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	webapps/docs/realm-howto.xml	638	# Define an entry to contain people	COMMENT
MEDIUM⚡	webapps/docs/realm-howto.xml	644	# Define a user entry for Janet Jones	COMMENT
MEDIUM⚡	webapps/docs/realm-howto.xml	653	# Define a user entry for Fred Bloggs	COMMENT
MEDIUM⚡	webapps/docs/realm-howto.xml	662	# Define an entry to contain LDAP groups	COMMENT
MEDIUM⚡	webapps/docs/realm-howto.xml	668	# Define an entry for the "tomcat" role	COMMENT
MEDIUM⚡	webapps/docs/realm-howto.xml	675	# Define an entry for the "role1" role	COMMENT
MEDIUM	bin/catalina.sh	221	# Define the java.io.tmpdir to use for Catalina	COMMENT

Synthetic Comment Markers3 hits · 22 pts

Severity	File	Line	Snippet	Context
HIGH	…/apache/tomcat/security/TestSecurity2026WebSocket.java	91	* Generated by Claude Code with Sonnet 5.	COMMENT
HIGH	test/org/apache/coyote/http2/TestHttp2Security.java	76	* Generated by Claude Code with Sonnet 5	COMMENT
HIGH	test/org/apache/coyote/http2/TestHttp2Security.java	243	* Generated by Claude Code with Sonnet 5	COMMENT

Slop Phrases11 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	webapps/docs/realm-howto.xml	521	the repository for user information as discussed above).	CODE
MEDIUM	webapps/docs/realm-howto.xml	757	<p>However, as discussed above, the default bind mode for	CODE
LOW	webapps/docs/jndi-datasource-examples-howto.xml	213	<p>Before you proceed, don't forget to copy the JDBC Driver's jar into <code>$CATALINA_HOME/lib</code>.</p>	CODE
LOW	webapps/docs/jndi-datasource-examples-howto.xml	337	project — just make sure you get a 1.1.x or later release. Once you have	CODE
LOW	webapps/docs/config/cluster.xml	195	Enable this flag don't forget to disable the channel heartbeat thread.	CODE
MEDIUM	webapps/docs/appdev/source.xml	167	<p>As mentioned earlier, it is highly recommended that you place all of the	CODE
LOW	webapps/docs/appdev/processes.xml	176	Whenever you create a new file, don't forget to add it to the source code	CODE
MEDIUM	java/org/apache/catalina/filters/ExpiresFilter.java	72	* <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9" >RFC 2616 section 14.9</a>), you can use	COMMENT
LOW	java/org/apache/catalina/servlets/WebdavServlet.java	154	* Don't forget to secure access appropriately to the editing URLs, especially if allowSpecialPaths is used. With the	COMMENT
MEDIUM	modules/jdbc-pool/doc/jdbc-pool.xml	823	<p>Here is a simple example of how to create and use a data source.</p>	CODE
LOW	modules/jdbc-pool/doc/jdbc-pool.xml	990	When overriding these methods, don't forget to call super if you are extending a class other than <code>JdbcInter	CODE

AI Slop Vocabulary5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	java/org/apache/tomcat/util/net/IPv6Utils.java	64	// Definitely not an IPv6, return untouched input.	COMMENT
MEDIUM	java/org/apache/tomcat/buildutil/translate/Import.java	49	// Not robust but good enough	COMMENT
MEDIUM	java/org/apache/el/parser/AstLambdaParameters.java	28	// Purely for debug purposes. May not be complete or correct. Certainly	COMMENT
MEDIUM	java/org/apache/el/parser/AstMethodParameters.java	45	// Purely for debug purposes. May not be complete or correct. Certainly	COMMENT
MEDIUM	java/org/apache/el/parser/AstLambdaExpression.java	136	// Purely for debug purposes. May not be complete or correct. Certainly	COMMENT

Cross-File Repetition3 hits · 15 pts

Severity	File	Snippet	Context
HIGH	…/tomcat/integration/httpd/TestSSLValveWithProxy01.java	loadmodule proxy_module modules/mod_proxy.so loadmodule proxy_http_module modules/mod_proxy_http.so loadmodule headers_m	STRING
HIGH	…che/tomcat/integration/httpd/TestFullReverseProxy.java	loadmodule proxy_module modules/mod_proxy.so loadmodule proxy_http_module modules/mod_proxy_http.so loadmodule headers_m	STRING
HIGH	…/tomcat/integration/httpd/TestSSLValveWithProxy02.java	loadmodule proxy_module modules/mod_proxy.so loadmodule proxy_http_module modules/mod_proxy_http.so loadmodule headers_m	STRING

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	bin/daemon.sh	92	# Set JAVA_HOME to working JDK or JRE	COMMENT

Structural Annotation Overuse1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…va/org/apache/tomcat/util/http/fileupload/IOUtils.java	63	// NOTE: This class is focused on InputStream, OutputStream, Reader and	COMMENT

apache/tomcat

Open-Source Code Quality, Security and Technical Debt Review