1.8

Adjusted Signal

1.8

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

11.4K

Stars

Java

Language

868.6K

Lines of Code

11.3K

Files

1.1K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 577 finding(s).

Hallucinated Dependency & Supply Chain Risk 5.5/100 · LOW

Are imports declared and package/API names verified? 541 finding(s).

Agent Over-Engineering Ratio 2.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 431 finding(s).

PR Review Velocity Impact 8.2/100 · LOW

Which changes need focused human review? 1118 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 38HIGH 0MEDIUM 10LOW 1070

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1118 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Fake / Example Data499 hits · 518 pts

Severity	File	Line	Snippet	Context
LOW⚡	…s/notifications/DefaultCommunicationsManagerTests.java	49	props.setFrom("cas@example.org");	CODE
LOW⚡	…s/notifications/DefaultCommunicationsManagerTests.java	50	props.setCc(List.of("cc@example.org"));	CODE
LOW⚡	…s/notifications/DefaultCommunicationsManagerTests.java	51	props.setBcc(List.of("bcc@example.org"));	CODE
LOW⚡	…s/notifications/DefaultCommunicationsManagerTests.java	52	props.setReplyTo("bcc1@example.org");	CODE
LOW⚡	…s/notifications/DefaultCommunicationsManagerTests.java	59	when(p.getAttributes()).thenReturn(CollectionUtils.wrap("email", List.of("cas@example.org")));	CODE
LOW	…s/notifications/DefaultCommunicationsManagerTests.java	70	props.setFrom("cas@example.org");	CODE
LOW	…s/notifications/DefaultCommunicationsManagerTests.java	74	.to(List.of("sample@example.org")).body(body).build();	CODE
LOW	…s/notifications/DefaultCommunicationsManagerTests.java	88	props.setFrom("cas@example.org");	CODE
LOW	…s/notifications/DefaultCommunicationsManagerTests.java	93	.to(List.of("sample@example.org")).body(body).build();	CODE
LOW	…eo/cas/notifications/mail/DefaultEmailSenderTests.java	87	.emailProperties(new EmailProperties().setSubject("Hello ${name}").setFrom("cas@example.org"))	CODE
LOW	…eo/cas/notifications/mail/DefaultEmailSenderTests.java	90	.to(List.of("casuser@example.org"))	CODE
LOW	…eo/cas/authentication/CoreAuthenticationTestUtils.java	105	attributes.put("mail", CollectionUtils.wrap(CONST_USERNAME + "@example.org"));	CODE
LOW	…ntication/DefaultAuthenticationResultBuilderTests.java	94	CollectionUtils.wrap("email", "cas@example.org",	CODE
LOW	…src/test/java/org/apereo/cas/util/RegexUtilsTests.java	55	assertTrue(RegexUtils.createPattern(pattern).matcher("something@example.org").find());	CODE
LOW	…as/util/gen/ChainingPrincipalNameTransformerTests.java	24	t.addTransformer(new RegexPrincipalNameTransformer("(.+)@example.org"));	CODE
LOW	…as/util/gen/ChainingPrincipalNameTransformerTests.java	27	val uid = t.transform("casuser@example.org");	CODE
LOW	…java/org/apereo/cas/ticket/TicketSerializersTests.java	45	val principal = RegisteredServiceTestUtils.getPrincipal("casuser", CollectionUtils.wrap("email", List.of("casuse	CODE
LOW	…n/support/DefaultCasProtocolAttributeEncoderTests.java	94	attributes.put("_MAIL_", "casuser@example.org");	CODE
LOW	…/services/ReturnMappedAttributeReleasePolicyTests.java	185	principalAttributes.put("email", List.of("user@example.org"));	CODE
LOW	…/services/ReturnMappedAttributeReleasePolicyTests.java	195	assertEquals(List.of("user@example.org"), result.get(mappedAttribute));	CODE
LOW	…r/BaseSimpleMultifactorAuthenticationTriggerTests.java	66	when(principal.getAttributes()).thenReturn(Map.of("email", List.of("casuser@example.org")));	CODE
LOW	…teredServiceMultifactorAuthenticationTriggerTests.java	48	when(policy.getPrincipalAttributeValueToMatch()).thenReturn("@example.org");	CODE
LOW	…redServiceAttributeReleaseActivationCriteriaTests.java	96	criteria.setRequiredAttributes(Map.of("memberOf", List.of("ad.+\|sys.+"), "mail", List.of(".+@example.org")));	CODE
LOW	…rg/apereo/cas/services/RegisteredServiceTestUtils.java	451	"mail", "groovy { return attributes['sAMAccountName'][0] + '@example.org'}")));	CODE
LOW	…enPolicyAgentRegisteredServiceAccessStrategyTests.java	59	principalAttributes.put("email", List.of("user@example.org"));	CODE
LOW	…ces/DefaultRegisteredServiceUsernameProviderTests.java	76	val principal = RegisteredServiceTestUtils.getPrincipal("casuser@example.org");	CODE
LOW	…cas/services/RegisteredServicesEventListenerTests.java	64	"cas.service-registry.mail.from=admin@example.org",	CODE
LOW	…cas/services/RegisteredServicesEventListenerTests.java	105	contact.setEmail("casuser@example.org");	CODE
LOW	…cas/services/RegisteredServicesEventListenerTests.java	117	contact.setEmail("casuser@example.org");	CODE
LOW	…alAttributeRegisteredServiceUsernameProviderTests.java	57	principalAttributes.put("email", List.of("user@example.org"));	CODE
LOW	…alAttributeRegisteredServiceUsernameProviderTests.java	67	assertEquals("user@example.org", id);	CODE
LOW	…/apereo/cas/services/AbstractServiceRegistryTests.java	628	contact.setEmail("cas@example.org");	CODE
LOW	…til/transforms/RegexPrincipalNameTransformerTests.java	22	val result = chain.transform("cas@example.org");	CODE
LOW	…il/transforms/GroovyPrincipalNameTransformerTests.java	23	val result = chain.transform("cas@example.org");	CODE
LOW	…narios/interrupt-afterauthn-login-saml-idp/script.json	20	"--cas.authn.attribute-repository.stub.attributes.mail=casuser@example.org",	CODE
LOW	…r/scenarios/service-registry-import-export/script.json	11	"--cas.authn.attribute-repository.stub.attributes.mail=casuser@example.org",	CODE
LOW	…teer/scenarios/forgot-password-stateless/accounts.json	3	"email" : "casuser@example.org",	CODE
LOW	…-login-saml2-sp-oidc-idp-selection-discovery/script.js	44	await cas.type(page, "#username", "casuser@example.org");	CODE
LOW	…enarios/pm-must-change-password-generic/passwords.json	3	"email" : "mustchangepswd@example.org",	CODE
LOW	…/scenarios/oidc-client-registration-expiring/script.js	10	"contacts": ["cas@example.org"],	CODE
LOW	…/scenarios/oidc-client-registration-expiring/script.js	36	"contacts": ["cas@example.org", "new@example.org"],	CODE
LOW	…s/puppeteer/scenarios/surrogate-auto-login/script.json	13	"--cas.authn.attribute-repository.stub.attributes.mail=casuser@example.org",	CODE
LOW	…teer/scenarios/oidc-clientcredentials-x509/script.json	16	"--cas.authn.attribute-repository.stub.attributes.mail=casuser@example.org",	CODE
LOW	…s/puppeteer/scenarios/passwordless-login/accounts.json	6	"email": "cas@example.org",	CODE
LOW	…uppeteer/scenarios/simple-mfa-login-locale/script.json	22	"--cas.authn.attribute-repository.stub.attributes.mail=casuser@example.org",	CODE
LOW	…s/puppeteer/scenarios/surrogate-login-jdbc/script.json	16	"--cas.authn.attribute-repository.stub.attributes.mail=casuser@example.org",	CODE
LOW	…puppeteer/scenarios/rest-protocol-services/script.json	10	"--cas.rest.services.attribute-value=.*@example.org",	CODE
LOW	…puppeteer/scenarios/rest-protocol-services/script.json	11	"--cas.authn.attribute-repository.stub.attributes.mail=casuser@example.org"	CODE
LOW	…/tests/puppeteer/scenarios/wsfed-idp-login/script.json	6	"--cas.authn.attribute-repository.stub.attributes.email=casuser@example.org",	CODE
LOW	ci/tests/puppeteer/scenarios/wsfed-idp-login/script.js	21	await cas.assertInnerText(page, "#claim0", "http://schemas.xmlsoap.org/claims/EmailAddress:casuser@example.org")	CODE
LOW	ci/tests/puppeteer/scenarios/wsfed-idp-login/script.js	23	await cas.assertInnerText(page, "#claim2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress:C	CODE
LOW	ci/tests/puppeteer/scenarios/wsfed-idp-login/script.js	38	await cas.assertInnerText(page, "#claim0", "http://schemas.xmlsoap.org/claims/EmailAddress:casuser@example.org")	CODE
LOW	ci/tests/puppeteer/scenarios/wsfed-idp-login/script.js	40	await cas.assertInnerText(page, "#claim2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress:C	CODE
LOW	…eteer/scenarios/wsfed-idp-login/services/Sample-1.json	12	"EMAIL_ADDRESS_2005" : "groovy { return attributes['cn'].get(0) + '@example.org' }"	CODE
LOW	…ppeteer/scenarios/oidc-authzcode-claim-sub/script.json	13	"--cas.authn.attribute-repository.stub.attributes.mail=cas@example.org",	CODE
LOW	…ppeteer/scenarios/oidc-discovery-webfinger/script.json	13	"--cas.authn.attribute-repository.stub.attributes.email=cas@example.org",	CODE
LOW	…puppeteer/scenarios/oidc-discovery-webfinger/script.js	18	const resource2 = "okta:acct:joe.stormtrooper@example.org";	CODE
LOW⚡	…narios/passwordless-login-user-selection/accounts.json	23	"email": "casuser@example.org"	CODE
LOW⚡	…narios/passwordless-login-user-selection/accounts.json	30	"email": "casuser@example.org",	CODE
LOW⚡	…narios/passwordless-login-user-selection/accounts.json	35	"email": [ "java.util.ArrayList", [ "casuser@example.org" ] ]	CODE
439 more matches not shown…

Hallucination Indicators38 hits · 458 pts

Severity	File	Line	Snippet	Context
CRITICAL	…s/web/support/gen/CookieRetrievingCookieGenerator.java	111	var cookie = org.springframework.web.util.WebUtils.getCookie(request, Objects.requireNonNull(getCookieName()	CODE
CRITICAL	…cenarios/sso-access-per-service/services/Sample-2.json	15	"randomNumber" : "groovy { return org.apereo.cas.util.RandomUtils.generateSecureRandomId() }"	CODE
CRITICAL	…cenarios/sso-access-per-service/services/Sample-1.json	15	"randomNumber" : "groovy { return org.apereo.cas.util.RandomUtils.generateSecureRandomId() }"	CODE
CRITICAL⚡	…er-documentation/installation/Troubleshooting-Guide.md	167	at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)	CODE
CRITICAL⚡	…er-documentation/installation/Troubleshooting-Guide.md	168	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)	CODE
CRITICAL⚡	…er-documentation/installation/Troubleshooting-Guide.md	169	at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)	CODE
CRITICAL⚡	…er-documentation/installation/Troubleshooting-Guide.md	170	at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)	CODE
CRITICAL⚡	…er-documentation/installation/Troubleshooting-Guide.md	171	at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)	CODE
CRITICAL	…er-documentation/installation/Troubleshooting-Guide.md	202	org.apereo.cas.client.validation.Saml11TicketValidator.retrieveResponseFromServer(Saml11TicketValidator.java:203)	CODE
CRITICAL	…er-documentation/installation/Troubleshooting-Guide.md	203	org.apereo.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:185)	CODE
CRITICAL	…-documentation/authentication/SPNEGO-Authentication.md	234	at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source)	CODE
CRITICAL	…org/apereo/cas/config/CasJpaUtilAutoConfiguration.java	52	com.mysql.cj.jdbc.Driver.class.getName(),	CODE
CRITICAL	…org/apereo/cas/config/CasJpaUtilAutoConfiguration.java	55	org.mariadb.jdbc.Driver.class.getName()	CODE
CRITICAL	…ereo/cas/heimdall/HeimdallAuthorizationController.java	89	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…ereo/cas/heimdall/HeimdallAuthorizationController.java	136	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…ereo/cas/heimdall/HeimdallAuthorizationController.java	182	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…apereo/cas/heimdall/HeimdallAuthorizationEndpoint.java	113	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…/org/apereo/cas/config/CasJaversAutoConfiguration.java	99	@Pointcut("execution(* org.apereo.cas.services.ServicesManager.save(..))")	CODE
CRITICAL	…meleaf/src/main/resources/static/js/palantir-system.js	94	const originalLabels = Chart.defaults.plugins.legend.labels.generateLabels(chart);	CODE
CRITICAL⚡	…hymeleaf/src/main/resources/static/js/inwebo/client.js	3	o=(h[2]\|\|"").split(".").sort(),n){for(l=oa.event.special[n]\|\|{},m=i[n=(d?l.delegateType:l.bindType)\|\|n]\|\|[],h=h[	CODE
CRITICAL⚡	…hymeleaf/src/main/resources/static/js/inwebo/client.js	4	if(v="abort",r.add(n.complete),w.done(n.success),w.fail(n.error),d=Y(Kb,n,b,w)){if(w.readyState=1,k&&p.trigger("	CODE
CRITICAL⚡	…hymeleaf/src/main/resources/static/js/inwebo/client.js	5	this.options.axis&&"x"===this.options.axis\|\|(this.helper[0].style.top=this.position.top+"px"),a.ui.ddmanager&&a.ui.d	CODE
CRITICAL⚡	…c/main/resources/templates/consent/casConsentView.html	176	#{screen.consent.options.desc.attributevalue.first(${service.id})} +	COMMENT
CRITICAL⚡	…c/main/resources/templates/consent/casConsentView.html	178	#{screen.consent.options.desc.attributevalue.second(${service.id})} +	COMMENT
CRITICAL⚡	…c/main/resources/templates/consent/casConsentView.html	180	#{screen.consent.options.desc.attributevalue.third(${service.id})} +	COMMENT
CRITICAL	…apereo/cas/support/rest/RegisteredServiceResource.java	72	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…/cas/config/CasJpaTicketRegistryAutoConfiguration.java	234	val repo = new org.springframework.integration.jdbc.lock.DefaultLockRepository(dataSourceTicket);	CODE
CRITICAL	…g/OidcDynamicClientRegistrationEndpointController.java	60	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…dynareg/OidcClientConfigurationEndpointController.java	98	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…llers/jwks/OidcJwksRegistrationEndpointController.java	70	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…IdPDelegatedClientAuthenticationRequestCustomizer.java	137	if (org.apache.commons.lang3.StringUtils.isBlank(identityProviderEntityId)) {	CODE
CRITICAL	…dp/metadata/SamlRegisteredServiceMetadataEndpoint.java	216	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(required = true,	CODE
CRITICAL	…va/org/apereo/cas/webauthn/web/WebAuthnController.java	123	requestBody = @io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…shell/commands/util/ValidateLdapConnectionCommand.java	132	if (org.apache.commons.lang3.StringUtils.isNotBlank(userPassword)) {	CODE
CRITICAL	…thn/web/flow/WebAuthnMultifactorWebflowConfigurer.java	99	val appId = org.apache.commons.lang3.StringUtils.defaultIfBlank(webAuthn.getCore().getApplicationId(), casPr	CODE
CRITICAL	…dpoints/OAuth20AccessTokenEndpointControllerTests.java	773	assertEquals(org.springframework.http.HttpStatus.FOUND.value(), devResponse.getStatus());	CODE
CRITICAL	…/cas/adaptors/duo/web/DuoSecurityAdminApiEndpoint.java	129	@io.swagger.v3.oas.annotations.parameters.RequestBody(	CODE
CRITICAL	…eo/cas/config/CasSpringBootAdminAutoConfiguration.java	85	val nettyHttpClient = reactor.netty.http.client.HttpClient.create()	CODE

Hyper-Verbose Identifiers431 hits · 418 pts

Severity	File	Line	Snippet	Context
LOW	…s/throttle/DefaultThrottledRequestResponseHandler.java	22	public class DefaultThrottledRequestResponseHandler implements ThrottledRequestResponseHandler {	CODE
LOW	ci/tests/puppeteer/run.sh	68	function downloadAndRunExternalTomcat() {	CODE
LOW	ci/tests/puppeteer/run.sh	853	function casServerArtifactForInstance() {	CODE
LOW	ci/tests/puppeteer/run.sh	868	function nativeFeatureModulesForInstance() {	CODE
LOW	ci/tests/puppeteer/run.sh	874	function dockerImageNameForInstance() {	CODE
LOW	…scenarios/redis-ticket-registry-idle-timeout/script.js	9	async function verifyTicketGrantingTicketCount(count = 0) {	CODE
LOW	…/scenarios/passwordless-login-user-selection/script.js	29	async function authenticateWithDelegation(browser) {	CODE
LOW	…/scenarios/passwordless-login-user-selection/script.js	53	async function authenticateWithPasswordlessToken(browser) {	CODE
LOW	…tests/puppeteer/scenarios/pm-account-profile/script.js	15	async function importMultifactorTrustedRecord() {	CODE
LOW	…tests/puppeteer/scenarios/pm-account-profile/script.js	50	async function removeMultifactorTrustedRecord(record) {	CODE
LOW	…tests/puppeteer/scenarios/pm-account-profile/script.js	54	async function verifyAccountManagementFlow(browser) {	CODE
LOW	…tests/puppeteer/scenarios/pm-account-profile/script.js	140	async function verifyPasswordManagementFlow(browser) {	CODE
LOW	ci/tests/puppeteer/scenarios/heimdall-authzen/script.js	203	async function verifyCallerAuthentication() {	CODE
LOW	…ppeteer/scenarios/pm-mfa-device-registration/script.js	6	async function registerGoogleAuthenticatorAccount() {	CODE
LOW	…ppeteer/scenarios/pm-mfa-device-registration/script.js	17	async function deleteGoogleAuthenticatorAccounts() {	CODE
LOW	…ppeteer/scenarios/pm-mfa-device-registration/script.js	21	async function passwordResetFlowMfaWithoutRegisteredDevice(browser) {	CODE
LOW	…teer/scenarios/surrogate-login-selection-duo/script.js	7	async function verifyImpersonationWithMfa(page) {	CODE
LOW	…teer/scenarios/surrogate-login-selection-duo/script.js	45	async function verifyNoImpersonationWithMfa(page) {	CODE
LOW	…sts/puppeteer/scenarios/oidc-authzcode-login/script.js	4	async function verifyAccessTokenIsLimited(context) {	CODE
LOW	…sts/puppeteer/scenarios/oidc-authzcode-login/script.js	43	async function verifyAccessTokenIsNeverReceived(context) {	CODE
LOW	…sts/puppeteer/scenarios/oidc-authzcode-login/script.js	75	async function verifyAccessTokenAndProfile(context) {	CODE
LOW	…sts/puppeteer/scenarios/oidc-authzcode-login/script.js	183	async function verifyMissingTicketGrantingCookie(context) {	CODE
LOW	…scenarios/oidc-verifiable-credentials-waltid/script.js	62	async function createVerifiableCredentialTransaction(credentialConfigurationIds) {	CODE
LOW	…scenarios/oidc-verifiable-credentials-waltid/script.js	84	async function startVerifiableCredentialFlowForConfiguration(wallet, ...configurationIds) {	CODE
LOW	…scenarios/oidc-verifiable-credentials-waltid/script.js	122	async function startVerifiableCredentialPresentationFlow(wallet, responseMode) {	CODE
LOW	…rios/cassandra-authn-ticket-service-registry/script.js	14	async function storedTicketGrantingTickets() {	CODE
LOW	…ts/puppeteer/scenarios/delegated-login-saml2/script.js	8	async function verifyNormalAuthenticationFlow(browser) {	CODE
LOW	…/tests/puppeteer/scenarios/oidc-login-jwt-at/script.js	62	async function verifyAccessTokenWithProfile(accessToken) {	CODE
LOW	…eteer/scenarios/passwordless-delegated-login/script.js	61	async function verifyPasswordlessAccountEndpoint() {	CODE
LOW	…r/scenarios/shibboleth-idp-service-selection/script.js	4	function getShibbolethUrlForEntityId(entityId) {	CODE
LOW	…uppeteer/scenarios/surrogate-login-selection/script.js	21	async function verifyImpersonationByPrincipalAttributes(browser) {	CODE
LOW	…uppeteer/scenarios/surrogate-login-selection/script.js	40	async function verifyImpersonationByPrincipalAttributesDisabled(browser) {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	174	async function exchangeAuthorizationCode(code) {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	228	async function assertTicketGrantingCookieSize(page) {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	243	async function verifyInterruptNotification(context) {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	276	async function verifyBlockedInterruptNotification(context) {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	301	async function verifySamlIdentityProviderWithOidc(context, username) {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	327	async function verifyDelegatedSamlIdentityProvider(context) {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	403	async function verifyUnhappyPathsOverHttp(jar, serviceTicket, oidc) {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	529	async function verifyExpiredServiceTickets() {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	561	async function verifyPushedAuthorizationRequest(context) {	CODE
LOW	…eer/scenarios/stateless-ticket-registry-load/script.js	587	async function verifySimpleMultifactorAuthentication(context, browser) {	CODE
LOW	…narios/mfa-duo-universal-login-storage-fails/script.js	4	async function makeBrowserStorageUnavailable(page) {	CODE
LOW	…narios/mfa-duo-universal-login-storage-fails/script.js	43	async function makeScriptCookiesUnavailable(page) {	CODE
LOW	…ests/puppeteer/scenarios/oidc-token-exchange/script.js	97	async function verifyTokenExchangeNativeSso() {	CODE
LOW	…eer/scenarios/mfa-webauthn-register-qr-login/script.js	7	async function verifyFlowUsingQRCodeButtonSameWindow() {	CODE
LOW	…uppeteer/scenarios/account-mgmt-registration/script.js	4	async function verifyAccountRegistrationWithOidcService() {	CODE
LOW	…uppeteer/scenarios/account-mgmt-registration/script.js	30	async function submitAccountRegistrationRequest(page, browser, checkAccessibility = false) {	CODE
LOW	…uppeteer/scenarios/account-mgmt-registration/script.js	84	async function verifyAccountRegistrationWithCasService() {	CODE
LOW	…enarios/pm-account-profile-mfa-trusteddevice/script.js	7	async function passwordResetFlowWithoutTrustedDevice(browser) {	CODE
LOW	…enarios/pm-account-profile-mfa-trusteddevice/script.js	58	async function passwordResetFlowWithTrustedDevice(browser) {	CODE
LOW	…enarios/pm-account-profile-mfa-trusteddevice/script.js	97	async function passwordResetFlowWithAccountProfileWithoutTrustedDevice(browser) {	CODE
LOW	…enarios/pm-account-profile-mfa-trusteddevice/script.js	129	async function passwordResetFlowWithAccountProfileWithTrustedDeviceIgnored(browser) {	CODE
LOW	…scenarios/redis-ticket-registry-loadbalanced/script.js	4	async function ensureNoSsoSessionsExistAfterLogout(page, port) {	CODE
LOW	…scenarios/redis-ticket-registry-loadbalanced/script.js	37	async function checkTicketValidationAcrossNodes(browser) {	CODE
LOW	…scenarios/redis-ticket-registry-loadbalanced/script.js	155	async function checkSsoSessionsWithActuator(browser) {	CODE
LOW	…ticket-validation-casv3-pgt-service-validate/script.js	29	async function assertProxyTicketRejected(body, endpoint) {	CODE
LOW	…/scenarios/passwordless-delegation-with-ldap/script.js	5	async function verifyDelegatedAuthenticationFlow(page) {	CODE
LOW	…/scenarios/passwordless-delegation-with-ldap/script.js	21	async function verifyPasswordRequestFlow(page) {	CODE
LOW	…puppeteer/scenarios/surrogate-oidc-authzcode/script.js	4	async function verifyImpersonationAutoSelected(browser) {	CODE
371 more matches not shown…

Over-Commented Block124 hits · 80 pts

Severity	File	Line	Snippet	Context
LOW	ci/tests/puppeteer/prefetch-docker-images.sh	1	#!/bin/bash	COMMENT
LOW	…eteer/scenarios/oidc-login-strapi/strapi/entrypoint.sh	1	#!/bin/bash	COMMENT
LOW	ci/tests/elastic/apm-server.yml	1	######################### APM Server Configuration #########################	COMMENT
LOW	ci/tests/elastic/apm-server.yml	21		COMMENT
LOW	ci/tests/elastic/apm-server.yml	41	#rate_limit:	COMMENT
LOW	ci/tests/elastic/apm-server.yml	61		COMMENT
LOW	ci/tests/elastic/apm-server.yml	81	# request from the agent.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	101	# Path to file containing the certificate for server authentication.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	121		COMMENT
LOW	ci/tests/elastic/apm-server.yml	141		COMMENT
LOW	ci/tests/elastic/apm-server.yml	161	#source_mapping:	COMMENT
LOW	ci/tests/elastic/apm-server.yml	181	#elasticsearch:	COMMENT
LOW	ci/tests/elastic/apm-server.yml	201	# When using APM agent configuration, information fetched from Elasticsearch or Kibana will be cached in memory for	COMMENT
LOW	ci/tests/elastic/apm-server.yml	221	# Scheme and port can be left out and will be set to the default (`http` and `5601`).	COMMENT
LOW	ci/tests/elastic/apm-server.yml	241	#	COMMENT
LOW	ci/tests/elastic/apm-server.yml	261	#ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2]	COMMENT
LOW	ci/tests/elastic/apm-server.yml	281		COMMENT
LOW	ci/tests/elastic/apm-server.yml	301		COMMENT
LOW	ci/tests/elastic/apm-server.yml	321	#username: "elastic"	COMMENT
LOW	ci/tests/elastic/apm-server.yml	341	# tries to reconnect. If the attempt fails, the backoff timer is increased	COMMENT
LOW	ci/tests/elastic/apm-server.yml	361	# Enable custom SSL settings. Set to false to ignore custom SSL settings for secure communication.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	381	#ssl.verification_mode: full	COMMENT
LOW	ci/tests/elastic/apm-server.yml	401	#ssl.cipher_suites: []	COMMENT
LOW	ci/tests/elastic/apm-server.yml	421	# Configure escaping HTML symbols in strings.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	441	# Optional maximum time to live for a connection to Logstash, after which the	COMMENT
LOW	ci/tests/elastic/apm-server.yml	461	# after a network error. After waiting backoff.init seconds, apm-server	COMMENT
LOW	ci/tests/elastic/apm-server.yml	481	# Enable SSL support. SSL is automatically enabled if any SSL setting is set.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	501	#ssl.verification_mode: full	COMMENT
LOW	ci/tests/elastic/apm-server.yml	521	#ssl.cipher_suites: []	COMMENT
LOW	ci/tests/elastic/apm-server.yml	541	# using any event field. To set the topic from document type use `%{[type]}`.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	561	# Authentication details. Password is required if username is set.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	581	#retry.max: 3	COMMENT
LOW	ci/tests/elastic/apm-server.yml	601		COMMENT
LOW	ci/tests/elastic/apm-server.yml	621	# Set the compression level. Currently only gzip provides a compression level	COMMENT
LOW	ci/tests/elastic/apm-server.yml	641	#ssl.enabled: false	COMMENT
LOW	ci/tests/elastic/apm-server.yml	661		COMMENT
LOW	ci/tests/elastic/apm-server.yml	681		COMMENT
LOW	ci/tests/elastic/apm-server.yml	701	# Name of the Kerberos user. It is used when auth_type is set to password.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	721	# Hosts to report instrumentation results to.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	741		COMMENT
LOW	ci/tests/elastic/apm-server.yml	761	# Windows systems default to file output. All other systems default to syslog.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	781	# The period after which to log the internal metrics. The default is 30s.	COMMENT
LOW	ci/tests/elastic/apm-server.yml	801		COMMENT
LOW	ci/tests/elastic/apm-server.yml	821	#http.enabled: false	COMMENT
LOW	ci/tests/elastic/apm-server.yml	841	# output configuration. This means that if you have the Elasticsearch output configured,	COMMENT
LOW	ci/tests/elastic/apm-server.yml	861		COMMENT
LOW	ci/tests/elastic/apm-server.yml	881	# The maximum number of seconds to wait before attempting to connect to	COMMENT
LOW	ci/tests/elastic/apm-server.yml	901	# * certificate, which verifies that the provided certificate is signed by a	COMMENT
LOW	ci/tests/elastic/apm-server.yml	921	#ssl.key: "/etc/pki/client/cert.key"	COMMENT
LOW	ci/tests/ldap/run-ad-server.sh	1	#!/bin/bash	COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	1		COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	21	# Specifying initial_token will override this setting on the node's initial start,	COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	41		COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	61	# this defines the maximum amount of time a dead host will have hints	COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	81		COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	101	# Authentication backend, implementing IAuthenticator; used to identify users	COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	121	# Part of the Authentication & Authorization backend, implementing IRoleManager; used	COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	141		COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	161	# Will be disabled automatically for AllowAllAuthorizer.	COMMENT
LOW	ci/tests/cassandra/cassandra.yaml	181	credentials_validity_in_ms: 2000	COMMENT
64 more matches not shown…

Self-Referential Comments7 hits · 26 pts

Severity	File	Line	Snippet	Context
MEDIUM	ci/tests/elastic/apm-server.yml	19	# Define a shared secret token for authorizing agents using the "Bearer" authorization method.	COMMENT
MEDIUM	ci/tests/ldap/run-ldap-server.sh	34	# Create an empty OpenLdap server for the company Example Inc. and the domain example.org.	COMMENT
MEDIUM	ci/tests/cassandra/generate-keys.sh	52	# Create the cluster key for cluster communication.	COMMENT
MEDIUM	ci/tests/cassandra/generate-keys.sh	57	# Create the public key for the cluster which is used to identify nodes.	COMMENT
MEDIUM⚡	ci/tests/cassandra/generate-keys.sh	70	# Create the client key for CQL.	COMMENT
MEDIUM⚡	ci/tests/cassandra/generate-keys.sh	75	# Create the public key for the client to identify itself.	COMMENT
MEDIUM⚡	ci/tests/cassandra/generate-keys.sh	84	# Create a pks12 keystore file	COMMENT

Verbosity Indicators6 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW⚡	ci/tests/cassandra/cassandra.yaml	1109	# Step 1: Set internode_encryption=<dc\|rack\|all> and explicitly set optional=true. Restart all nodes	COMMENT
LOW⚡	ci/tests/cassandra/cassandra.yaml	1111	# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual	COMMENT
LOW⚡	ci/tests/cassandra/cassandra.yaml	1156	# Step 1: Set enabled=true and explicitly set optional=true. Restart all nodes	COMMENT
LOW⚡	ci/tests/cassandra/cassandra.yaml	1158	# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual	COMMENT
LOW	gradle/libs.versions.toml	280	# This section handles Gradle build classpath dependency versions	COMMENT
LOW	gradle/libs.versions.toml	821	# This section handles Gradle build classpath dependencies	COMMENT

Structural Annotation Overuse4 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW⚡	ci/tests/cassandra/cassandra.yaml	1109	# Step 1: Set internode_encryption=<dc\|rack\|all> and explicitly set optional=true. Restart all nodes	COMMENT
LOW⚡	ci/tests/cassandra/cassandra.yaml	1111	# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual	COMMENT
LOW⚡	ci/tests/cassandra/cassandra.yaml	1156	# Step 1: Set enabled=true and explicitly set optional=true. Restart all nodes	COMMENT
LOW⚡	ci/tests/cassandra/cassandra.yaml	1158	# Step 2: Set optional=false (or remove it) and if you generated truststores and want to use mutual	COMMENT

Slop Phrases2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	ci/tests/cassandra/cassandra.yaml	46	# initial_token allows you to specify tokens manually. While you can use it with	COMMENT
MEDIUM	ci/tests/cassandra/cassandra.yaml	715	# you may want to adjust max_value_size_in_mb accordingly. This should be positive and less than 2048.	COMMENT

Unused Imports4 hits · 4 pts

Severity	File	Line	Context
LOW	etc/loadtests/locust/cas/samlLocust.py	3	CODE
LOW	etc/loadtests/locust/cas/allLocust.py	1	CODE
LOW	etc/loadtests/locust/cas/casLocust.py	3	CODE
LOW	etc/loadtests/locust/cas/casLocust.py	10	CODE

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	ci/tests/elastic/apm-server.yml	594	# Set max_retries to a value less than 0 to retry	COMMENT
LOW	ci/tests/cassandra/generate-keys.sh	23	# Check if cluster-name and password are provided as params....	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	ci/tests/cassandra/cassandra.yaml	1318	# each write which may be lower in order to facilitate availability.	COMMENT

apereo/cas

Open-Source Code Quality, Security and Technical Debt Review