The open-source cloud for agents & devs. Including Auth, Databases, Storage, Functions, Messaging, Hosting, Realtime, WAF and more
This report summarizes scanner evidence for appwrite/appwrite, a TypeScript project with 57,623 GitHub stars. SynthScan examined 1,904,828 lines of code across 9182 source files, recording 13881 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 7.3 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 13001 finding(s).
Are imports declared and package/API names verified? 763 finding(s).
Are wrappers, guards, and repeated structures necessary? 12541 finding(s).
Which changes need focused human review? 13881 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 13881 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/unit/AvatarPhotos/Providers/FallbackTest.php | 64 | public function testGetDrawsOnNeutralSurface(): void | CODE |
| LOW | tests/unit/AvatarPhotos/Providers/InitialsTest.php | 51 | public function testGetDeclinesUnprintableName(): void | CODE |
| LOW | tests/unit/AvatarPhotos/Providers/InitialsTest.php | 76 | public function testGetRendersMultibyteNames(string $name, bool $renders): void | CODE |
| LOW | tests/unit/AvatarPhotos/Providers/InitialsTest.php | 91 | public function testGetUppercasesInitials(): void | CODE |
| LOW | tests/unit/AvatarPhotos/Providers/InitialsTest.php | 118 | public function testGetDerivesInitialsFromWords(string $name, string $equivalent): void | CODE |
| LOW | tests/unit/AvatarPhotos/Providers/InitialsTest.php | 136 | public function testGetDrawsOnNeutralSurface(): void | CODE |
| LOW | tests/unit/AvatarPhotos/Providers/InitialsTest.php | 149 | public function testGetHonoursBackgroundOverride(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 43 | public function testAcceptsEntryWithoutParams(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 54 | public function testRejectsEntryMissingRequiredKeys(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 63 | public function testRejectsEntryWithEmptyStrings(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 74 | public function testRejectsEntryWithNonStringFields(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 85 | public function testRejectsEntryWithScalarParams(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 105 | public function testRejectsMoreThanMaxCount(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 122 | public function testAcceptsExactlyMaxCount(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 152 | public function testRejectsEntryWithEmptyService(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 163 | public function testRejectsEntryWithEmptyMethod(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 174 | public function testRejectsUnknownService(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 198 | public function testAcceptsCustomAllowedLists(): void | CODE |
| LOW | tests/unit/Advisor/Validator/CTAsTest.php | 218 | public function testDefaultMaxCountIsSixteen(): void | CODE |
| LOW | tests/unit/Schedule/Source/DatabaseTest.php | 14 | public function testRemovesMissingProjectScheduleOnce(): void | CODE |
| LOW | tests/unit/Schedule/Source/DatabaseTest.php | 39 | public function testRetriesFailedProjectRead(): void | CODE |
| LOW | tests/unit/Schedule/Source/DatabaseTest.php | 61 | public function testRetriesFailedDeletion(): void | CODE |
| LOW | tests/unit/Schedule/Source/DatabaseTest.php | 84 | public function testDoesNotCacheMissingProject(): void | CODE |
| LOW | tests/unit/Schedule/Source/FunctionsTest.php | 14 | public function testIntervalRunsOncePerPeriodAtStablePhase(): void | CODE |
| LOW | tests/unit/Schedule/Source/FunctionsTest.php | 29 | public function testSkipsUnsupportedInterval(): void | CODE |
| LOW | tests/unit/Docker/EnvTest.php | 45 | public function testMultilineDoubleQuotedPrivateKey(): void | CODE |
| LOW | tests/unit/Docker/EnvTest.php | 56 | public function testEscapedNewlineInDoubleQuotedValue(): void | CODE |
| LOW | tests/unit/Docker/EnvTest.php | 68 | public function testRoundTripPreservesMultilineSecret(): void | CODE |
| LOW⚡ | tests/unit/Docker/EnvTest.php | 84 | public function testEncodeValueEscapesSpecialCharacters(): void | CODE |
| LOW⚡ | tests/unit/Docker/EnvTest.php | 92 | public function testUnknownEscapesPreserveBackslash(): void | CODE |
| LOW⚡ | tests/unit/Docker/EnvTest.php | 102 | public function testIndentedCommentDoesNotCaptureNextAssignment(): void | CODE |
| LOW | tests/unit/Docker/EnvTest.php | 114 | public function testLineWithoutAssignmentIsSkipped(): void | CODE |
| LOW | tests/unit/Docker/EnvTest.php | 124 | public function testUnterminatedQuoteDoesNotAbsorbLaterAssignments(): void | CODE |
| LOW | tests/unit/Docker/EnvTest.php | 135 | public function testUnterminatedQuoteDoesNotAbsorbLaterQuotedAssignment(): void | CODE |
| LOW | tests/unit/Docker/Compose/GeneratorTest.php | 23 | public function testSelectsDatabaseService(): void | CODE |
| LOW | tests/unit/Docker/Compose/GeneratorTest.php | 49 | public function testKeepsProductionWorkers(): void | CODE |
| LOW | tests/unit/Docker/Compose/GeneratorTest.php | 62 | public function testSelectsSeparateTopology(): void | CODE |
| LOW | tests/unit/Docker/Compose/GeneratorTest.php | 94 | public function testAddsLocalHostPathMount(): void | CODE |
| LOW | tests/unit/Docker/Compose/GeneratorTest.php | 104 | public function testRewritesLocalRelativeBindMountsToHostPath(): void | CODE |
| LOW | tests/unit/Docker/Compose/GeneratorTest.php | 118 | public function testLeavesNoRelativeBindMountOnPublishedVersions(): void | CODE |
| LOW | tests/unit/Docker/Compose/GeneratorTest.php | 136 | public function testDoesNotAddDatabaseDependencyWithoutPlaceholder(): void | CODE |
| LOW | tests/unit/Docker/Compose/GeneratorTest.php | 147 | public function testKeepsLongCommandsReadable(): void | CODE |
| LOW | tests/unit/Utopia/ResponseTest.php | 94 | public function testResponseModelRequired(): void | CODE |
| LOW | tests/unit/Utopia/ResponseTest.php | 109 | public function testResponseModelRequiredException(): void | CODE |
| LOW | tests/unit/Utopia/ResponseTest.php | 267 | public function testShowSensitiveRestoresPreviousState(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 28 | public function testGetIPIgnoresClientForwardedForWhenProxiesEmpty(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 46 | public function testGetIPHonorsForwardedForFromTrustedProxy(string $forwardedFor, string $expected): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 113 | public function testGetParamsWithMultipleMethods(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 129 | public function testGetParamsWithAllRequired(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 147 | public function testGetParamsWithAllOptional(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 164 | public function testGetParamsMatchesMethodB(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 180 | public function testGetParamsFallbackForMixedAndUnknown(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 201 | public function testRouteIsScopedToRequestInstance(): void | CODE |
| LOW⚡ | tests/unit/Utopia/RequestTest.php | 216 | public function testGetHeaderLineReturnsStringValue(): void | CODE |
| LOW⚡ | tests/unit/Utopia/RequestTest.php | 223 | public function testGetHeaderLineReturnsDefaultWhenMissing(): void | CODE |
| LOW⚡ | tests/unit/Utopia/RequestTest.php | 229 | public function testGetHeaderLineJoinsMultipleValues(): void | CODE |
| LOW⚡ | tests/unit/Utopia/RequestTest.php | 238 | public function testGetHeadersSynthesizesCookieHeaderFromCookieJar(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 253 | public function testGetHeadersOmitsCookieHeaderWhenNoCookies(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 298 | public function testGetParamsDoesNotCacheRawParamsForServerError(): void | CODE |
| LOW | tests/unit/Utopia/RequestTest.php | 324 | public function testGetParamsDoesNotCacheRawParamsForUncodedException(): void | CODE |
| 12364 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | app/controllers/shared/api.php | 125 | // Step 1: Check if project is empty | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 130 | // Step 2: Get roles configuration | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 133 | // Step 3: Determine role for user | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 140 | // Step 4: Get scopes for the role | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 143 | // Step 5: API Key Authentication | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 530 | // Step 9: Validate scope permissions | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 536 | // Step 10: Check if user is blocked | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 541 | // Step 11: Verify password status | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 546 | // Step 12: Validate MFA requirements | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 556 | // Step 13: Handle Multi-Factor Authentication | COMMENT |
| LOW | app/controllers/shared/api.php | 406 | // Step 6: Update project and user last activity | COMMENT |
| LOW⚡ | tests/unit/Messaging/MessagingTest.php | 594 | // Step 1: guest subscribes. convertChannels preserves the literal form. | COMMENT |
| LOW⚡ | tests/unit/Messaging/MessagingTest.php | 599 | // Step 2: fromPayload publishes account.create alongside the user-scoped form. | COMMENT |
| LOW | tests/unit/Messaging/MessagingTest.php | 547 | // Step 2: A → B. | COMMENT |
| LOW | tests/unit/Messaging/MessagingTest.php | 558 | // Step 3: permissions-change for B (userId stays 'B'). | COMMENT |
| LOW | tests/unit/Messaging/MessagingTest.php | 569 | // Step 4: B → C. | COMMENT |
| LOW | tests/unit/Messaging/MessagingTest.php | 618 | // Step 3: in-band auth promotes the guest to user 'B'. | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 69 | // Step 1: Create Account | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 85 | // Step 2: Create Session | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 110 | // Step 3: Create Team | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 122 | // Step 4: Create Project | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 135 | // Step 5: Create API Key | COMMENT |
| LOW | tests/e2e/Services/Organization/KeysIntegrationTest.php | 37 | // Step 1: Create an ephemeral key scoped to users.read only. | COMMENT |
| LOW | tests/e2e/Services/Organization/KeysIntegrationTest.php | 58 | // Step 2: Create a project user using console headers. | COMMENT |
| LOW⚡ | tests/e2e/Services/Organization/KeysIntegrationTest.php | 73 | // Step 3: Ephemeral key can list users. | COMMENT |
| LOW⚡ | tests/e2e/Services/Organization/KeysIntegrationTest.php | 82 | // Step 4: Ephemeral key can get the specific user. | COMMENT |
| LOW⚡ | tests/e2e/Services/Organization/KeysIntegrationTest.php | 91 | // Step 5: Ephemeral key cannot create users (missing users.write scope). | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3511 | // Step 1: Create new documents with age > 25 in transaction | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3544 | // Step 2: Bulk update all documents with age > 25 to have status 'active' | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3694 | // Step 1: Update some documents to have category 'special' in transaction | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3721 | // Step 2: Bulk update all documents with category 'special' to have priority 'high' | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3860 | // Step 1: Create temporary documents in transaction | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3891 | // Step 2: Bulk delete all documents with type 'temporary' | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 4024 | // Step 1: Mark some documents for deletion by updating their status | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 4051 | // Step 2: Bulk delete all documents with status 'marked_for_deletion' | COMMENT |
| LOW | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 71 | // Step 1: Enable the custom factor and disable email | COMMENT |
| LOW⚡ | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 85 | // Step 2: A user with a verified email sees the policy reflected in factors | COMMENT |
| LOW⚡ | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 93 | // Step 3: Challenges for a disabled factor are rejected | COMMENT |
| LOW⚡ | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 100 | // Step 4: The custom factor completes the full challenge flow | COMMENT |
| LOW | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 119 | // Step 5: Leave a custom challenge pending, then restore email and disable custom again | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 44 | // Step 1: Set session duration to 60 seconds (the policy minimum) | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 47 | // Step 2: Create user and a session | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 76 | // Step 3: Poll until the 60s TTL elapses - session should expire | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 82 | // Step 4: Raise duration to 120s - same session should still not be usable | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 88 | // Step 5: Set duration to 1 year | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 91 | // Step 6: Same session should still not be usable | COMMENT |
| LOW⚡ | …roject/PoliciesPasswordPersonalDataIntegrationTest.php | 87 | // Step 1: Enable password personal data policy | COMMENT |
| LOW⚡ | …roject/PoliciesPasswordPersonalDataIntegrationTest.php | 90 | // Step 2: Each of the four personal-data fields in the password must block user creation | COMMENT |
| LOW⚡ | …roject/PoliciesPasswordPersonalDataIntegrationTest.php | 97 | // Step 3: Disable password personal data policy | COMMENT |
| LOW⚡ | …roject/PoliciesPasswordPersonalDataIntegrationTest.php | 100 | // Step 4: The same categories of passwords should now be accepted (fresh data to avoid uniqueness conflicts) | COMMENT |
| LOW | …/Services/Project/MockPhonesSessionIntegrationTest.php | 35 | // Step 1: Configure two mock phones with distinct OTPs. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 369 | // Step 1: Set a custom replyToEmail. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 380 | // Step 2: Clear it with an empty string. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 385 | // Step 3: Verify the cleared value persists. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 396 | // Step 1: Configure SMTP with a sender email, then disable it. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 405 | // Step 2: Clear senderEmail while keeping SMTP disabled. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 414 | // Step 3: Verify the cleared value persists. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 615 | // Step 1: Set username and password. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 627 | // Step 2: Clear both credentials by passing empty strings. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 637 | // Step 3: Verify the cleared username persists (a no-params PATCH must not restore it). | COMMENT |
| 286 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | app/config/templates/function.php | 216 | 'placeholder' => 'neo4j+s://4tg4mddo.databases.neo4j.io', | CODE |
| LOW⚡ | app/config/templates/function.php | 224 | 'placeholder' => 'neo4j', | CODE |
| LOW⚡ | app/config/templates/function.php | 232 | 'placeholder' => 'mCUc4PbVUQN-_NkTLJLisb6ccnwzQKKhrkF77YMctzx', | CODE |
| LOW⚡ | app/config/templates/function.php | 309 | 'placeholder' => 'ep-still-sea-a792sh84.eu-central-1.aws.neon.tech', | CODE |
| LOW⚡ | app/config/templates/function.php | 317 | 'placeholder' => 'main', | CODE |
| LOW⚡ | app/config/templates/function.php | 325 | 'placeholder' => 'main_owner', | CODE |
| LOW⚡ | app/config/templates/function.php | 333 | 'placeholder' => 'iQCfaUaaWB3B', | CODE |
| LOW⚡ | app/config/templates/function.php | 341 | 'placeholder' => 'ep-still-sea-a792sh84', | CODE |
| LOW⚡ | app/config/templates/function.php | 399 | 'placeholder' => 'sk-wzG...vcy', | CODE |
| LOW⚡ | app/config/templates/function.php | 407 | 'placeholder' => '512', | CODE |
| LOW⚡ | app/config/templates/function.php | 444 | 'placeholder' => 'appwrite-hosted-mcp', | CODE |
| LOW⚡ | app/config/templates/function.php | 452 | 'placeholder' => 'none', | CODE |
| LOW⚡ | app/config/templates/function.php | 460 | 'placeholder' => 'your-long-random-secret', | CODE |
| LOW⚡ | app/config/templates/function.php | 468 | 'placeholder' => 'openid tasks.read', | CODE |
| LOW⚡ | app/config/templates/function.php | 476 | 'placeholder' => '25', | CODE |
| LOW⚡ | app/config/templates/function.php | 527 | 'placeholder' => 'db9...980', | CODE |
| LOW⚡ | app/config/templates/function.php | 535 | 'placeholder' => '427...169', | CODE |
| LOW⚡ | app/config/templates/function.php | 543 | 'placeholder' => 'NDI...LUfg', | CODE |
| LOW⚡ | app/config/templates/function.php | 737 | 'placeholder' => 'urlShortener', | CODE |
| LOW⚡ | app/config/templates/function.php | 745 | 'placeholder' => 'urls', | CODE |
| LOW⚡ | app/config/templates/function.php | 753 | 'placeholder' => 'https://shortdomain.io', | CODE |
| LOW⚡ | app/config/templates/function.php | 803 | 'placeholder' => '64a55...7b912', | CODE |
| LOW⚡ | app/config/templates/function.php | 810 | 'placeholder' => '7c3e8...2a9f1', | CODE |
| LOW⚡ | app/config/templates/function.php | 817 | 'placeholder' => 'OFCNCOG2CU', | CODE |
| LOW⚡ | app/config/templates/function.php | 824 | 'placeholder' => 'fd0aa...136a8', | CODE |
| LOW⚡ | app/config/templates/function.php | 831 | 'placeholder' => 'my_index', | CODE |
| LOW⚡ | app/config/templates/function.php | 838 | 'placeholder' => 'bf2f5...df733', | CODE |
| LOW⚡ | app/config/templates/function.php | 902 | 'placeholder' => '64a55...7b912', | CODE |
| LOW⚡ | app/config/templates/function.php | 909 | 'placeholder' => '7c3e8...2a9f1', | CODE |
| LOW⚡ | app/config/templates/function.php | 916 | 'placeholder' => 'http://127.0.0.1:7700', | CODE |
| LOW⚡ | app/config/templates/function.php | 923 | 'placeholder' => 'masterKey1234', | CODE |
| LOW⚡ | app/config/templates/function.php | 930 | 'placeholder' => 'searchKey1234', | CODE |
| LOW⚡ | app/config/templates/function.php | 937 | 'placeholder' => 'appwrite_index', | CODE |
| LOW⚡ | app/config/templates/function.php | 1009 | 'placeholder' => '62...97', | CODE |
| LOW⚡ | app/config/templates/function.php | 1016 | 'placeholder' => 'Zjc...5PH', | CODE |
| LOW⚡ | app/config/templates/function.php | 1023 | 'placeholder' => 'NXOi3...IBHDa', | CODE |
| LOW⚡ | app/config/templates/function.php | 1030 | 'placeholder' => '+14000000102', | CODE |
| LOW⚡ | app/config/templates/function.php | 1067 | 'placeholder' => 'mywebapp-f6e57', | CODE |
| LOW⚡ | app/config/templates/function.php | 1074 | 'placeholder' => 'fcm-adminsdk-2f0de@test-f7q57.iam.gserviceaccount.com', | CODE |
| LOW⚡ | app/config/templates/function.php | 1081 | 'placeholder' => '0b683...75675', | CODE |
| LOW⚡ | app/config/templates/function.php | 1088 | 'placeholder' => 'https://my-app-f298e.firebaseio.com', | CODE |
| LOW⚡ | app/config/templates/function.php | 1139 | 'placeholder' => 'smtp.mailgun.org', | CODE |
| LOW⚡ | app/config/templates/function.php | 1146 | 'placeholder' => '25', | CODE |
| LOW⚡ | app/config/templates/function.php | 1153 | 'placeholder' => 'no-reply@mywebapp.org', | CODE |
| LOW⚡ | app/config/templates/function.php | 1160 | 'placeholder' => '5up3r5tr0ngP4ssw0rd', | CODE |
| LOW⚡ | app/config/templates/function.php | 1167 | 'placeholder' => 'me@mywebapp.org', | CODE |
| LOW⚡ | app/config/templates/function.php | 1175 | 'placeholder' => 'https://mywebapp.org,https://mywebapp.com', | CODE |
| LOW⚡ | app/config/templates/function.php | 1254 | 'placeholder' => 'sk_test_51J...', | CODE |
| LOW⚡ | app/config/templates/function.php | 1261 | 'placeholder' => 'whsec_...', | CODE |
| LOW⚡ | app/config/templates/function.php | 1269 | 'placeholder' => 'orders', | CODE |
| LOW⚡ | app/config/templates/function.php | 1277 | 'placeholder' => 'orders', | CODE |
| LOW⚡ | app/config/templates/function.php | 1386 | 'placeholder' => 'ai', | CODE |
| LOW⚡ | app/config/templates/function.php | 1394 | 'placeholder' => 'image_classification', | CODE |
| LOW⚡ | app/config/templates/function.php | 1402 | 'placeholder' => 'image_classification', | CODE |
| LOW⚡ | app/config/templates/function.php | 1409 | 'placeholder' => 'hf_MUvn...', | CODE |
| LOW⚡ | app/config/templates/function.php | 1446 | 'placeholder' => 'ai', | CODE |
| LOW⚡ | app/config/templates/function.php | 1454 | 'placeholder' => 'object_detection', | CODE |
| LOW⚡ | app/config/templates/function.php | 1462 | 'placeholder' => 'object_detection', | CODE |
| LOW⚡ | app/config/templates/function.php | 1469 | 'placeholder' => 'hf_MUvn...', | CODE |
| LOW⚡ | app/config/templates/function.php | 1506 | 'placeholder' => 'ai', | CODE |
| 620 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | app/config/templates/function.php | 397 | 'description' => 'A unique key used to authenticate with the OpenAI API. This is a paid service and you | CODE |
| HIGH⚡ | app/config/templates/function.php | 1788 | 'description' => 'A unique key used to authenticate with the OpenAI API. This is a paid service and you | CODE |
| HIGH⚡ | app/config/templates/function.php | 1853 | 'description' => 'A unique key used to authenticate with the OpenAI API. This is a paid service and you | CODE |
| HIGH | .semgrep/default-secret-placeholder.php | 15 | $token = 'your-api-key'; | CODE |
| HIGH | .semgrep/README.md | 101 | | Placeholder secret literal (`your-secret-key`, `your-api-key`, `changeme`, `insecure-secret`, …) outside Doctor, or an | CODE |
| HIGH | .semgrep/default-secret-placeholder.yml | 4 | Placeholder secret literals (your-secret-key, your-api-key, changeme, | CODE |
| HIGH | docs/sdks/dart/EXAMPLES.md | 11 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH | docs/sdks/dart/EXAMPLES.md | 11 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH | docs/sdks/dart/GETTING_STARTED.md | 9 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH | docs/sdks/dart/GETTING_STARTED.md | 9 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH | packages/agents/README.md | 49 | $adapter = new OpenAI('your-api-key', OpenAI::MODEL_GPT_4_TURBO); | CODE |
| HIGH | packages/agents/README.md | 70 | apiKey: 'your-api-key', | CODE |
| HIGH | packages/agents/README.md | 92 | apiKey: 'your-api-key', | CODE |
| HIGH | packages/agents/README.md | 114 | apiKey: 'your-api-key', | CODE |
| HIGH | packages/agents/README.md | 131 | apiKey: 'your-api-key', | CODE |
| HIGH | packages/agents/README.md | 151 | apiKey: 'your-api-key', | CODE |
| HIGH | packages/agents/README.md | 170 | apiKey: 'your-api-key', | CODE |
| HIGH | packages/agents/README.md | 207 | $adapter = new OpenAI('your-api-key', client: $client); | CODE |
| HIGH | packages/agents/README.md | 259 | $agent = new Agent(new OpenAI('your-api-key', OpenAI::MODEL_GPT_4O)); | CODE |
| HIGH | packages/agents/README.md | 285 | $agent = new Agent(new OpenAI('your-api-key', OpenAI::MODEL_GPT_4O)); | CODE |
| HIGH | packages/abuse/README.md | 85 | ->setKey('[YOUR_API_KEY]'); | CODE |
| HIGH⚡ | packages/messaging/README.md | 38 | $messaging = new Sendgrid('YOUR_API_KEY'); | CODE |
| HIGH⚡ | packages/messaging/README.md | 41 | $messaging = new Mailgun('YOUR_API_KEY', 'YOUR_DOMAIN'); | CODE |
| HIGH⚡ | packages/messaging/README.md | 44 | $messaging = new Resend('YOUR_API_KEY'); | CODE |
| HIGH | apps/console/src/content/docs-partials/auth-security.md | 278 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH | apps/console/src/content/docs-partials/auth-security.md | 278 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH | apps/console/src/content/docs-partials/auth-security.md | 295 | client.set_key('<YOUR_API_KEY>') | CODE |
| HIGH | apps/console/src/content/docs-partials/auth-security.md | 295 | client.set_key('<YOUR_API_KEY>') | CODE |
| HIGH | apps/console/src/content/docs-partials/auth-security.md | 314 | ->setKey('<YOUR_API_KEY>'); | CODE |
| HIGH | apps/console/src/content/docs-partials/auth-security.md | 314 | ->setKey('<YOUR_API_KEY>'); | CODE |
| HIGH | apps/console/src/content/docs-partials/auth-security.md | 329 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH | apps/console/src/content/docs-partials/auth-security.md | 329 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/deno/prompt.md | 55 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/deno/prompt.md | 55 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH⚡ | …console/src/content/docs/quick-starts/python/prompt.md | 66 | client.set_key('<YOUR_API_KEY>') | CODE |
| HIGH⚡ | …console/src/content/docs/quick-starts/python/prompt.md | 66 | client.set_key('<YOUR_API_KEY>') | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/dart/prompt.md | 32 | - Replace `<REGION>`, `<PROJECT_ID>`, and `<YOUR_API_KEY>` with the user's values if provided, else leave placeholders a | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/dart/prompt.md | 32 | - Replace `<REGION>`, `<PROJECT_ID>`, and `<YOUR_API_KEY>` with the user's values if provided, else leave placeholders a | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/dart/prompt.md | 44 | .setKey("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/dart/prompt.md | 44 | .setKey("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/dart/prompt.md | 168 | .setKey("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/dart/prompt.md | 168 | .setKey("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/rust/prompt.md | 61 | .set_key("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/rust/prompt.md | 61 | .set_key("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/rust/prompt.md | 247 | .set_key("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/rust/prompt.md | 247 | .set_key("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …console/src/content/docs/quick-starts/kotlin/prompt.md | 65 | .setKey("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …console/src/content/docs/quick-starts/kotlin/prompt.md | 65 | .setKey("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …ps/console/src/content/docs/quick-starts/php/prompt.md | 56 | ->setKey('<YOUR_API_KEY>'); | CODE |
| HIGH⚡ | …ps/console/src/content/docs/quick-starts/php/prompt.md | 56 | ->setKey('<YOUR_API_KEY>'); | CODE |
| HIGH⚡ | …console/src/content/docs/quick-starts/dotnet/prompt.md | 49 | .SetKey("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …console/src/content/docs/quick-starts/dotnet/prompt.md | 49 | .SetKey("<YOUR_API_KEY>"); | CODE |
| HIGH⚡ | …/console/src/content/docs/quick-starts/swift/prompt.md | 51 | .setKey("<YOUR_API_KEY>") | CODE |
| HIGH⚡ | …/console/src/content/docs/quick-starts/swift/prompt.md | 51 | .setKey("<YOUR_API_KEY>") | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/node/prompt.md | 53 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/node/prompt.md | 53 | .setKey('<YOUR_API_KEY>'); | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/ruby/prompt.md | 47 | .set_key('<YOUR_API_KEY>') # Your secret API key | CODE |
| HIGH⚡ | …s/console/src/content/docs/quick-starts/ruby/prompt.md | 47 | .set_key('<YOUR_API_KEY>') # Your secret API key | CODE |
| HIGH | …projects/$projectId/shared/TerraformConnectSection.tsx | 95 | export APPWRITE_API_KEY="your-api-key"` | CODE |
| HIGH | …projects/$projectId/shared/TerraformConnectSection.tsx | 147 | appwrite_api_key = "your-api-key"` | CODE |
| 16 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 19 | // ── columns (public private(set)) ────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 90 | // ── indexes (public private(set)) ────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 154 | // ── foreignKeys (public private(set)) ────────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 190 | // ── dropColumns (public private(set)) ────────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 218 | // ── renameColumns (public private(set)) ──────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 237 | // ── dropIndexes (public private(set)) ────────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 254 | // ── dropForeignKeys (public private(set)) ────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 271 | // ── rawColumnDefs (public private(set)) ──────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 288 | // ── rawIndexDefs (public private(set)) ───────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Schema/TableTest.php | 305 | // ── Combined / integration ───────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/API/HelperTest.php | 879 | // ── Query::diff() edge cases (exercises array_any) ───────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/API/HelperTest.php | 931 | // ── #[\Deprecated] on Query::containsString() ──────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/API/HelperTest.php | 931 | // ── #[\Deprecated] on Query::containsString() ──────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/API/HelperTest.php | 953 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | packages/query/tests/API/HelperTest.php | 955 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | packages/query/tests/API/HelperTest.php | 957 | // ── Query::page() with perPage < 1 (line 1152) ────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Hook/Filter/TenantTest.php | 199 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | packages/query/tests/Hook/Filter/TenantTest.php | 201 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | packages/query/tests/Hook/Filter/TenantTest.php | 203 | // ── Invalid column name (line 36) ──────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Hook/Filter/TenantTest.php | 247 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | packages/query/tests/Hook/Filter/TenantTest.php | 249 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | packages/query/tests/Hook/Filter/TenantTest.php | 251 | // ── Invalid column name (line 22) ──────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/query/tests/Hook/Filter/TenantTest.php | 260 | // ── Empty tenantIds (line 29) ──────────────────────────────── | COMMENT |
| MEDIUM | packages/query/tests/Hook/Filter/TenantTest.php | 216 | // ── Invalid permissions table name (line 51) ───────────────── | COMMENT |
| MEDIUM | packages/query/tests/Hook/Filter/TenantTest.php | 230 | // ── subqueryFilter (lines 72-74) ───────────────────────────── | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 1 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 16 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 18 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 38 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 40 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 53 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 55 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 74 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 76 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 102 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 104 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 149 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 151 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 175 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 177 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 223 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 225 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 245 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 247 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 268 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 270 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 289 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 291 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 318 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 320 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 352 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 354 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 378 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 381 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 400 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/.maestro/auth.yaml | 402 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/mobile/.maestro/auth.yaml | 1 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/mobile/.maestro/auth.yaml | 42 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/mobile/.maestro/auth.yaml | 44 | # =========================================================================== | COMMENT |
| MEDIUM | apps/console/tests/connect-qa/mobile/.maestro/auth.yaml | 59 | # =========================================================================== | COMMENT |
| 57 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | app/controllers/shared/api.php | 125 | // Step 1: Check if project is empty | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 130 | // Step 2: Get roles configuration | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 133 | // Step 3: Determine role for user | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 140 | // Step 4: Get scopes for the role | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 143 | // Step 5: API Key Authentication | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 530 | // Step 9: Validate scope permissions | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 536 | // Step 10: Check if user is blocked | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 541 | // Step 11: Verify password status | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 546 | // Step 12: Validate MFA requirements | COMMENT |
| LOW⚡ | app/controllers/shared/api.php | 556 | // Step 13: Handle Multi-Factor Authentication | COMMENT |
| LOW | app/controllers/shared/api.php | 406 | // Step 6: Update project and user last activity | COMMENT |
| LOW⚡ | tests/unit/Messaging/MessagingTest.php | 594 | // Step 1: guest subscribes. convertChannels preserves the literal form. | COMMENT |
| LOW⚡ | tests/unit/Messaging/MessagingTest.php | 599 | // Step 2: fromPayload publishes account.create alongside the user-scoped form. | COMMENT |
| LOW | tests/unit/Messaging/MessagingTest.php | 547 | // Step 2: A → B. | COMMENT |
| LOW | tests/unit/Messaging/MessagingTest.php | 558 | // Step 3: permissions-change for B (userId stays 'B'). | COMMENT |
| LOW | tests/unit/Messaging/MessagingTest.php | 569 | // Step 4: B → C. | COMMENT |
| LOW | tests/unit/Messaging/MessagingTest.php | 618 | // Step 3: in-band auth promotes the guest to user 'B'. | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 69 | // Step 1: Create Account | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 85 | // Step 2: Create Session | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 110 | // Step 3: Create Team | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 122 | // Step 4: Create Project | COMMENT |
| LOW | tests/benchmarks/bulk-operations/utils.js | 135 | // Step 5: Create API Key | COMMENT |
| LOW | tests/e2e/Services/Organization/KeysIntegrationTest.php | 37 | // Step 1: Create an ephemeral key scoped to users.read only. | COMMENT |
| LOW | tests/e2e/Services/Organization/KeysIntegrationTest.php | 58 | // Step 2: Create a project user using console headers. | COMMENT |
| LOW⚡ | tests/e2e/Services/Organization/KeysIntegrationTest.php | 73 | // Step 3: Ephemeral key can list users. | COMMENT |
| LOW⚡ | tests/e2e/Services/Organization/KeysIntegrationTest.php | 82 | // Step 4: Ephemeral key can get the specific user. | COMMENT |
| LOW⚡ | tests/e2e/Services/Organization/KeysIntegrationTest.php | 91 | // Step 5: Ephemeral key cannot create users (missing users.write scope). | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3511 | // Step 1: Create new documents with age > 25 in transaction | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3544 | // Step 2: Bulk update all documents with age > 25 to have status 'active' | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3694 | // Step 1: Update some documents to have category 'special' in transaction | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3721 | // Step 2: Bulk update all documents with category 'special' to have priority 'high' | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3860 | // Step 1: Create temporary documents in transaction | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 3891 | // Step 2: Bulk delete all documents with type 'temporary' | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 4024 | // Step 1: Mark some documents for deletion by updating their status | COMMENT |
| LOW | …e/Services/Databases/Transactions/TransactionsBase.php | 4051 | // Step 2: Bulk delete all documents with status 'marked_for_deletion' | COMMENT |
| LOW | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 71 | // Step 1: Enable the custom factor and disable email | COMMENT |
| LOW⚡ | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 85 | // Step 2: A user with a verified email sees the policy reflected in factors | COMMENT |
| LOW⚡ | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 93 | // Step 3: Challenges for a disabled factor are rejected | COMMENT |
| LOW⚡ | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 100 | // Step 4: The custom factor completes the full challenge flow | COMMENT |
| LOW | …Services/Project/PoliciesMFAFactorsIntegrationTest.php | 119 | // Step 5: Leave a custom challenge pending, then restore email and disable custom again | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 44 | // Step 1: Set session duration to 60 seconds (the policy minimum) | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 47 | // Step 2: Create user and a session | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 76 | // Step 3: Poll until the 60s TTL elapses - session should expire | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 82 | // Step 4: Raise duration to 120s - same session should still not be usable | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 88 | // Step 5: Set duration to 1 year | COMMENT |
| LOW⚡ | …ces/Project/PoliciesSessionDurationIntegrationTest.php | 91 | // Step 6: Same session should still not be usable | COMMENT |
| LOW⚡ | …roject/PoliciesPasswordPersonalDataIntegrationTest.php | 87 | // Step 1: Enable password personal data policy | COMMENT |
| LOW⚡ | …roject/PoliciesPasswordPersonalDataIntegrationTest.php | 90 | // Step 2: Each of the four personal-data fields in the password must block user creation | COMMENT |
| LOW⚡ | …roject/PoliciesPasswordPersonalDataIntegrationTest.php | 97 | // Step 3: Disable password personal data policy | COMMENT |
| LOW⚡ | …roject/PoliciesPasswordPersonalDataIntegrationTest.php | 100 | // Step 4: The same categories of passwords should now be accepted (fresh data to avoid uniqueness conflicts) | COMMENT |
| LOW | …/Services/Project/MockPhonesSessionIntegrationTest.php | 35 | // Step 1: Configure two mock phones with distinct OTPs. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 369 | // Step 1: Set a custom replyToEmail. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 380 | // Step 2: Clear it with an empty string. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 385 | // Step 3: Verify the cleared value persists. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 396 | // Step 1: Configure SMTP with a sender email, then disable it. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 405 | // Step 2: Clear senderEmail while keeping SMTP disabled. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 414 | // Step 3: Verify the cleared value persists. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 615 | // Step 1: Set username and password. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 627 | // Step 2: Clear both credentials by passing empty strings. | COMMENT |
| LOW⚡ | tests/e2e/Services/Project/SMTPBase.php | 637 | // Step 3: Verify the cleared username persists (a no-params PATCH must not restore it). | COMMENT |
| 98 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/realtime.php | 861 | // roles they held until now, so the client sees what ended it before the | COMMENT |
| LOW | app/config/oAuthProviders.php | 561 | 'icon' => 'icon-zoom', | COMMENT |
| LOW | app/config/storage/logos.php | 21 | // // Microsoft Word | COMMENT |
| LOW | app/config/storage/logos.php | 41 | // 'application/vnd.ms-powerpoint.addin.macroEnabled.12' => __DIR__.'/logos/ppt.png', | COMMENT |
| LOW | …/Services/ProjectWebhooks/WebhooksCustomServerTest.php | 821 | $this->assertNotEmpty($response['body']['$id']); | COMMENT |
| LOW | …s/e2e/Services/GraphQL/TablesDB/DatabaseServerTest.php | 1881 | // * @depends testCreateFloatColumn | COMMENT |
| LOW | …s/e2e/Services/GraphQL/TablesDB/DatabaseServerTest.php | 1901 | // ] | COMMENT |
| LOW | …s/e2e/Services/GraphQL/TablesDB/DatabaseServerTest.php | 2181 | $row = $row['body']['data']['tablesDBGetRow']; | COMMENT |
| LOW | …s/e2e/Services/GraphQL/TablesDB/DatabaseServerTest.php | 2201 | // ], $this->getHeaders()), $gqlPayload); | COMMENT |
| LOW | …s/e2e/Services/GraphQL/TablesDB/DatabaseServerTest.php | 2221 | // ]; | COMMENT |
| LOW | …s/e2e/Services/GraphQL/TablesDB/DatabaseServerTest.php | 2321 | COMMENT | |
| LOW | …s/e2e/Services/GraphQL/TablesDB/DatabaseServerTest.php | 2381 | // public function testDeleteCustomEntity(array $data) | COMMENT |
| LOW | …sts/e2e/Services/GraphQL/Legacy/DatabaseServerTest.php | 1801 | // * @depends testCreateStringAttribute | COMMENT |
| LOW | …sts/e2e/Services/GraphQL/Legacy/DatabaseServerTest.php | 1821 | // 'email' => 'johndoe@appwrite.io', | COMMENT |
| LOW | …sts/e2e/Services/GraphQL/Legacy/DatabaseServerTest.php | 2101 | $this->assertArrayNotHasKey('errors', $document['body']); | COMMENT |
| LOW | …sts/e2e/Services/GraphQL/Legacy/DatabaseServerTest.php | 2121 | // 'x-appwrite-project' => $projectId, | COMMENT |
| LOW | …sts/e2e/Services/GraphQL/Legacy/DatabaseServerTest.php | 2141 | // ] | COMMENT |
| LOW | …sts/e2e/Services/GraphQL/Legacy/DatabaseServerTest.php | 2241 | $this->assertStringContainsString('New Document Name', (string) $document['data']); | COMMENT |
| LOW | …sts/e2e/Services/GraphQL/Legacy/DatabaseServerTest.php | 2261 | // $entity = $this->client->call(Client::METHOD_POST, '/graphql', array_merge([ | COMMENT |
| LOW | …sts/e2e/Services/GraphQL/Legacy/DatabaseServerTest.php | 2301 | // * @depends testCreateCustomEntity | COMMENT |
| LOW | packages/cache/src/Adapter/Redis/Multiplexing.php | 481 | // Otherwise the server is just slower than this caller was willing to | COMMENT |
| LOW | packages/cache/src/Adapter/Redis/Multiplexing.php | 661 | // May be a reply whose caller already gave up on its own | COMMENT |
| LOW | packages/nats/src/Connection.php | 1121 | // socket or raises. | COMMENT |
| LOW | packages/http/tests/bench/run.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | packages/http/src/Adapter/Swoole/Mode.php | 61 | { | COMMENT |
| LOW | packages/http/src/Adapter/Swoole/Mode.php | 81 | // wake-up on every junk/scan connection. The integer is the | COMMENT |
| LOW | packages/http/src/Adapter/Swoole/Mode.php | 101 | // upstreams let coroutines pile up until OOM. 1000 mainly backstops | COMMENT |
| LOW | packages/http/src/Adapter/Swoole/Mode.php | 141 | Constant::OPTION_DISPATCH_MODE => 3, | COMMENT |
| LOW | packages/http/src/Adapter/Swoole/Mode.php | 161 | // for every server-spawned coroutine; no Runtime::enableCoroutine | COMMENT |
| LOW | packages/http/src/Adapter/Swoole/Mode.php | 181 | // context switches. 1× cores is the right shape. | COMMENT |
| LOW | packages/queue/tests/bench/run.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | packages/queue/src/Adapter.php | 381 | // is rejected: reject() is where the broker decides between another | COMMENT |
| LOW | packages/queue/src/Broker/Nats.php | 101 | // maxDeliver, so a broker adopting it can tell that spare from a larger budget. | COMMENT |
| LOW | packages/queue/src/Broker/Nats.php | 1481 | // every attempt died unacknowledged, which pull() dead-letters on arrival. | COMMENT |
| LOW | packages/queue/src/Adapter/Swoole.php | 101 | Coroutine::set(['hook_flags' => SWOOLE_HOOK_ALL]); | COMMENT |
| LOW | packages/validators/src/compat.php | 1 | <?php | COMMENT |
| LOW | packages/dns/tests/Message/DomainTest.php | 141 | // Create a packet where we start mid-stream and encounter a pointer | COMMENT |
| LOW | .github/workflows/issue-triage.lock.yml | 1 | # This file was automatically generated by gh-aw. DO NOT EDIT. | COMMENT |
| LOW | .github/workflows/issue-triage.lock.yml | 21 | # pre_activation --> activation | COMMENT |
| LOW | .github/workflows/console-snippets-qa-android.yml | 201 | echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH" | COMMENT |
| LOW | apps/console/tests/connect-qa/mobile/.maestro/auth.yaml | 1 | # --------------------------------------------------------------------------- | COMMENT |
| LOW | apps/console/tests/connect-qa/mobile/.maestro/auth.yaml | 21 | # plaintext is asserted absent from the view hierarchy (4b, 6b), which | COMMENT |
| LOW | apps/console/scripts/generate-compose-data.ts | 21 | // Mirrors TOPOLOGY_SERVICE_GROUPS in src/Appwrite/Docker/Compose/Generator.php, | COMMENT |
| LOW | apps/console/scripts/apply-ja-dict-translations.ts | 101 | // For partial translation batches use scripts/patch-ja-placeholders-only.ts instead. | COMMENT |
| LOW | apps/console/src/lib/react-query/hooks/analytics.ts | 641 | // measured against query-core): | COMMENT |
| LOW | apps/console/src/lib/marketplace/marketplace-nav.ts | 101 | { | COMMENT |
| LOW | src/Appwrite/Deployment/Deployments.php | 421 | // the internal Docker network, so the presigned + callback URLs use an | COMMENT |
| LOW | src/Appwrite/Messaging/Adapter/Realtime.php | 41 | 'memberships', | COMMENT |
| LOW | src/Appwrite/Migration/Version/V19.php | 521 | // try { | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/console-snippets-qa-server.yml | 177 | # django-admin only exists once Django is installed, so the scaffold | COMMENT |
| MEDIUM | .github/workflows/console-snippets-qa-server.yml | 356 | # `dart create` rejects dashes in package names, so scaffold under | COMMENT |
| MEDIUM | .github/workflows/console-snippets-qa-server.yml | 358 | # --project-name instead, so it can scaffold straight into $APP_DIR. | COMMENT |
| MEDIUM | .github/workflows/issue-triage.lock.yml | 4 | # For more information: https://github.com/githubnext/gh-aw/blob/main/.github/instructions/github-agentic-workflows.inst | COMMENT |
| MEDIUM | .github/workflows/issue-triage.lock.yml | 4 | # For more information: https://github.com/githubnext/gh-aw/blob/main/.github/instructions/github-agentic-workflows.inst | COMMENT |
| MEDIUM | .github/workflows/console-snippets-qa-web.yml | 87 | # Nuxt 4 keeps app code under app/; drop the scaffold's welcome | COMMENT |
| MEDIUM | .github/workflows/console-snippets-qa-web.yml | 202 | # Some create CLIs exit 0 without scaffolding (e.g. create-solid on | COMMENT |
| MEDIUM | .github/workflows/console-snippets-qa-ios.yml | 215 | # rewritten - scaffold assets can be binary. | COMMENT |
| MEDIUM | …le/tests/connect-qa/android/templates/tauri/index.html | 4 | onto #app, which the scaffold's index.html does not have. | CODE |
| MEDIUM | apps/console/public/videos/firewall-trailer/seg_017.ts | 961 | �{�F�6�?f:���Hk0�pe�me��&����a}V:����z� ��lo��h�<�\��Ӧvw{�G��7M� #Ȑ5nk�T�,��+����E�|-�(*CrŅ���܂3�� x��R | CODE |
| MEDIUM | …projects/$projectId/databases/tablesdb/Spreadsheet.tsx | 4464 | // Sample data generation mutation (requires at least one non-relationship column; no auto-scaffold) | COMMENT |
| MEDIUM | …jects/$projectId/databases/documentsdb/Spreadsheet.tsx | 3807 | // Sample data generation mutation (requires at least one non-relationship column; no auto-scaffold) | COMMENT |
| MEDIUM | …rojects/$projectId/databases/vectorsdb/Spreadsheet.tsx | 4074 | // Sample data generation mutation (requires at least one non-relationship column; no auto-scaffold) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | apps/console/tests/unit/news-sitemap.test.ts | 337 | print(len(urls)) | CODE |
| HIGH | apps/console/src/lib/realtime/connection-snippets.ts | 104 | print(response); | CODE |
| HIGH | apps/console/src/lib/realtime/connection-snippets.ts | 115 | print(response); | CODE |
| HIGH | apps/console/src/lib/realtime/connection-snippets.ts | 130 | print(String(describing: response)) | CODE |
| HIGH | apps/console/src/lib/realtime/connection-snippets.ts | 138 | print(String(describing: response)) | CODE |
| HIGH | apps/console/src/lib/realtime/connection-snippets.ts | 155 | print(it.payload.toString()) | CODE |
| HIGH | apps/console/src/lib/realtime/connection-snippets.ts | 165 | print(it.payload.toString()) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/http/tests/bench/docker-compose.yml | 1 | # Benchmark harness: runs the Swoole bench server (tests/bench/server.php) | COMMENT |
| MEDIUM | packages/dns/tests/E2E/Validator/DNSTest.php | 90 | // Custom flags and tag is allowed, but only for Certainly | COMMENT |
| MEDIUM | packages/dns/tests/E2E/Validator/DNSTest.php | 102 | // Certainly CAA allows Certainly, but not LetsEncrypt; Same for subdomains | COMMENT |
| MEDIUM | packages/dns/tests/E2E/Validator/DNSTest.php | 110 | // LetsEncrypt CAA on subdomain with parent allowing Certainly. Only LetsEncrypt is allowed; Same for subdomains | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/resources/swagger2.json | 1 | {"swagger":"2.0","info":{"version":"0.8.0","title":"Appwrite","description":"Appwrite backend as a service cuts up to 70 | CODE |
| MEDIUM | …nts/global/shared/community-support-wizard/Content.tsx | 82 | 'If you have a minute, here is how you can help. If not, skip and get back to work.', | CODE |
| MEDIUM | apps/console/src/lib/i18n/dictionaries/he/shared-ui.ts | 326 | 'If you have a minute, here is how you can help. If not, skip and get back to work.': | CODE |
| MEDIUM | apps/console/src/lib/i18n/dictionaries/ja/shared-ui.ts | 211 | 'If you have a minute, here is how you can help. If not, skip and get back to work.': | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …/pages/projects/$projectId/shared/S3ConnectSection.tsx | 77 | # Create a bucket | COMMENT |
| MEDIUM | apps/console/src/lib/docs/toc.ts | 22 | * `# Create the bucket` is not a heading, so it must not reach the heading scan below. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/e2e/Services/Sites/SitesCustomServerTest.php | 1192 | // // TODO: Implement testCreateDeploymentFromCLI() later | COMMENT |