Arkime is an open source, large scale, full packet capturing, indexing, and database system.
This report summarizes scanner evidence for arkime/arkime, a C project with 7,554 GitHub stars. SynthScan examined 282,379 lines of code across 689 source files, recording 182 pattern matches distributed across 13 syntactic categories. The legacy adjusted pattern signal is 1.0 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 121 finding(s).
Are imports declared and package/API names verified? 23 finding(s).
Are wrappers, guards, and repeated structures necessary? 50 finding(s).
Which changes need focused human review? 182 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 182 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/gen/gen_adb_synthetic.py | 239 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 243 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 273 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 278 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 329 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 333 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 359 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 364 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 387 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 392 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 415 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 419 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 435 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_adb_synthetic.py | 439 | # ========================================================================== | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 41 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 43 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 139 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 141 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 200 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 202 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 343 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 345 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 387 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 389 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 433 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 435 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 473 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 475 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 776 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_ntlm_synthetic.py | 778 | # ------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_opcua_synthetic.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_opcua_synthetic.py | 30 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_opcua_synthetic.py | 94 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_opcua_synthetic.py | 96 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_opcua_synthetic.py | 136 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_opcua_synthetic.py | 138 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_opcua_synthetic.py | 277 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/gen/gen_opcua_synthetic.py | 279 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | easybutton-build.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | capture/python.c | 1 | /******************************************************************************/ | COMMENT |
| LOW | capture/dedup.c | 21 | * non-matches. MD5 is used over XXH3 to keep the function small | COMMENT |
| LOW | capture/main.c | 1 | /******************************************************************************/ | COMMENT |
| LOW | capture/field.c | 21 | #define ARKIME_FIELD_SPECIAL_MIN_SAVE -4 | COMMENT |
| LOW | capture/reader-tpacketv3.c | 301 | #endif // TPACKET_V3 | COMMENT |
| LOW | capture/db.c | 1 | /******************************************************************************/ | COMMENT |
| LOW | capture/arkime.h | 1 | /******************************************************************************/ | COMMENT |
| LOW | capture/arkime.h | 21 | #include "http_parser.h" | COMMENT |
| LOW | capture/arkime.h | 41 | #define SUPPRESS_ALIGNMENT __attribute__((no_sanitize_undefined())) | COMMENT |
| LOW | capture/arkime.h | 61 | #define ARKIME_SESSIONID6_LEN 40 | COMMENT |
| LOW | capture/arkime.h | 301 | #define ARKIME_COND_INIT(var) pthread_cond_init(&var##_cond, NULL) | COMMENT |
| LOW | capture/arkime.h | 761 | COMMENT | |
| LOW | capture/arkime.h | 1521 | typedef uint32_t (* ArkimePluginOutstandingFunc)(); | COMMENT |
| LOW | capture/arkime.h | 1821 | #define strcat(x,y) BANNED(strcat, g_strlcat) | COMMENT |
| LOW | capture/arkime.h | 1841 | #define asctime(t) BANNED(asctime, none) | COMMENT |
| LOW | capture/parsers/dns.c | 1 | /* Copyright 2012-2017 AOL Inc. All rights reserved. | COMMENT |
| LOW | capture/parsers/adb.c | 1 | /* Copyright 2012-2017 AOL Inc. All rights reserved. | COMMENT |
| LOW | capture/parsers/adb.c | 21 | #define ADB_AUTH_RSAPUBLICKEY 3 | COMMENT |
| LOW | capture/parsers/bacnet.c | 21 | #define BVLC_TYPE_BACNET_IP 0x81 | COMMENT |
| LOW | capture/parsers/sctp.c | 1 | /* sctp.c | COMMENT |
| LOW | capture/parsers/tcp.c | 341 | COMMENT | |
| LOW | capture/parsers/smb.c | 41 | #define SMB1_DELETE 11 | COMMENT |
| LOW | capture/parsers/stun.c | 41 | #define TURN_ALLOCATE_RESPONSE 0x0103 | COMMENT |
| LOW | capture/parsers/stun.c | 61 | #define STUN_ATTR_DATA 0x0013 | COMMENT |
| LOW | capture/plugins/wise.c | 61 | COMMENT | |
| LOW | capture/plugins/lua/molua.h | 21 | uint8_t invalid; // True if the pointer is no longer valid | COMMENT |
| LOW | capture/plugins/kafka/kafka.c | 1 | /* kafka.c -- Simple plugin that sends json encoded data to Kafka | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 321 | */ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 361 | * They will then be redefined for XXH_INLINE_ALL | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 381 | # undef XXH64_copyState | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 401 | # undef XXH3_128bits_withSeed | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 421 | * Alternative solution: do not redeclare them. | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 441 | #endif /* XXH_INLINE_ALL || XXH_PRIVATE_API */ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 461 | COMMENT | |
| LOW | capture/thirdparty/xxhash.h | 481 | # define XXH64_copyState XXH_IPREF(XXH64_copyState) | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 501 | # define XXH128 XXH_IPREF(XXH128) | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 521 | ***************************************/ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 861 | || (defined (__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) /* C99 */) ) | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 1701 | # define XXH_ALIGN(n) _Alignas(n) | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 2301 | /* default to 1 for -Os or -Oz */ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 2321 | # if XXH_SIZE_OPT >= 1 || defined(__NO_INLINE__) /* -O0, -fno-inline */ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 2421 | COMMENT | |
| LOW | capture/thirdparty/xxhash.h | 2441 | # define XXH_FORCE_INLINE static __forceinline | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 2461 | # define XXH3_WITH_SECRET_INLINE XXH_NO_INLINE | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 2501 | # include <assert.h> /* note: can still be disabled with NDEBUG */ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 2541 | #else | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 2561 | # else | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 2801 | # define XXH_rotl64 __builtin_rotateleft64 | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 3461 | * @defgroup XXH64_impl XXH64 implementation | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 3841 | # define XXH_likely(x) (x) | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 3861 | # if defined(__ARM_NEON__) || defined(__ARM_NEON) \ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 4001 | # elif defined(__ARM_FEATURE_SVE) | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 4021 | # endif | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 4041 | # define XXH_ACC_ALIGN 64 /* for compatibility with avx512 */ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 4061 | # define XXH_ACC_ALIGN 64 /* could be 8, but 64 may be faster */ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 4281 | # elif defined(__VEC_ELEMENT_REG_ORDER__) && __VEC_ELEMENT_REG_ORDER__ == __ORDER_BIG_ENDIAN__ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 4361 | acc = svadd_u64_x(mask, acc, mul); \ | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 4901 | # define ACC_NB XXH_ACC_NB | COMMENT |
| LOW | capture/thirdparty/xxhash.h | 5841 | #define XXH_CONCAT2(X, Y) X ## Y | COMMENT |
| 32 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | viewer/public/jquery-jvectormap-1.2.2.min.js | 7 | */(function(e){var t={set:{colors:1,values:1,backgroundColor:1,scaleColors:1,normalizeFunction:1,focus:1},get:{selected | COMMENT |
| CRITICAL | viewer/vueapp/src/components/sessions/Sessions.vue | 923 | return this.$store.state.user.settings.timelineDataFilters.map(i => FieldService.getField(i)); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/gen/gen_tcpseq_synthetic.py | 40 | def sec_out_of_window_rst_syn(): | CODE |
| LOW | tests/gen/gen_arkime_synthetic.py | 717 | def sec_dns_https_trailing_empty_param(): | CODE |
| LOW | tests/gen/gen_arkime_synthetic.py | 3096 | def sec_quic_duplicate_crypto(): | CODE |
| LOW | tests/gen/gen_arkime_synthetic.py | 3113 | def sec_udp_tunnel_port_fallback(): | CODE |
| LOW | tests/gen/gen_arkime_synthetic.py | 3174 | def sec_http_upgrade_not_switched(): | CODE |
| LOW | tests/gen/gen_arkime_synthetic.py | 3461 | def sec_http_connect_variants(): | CODE |
| LOW | tests/gen/gen_arkime_synthetic.py | 3639 | def sec_dtls_fragmented_hello(): | CODE |
| LOW | tests/gen/gen_arkime_synthetic.py | 3928 | def sec_http_connect_split_line(): | CODE |
| LOW | tests/gen/gen_arkime_synthetic.py | 3944 | def sec_http_connect_smtp_guess(): | CODE |
| LOW | cont3xt/vueapp/src/utils/cont3xtUtil.js | 61 | export function shouldDisplayIntegrationBtn (integration, integrationData) { | CODE |
| LOW | cont3xt/vueapp/src/utils/cont3xtUtil.js | 65 | export function shouldDisplayCountedIntegrationBtn (integration, integrationData) { | CODE |
| LOW | …/src/components/search/ExpressionAutocompleteInput.vue | 371 | function updateFieldHistoryResults (strToMatch) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/plugins/pythonpacketcb.py | 1 | CODE | |
| LOW | tests/plugins/pythontest.py | 3 | CODE | |
| LOW | tests/plugins/pythontest.py | 4 | CODE | |
| LOW | tests/gen/gen_s7comm_synthetic.py | 13 | CODE | |
| LOW | tests/gen/gen_tcp-reassembly-synthetic.py | 13 | CODE | |
| LOW | tests/gen/gen_openvpn_synthetic.py | 13 | CODE | |
| LOW | tests/gen/gen_ike-cert_synthetic.py | 13 | CODE | |
| LOW | tests/gen/gen_diameter_synthetic.py | 13 | CODE | |
| LOW | tests/gen/gen_dnp3_synthetic.py | 13 | CODE | |
| LOW | tests/gen/gen_dcerpc_synthetic.py | 13 | CODE | |
| LOW | tests/gen/gen_pana_synthetic.py | 13 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | easybutton-build.sh | 178 | # Check if in right directory | COMMENT |
| LOW | easybutton-build.sh | 181 | # Check if git | COMMENT |
| LOW | release/docker.sh | 134 | # Check if no arguments were provided | COMMENT |
| LOW | contrib/netflow2arkime.pl | 148 | # Check if stdin has data | COMMENT |
| LOW | contrib/netflow2arkime.pl | 639 | # Check if flow is reverse direction of another | COMMENT |
| LOW | contrib/netflow2arkime.pl | 667 | # Check if this is the reverse direction | COMMENT |
| LOW | contrib/netflow2arkime.pl | 1111 | # Check if nfdump is available (use list-form to avoid shell interpretation of $NFDUMP_PATH) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/plugins/pythontest.py | 6 | # Create a new field in the session we will be setting | COMMENT |
| MEDIUM | release/freebsdpkg.sh | 74 | # Create the package without -r flag, using absolute paths in plist | COMMENT |
| MEDIUM | db/db.pl | 4433 | # Create the template sessions use and update mapping of current sessions. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | capture/python.c | 571 | int dummy_value; // Example placeholder for session-specific data | CODE |
| LOW | capture/python.c | 1239 | state->dummy_value = 0; // Initialize dummy value | CODE |
| LOW | capture/python.c | 1297 | int dummy_value; // Example placeholder for packet-specific data | CODE |
| LOW | capture/python.c | 1702 | state->dummy_value = 0; // Initialize dummy value | CODE |
| LOW | …/src/components/search/ExpressionAutocompleteInput.vue | 10 | :placeholder="placeholder" | CODE |
| LOW | …/src/components/search/ExpressionAutocompleteInput.vue | 22 | :placeholder="placeholder" | CODE |
| LOW | parliament/parliament.example.json | 6 | "description": "This is the description of the cluster group. Lorem ipsum dolor sit amet, consectetur adipiscing e | CODE |
| LOW | parliament/parliament.example.json | 6 | "description": "This is the description of the cluster group. Lorem ipsum dolor sit amet, consectetur adipiscing e | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/gen/gen_opcua_synthetic.py | 15 | 5. IPv6 - HEL EndpointUrl length=-1 (null) | STRING |
| HIGH | tests/gen/gen_opcua_synthetic.py | 46 | """HEL Final. endpoint_url may be None (null), '' (empty) or a str.""" | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | capture/plugins/taggerUpload.pl | 3 | # a database key, so make sure to reuse the same filename. | COMMENT |
| MEDIUM | viewer/public/cyberchef.html | 11 | <meta charset=UTF-8><title>CyberChef</title><meta name=copyright content="Crown Copyright 2016-2026"><meta name=descript | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | viewer/apiMisc.js | 266 | const msg = 'Need to set https://arkime.com/settings#uploadcommand in config file for uploads to work. However if | CODE |
| MEDIUM | viewer/package-lock.json | 467 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.2.tgz", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/gen/gen_tcpseq_synthetic.py | 104 | CODE | |
| LOW | tests/gen/gen_tcpseq_synthetic.py | 136 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | contrib/netflow2arkime.pl | 17 | # Usage: | COMMENT |