Cookiecutter template for a Python package.
This report summarizes scanner evidence for audreyfeldroy/cookiecutter-pypackage, a Python project with 4,605 GitHub stars. SynthScan examined 5,879 lines of code across 68 source files, recording 85 pattern matches distributed across 5 syntactic categories. The legacy adjusted pattern signal is 16.2 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 82 finding(s).
Are imports declared and package/API names verified? 1 finding(s).
Are wrappers, guards, and repeated structures necessary? 76 finding(s).
Which changes need focused human review? 85 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 85 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_release.py | 43 | def test_unreleased_notes_are_finalized_before_tagging(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 68 | def test_legacy_versioned_notes_are_used_without_a_notes_commit(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 80 | def test_notes_push_failure_leaves_retryable_state(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 110 | def test_prepared_changelog_pair_is_retryable(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 122 | def test_local_tag_retry_pushes_without_retagging(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 140 | def test_existing_github_release_skips_republish(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 155 | def test_legacy_notes_push_main_before_tagging(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 193 | def test_publish_failures_abort_without_reporting_success(release, tmp_path, monkeypatch, tag_state, failed_command): | CODE |
| LOW | tests/test_release.py | 215 | def test_github_release_lookup_failure_is_reported(release, monkeypatch): | CODE |
| LOW | tests/test_release.py | 227 | def test_main_reports_unexpected_os_error(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 249 | def test_non_main_branch_aborts_before_release_mutation(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 271 | def test_diverged_main_aborts_before_release_mutation(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 293 | def test_remote_tag_is_fetched_and_verified(release, monkeypatch): | CODE |
| LOW | tests/test_release.py | 318 | def test_pre_release_tag_does_not_block_a_new_final_tag(release, monkeypatch): | CODE |
| LOW | tests/test_release.py | 334 | def test_tag_on_another_commit_is_rejected(release, monkeypatch): | CODE |
| LOW | tests/test_release.py | 354 | def test_remote_tag_on_another_commit_is_rejected(release, monkeypatch): | CODE |
| LOW | tests/test_release.py | 374 | def test_missing_executable_returns_a_readable_command_error(release, monkeypatch): | CODE |
| LOW | tests/test_release.py | 392 | def test_invalid_changelog_states_abort_before_writing(release, tmp_path, monkeypatch, versioned, unreleased): | CODE |
| LOW | tests/test_release.py | 407 | def test_empty_unreleased_notes_abort_before_writing(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 420 | def test_empty_legacy_notes_abort_before_writing(release, tmp_path, monkeypatch): | CODE |
| LOW | tests/test_release.py | 432 | def test_dirty_worktree_aborts_before_release_commands(release, monkeypatch): | CODE |
| LOW | tests/test_release.py | 447 | def test_outer_and_generated_release_scripts_stay_aligned(): | CODE |
| LOW | tests/test_post_gen_project.py | 62 | def test_declining_setup_has_no_git_or_github_side_effects(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 78 | def test_visibility_reprompts_and_defaults_to_private(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 108 | def test_final_confirmation_cancels_before_any_write(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 133 | def test_empty_existing_repository_requires_separate_consent(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 166 | def test_nonempty_existing_repository_is_never_modified(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 190 | def test_explicit_public_mode_supports_noninteractive_automation(hook, monkeypatch): | CODE |
| LOW | tests/test_post_gen_project.py | 224 | def test_github_setup_pins_one_host_when_ambient_host_differs(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 278 | def test_explicit_private_mode_leaves_pages_disabled(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 321 | def test_push_uses_github_cli_git_protocol(hook, monkeypatch, protocol, remote_url): | CODE |
| LOW | tests/test_post_gen_project.py | 339 | def test_https_setup_configures_git_credentials(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 360 | def test_ssh_setup_does_not_change_git_credentials(hook, monkeypatch): | CODE |
| LOW | tests/test_post_gen_project.py | 371 | def test_https_credential_failure_stops_before_git_or_github_writes(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 402 | def test_commit_failure_reports_partial_local_git_state(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 422 | def test_unsupported_git_protocol_stops_before_writes(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 436 | def test_remote_settings_precede_first_push_and_push_failure_is_reported(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 472 | def test_explicit_automation_failure_returns_nonzero(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 496 | def test_pages_failure_is_reported_without_false_success(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 510 | def test_docs_deployment_failure_is_reported_with_recovery_command(hook, monkeypatch, capsys): | CODE |
| LOW | tests/test_post_gen_project.py | 532 | def test_description_is_rendered_as_a_safe_string_literal(tmp_path, description): | CODE |
| LOW | tests/test_post_gen_project.py | 539 | def test_all_hook_template_values_are_rendered_safely(tmp_path): | CODE |
| LOW | tests/test_bake_project.py | 22 | def test_year_compute_in_license_file(cookies): | CODE |
| LOW | tests/test_bake_project.py | 40 | def test_bake_starts_with_an_unreleased_changelog(cookies): | CODE |
| LOW | tests/test_bake_project.py | 50 | def test_baked_release_script_runs_the_release_lifecycle(cookies, monkeypatch): | CODE |
| LOW | tests/test_bake_project.py | 94 | def test_bake_withspecialchars_and_run_tests(cookies): | CODE |
| LOW | tests/test_bake_project.py | 102 | def test_bake_with_apostrophe_and_run_tests(cookies): | CODE |
| LOW | tests/test_bake_project.py | 117 | def test_bake_preserves_description_in_valid_toml(cookies, description): | CODE |
| LOW | tests/test_bake_project.py | 127 | def test_bake_builds_when_package_and_import_names_differ(cookies): | CODE |
| LOW | tests/test_bake_project.py | 140 | def test_bake_treats_import_name_as_data(cookies, tmp_path): | CODE |
| LOW | tests/test_bake_project.py | 152 | def test_just_quality_recipes(cookies): | CODE |
| LOW⚡ | tests/test_bake_project.py | 168 | def test_py_typed_marker_exists(cookies): | CODE |
| LOW⚡ | tests/test_bake_project.py | 176 | def test_typing_classifier_in_pyproject(cookies): | CODE |
| LOW⚡ | tests/test_bake_project.py | 184 | def test_baked_workflows_support_private_repositories(cookies): | CODE |
| LOW | tests/test_readme_author.py | 4 | def test_readme_created_by_without_website(cookies): | CODE |
| LOW | tests/test_readme_author.py | 32 | def test_readme_created_by_with_website(cookies): | CODE |
| LOW | tests/test_readme_author.py | 53 | def test_readme_no_duplicate_links(cookies): | CODE |
| LOW⚡ | tests/test_cli.py | 16 | def test_readme_direct_cookiecutter_command_keeps_failed_projects(): | CODE |
| LOW⚡ | tests/test_cli.py | 23 | def test_find_template_dir_in_source_checkout(monkeypatch, tmp_path): | CODE |
| LOW⚡ | tests/test_cli.py | 33 | def test_find_template_dir_in_installed_package(monkeypatch, tmp_path): | CODE |
| 14 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/tutorial.md | 15 | ## Step 1: Generate your package | COMMENT |
| LOW | docs/tutorial.md | 103 | ## Step 2: Look around | COMMENT |
| LOW | docs/tutorial.md | 125 | ## Step 3: Install and verify | COMMENT |
| LOW | docs/tutorial.md | 145 | ## Step 4: Preview docs locally | COMMENT |
| LOW | docs/tutorial.md | 153 | ## Step 5: Write some code | COMMENT |
| LOW | docs/tutorial.md | 174 | ## Step 6: Set up PyPI publishing | COMMENT |
| LOW | docs/tutorial.md | 196 | ## Step 7: Release | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_bake_project.py | 199 | "${{ github.event.repository.private == false || vars.CODE_SECURITY_ENABLED == 'true' }}" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | dev.py | 61 | except Exception as e: | CODE |
| MEDIUM | dev.py | 62 | print(f"Error running cookiecutter: {e}") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | hooks/post_gen_project.py | 542 | CODE |