AI Slop Code Risk Monitor

balderdashy/sails

SlopCodeMonitor badge for balderdashy/sails Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Realtime MVC Framework for Node.js

3.8 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for balderdashy/sails, a JavaScript project with 22,779 GitHub stars. SynthScan examined 66,145 lines of code across 672 source files, recording 136 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 3.8 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

3.8
Adjusted Signal
3.8
Raw Pattern Score
100%
Time Factor
2026-05-27
Last Push
22.8K
Stars
JavaScript
Language
66.1K
Lines of Code
672
Files
136
Pattern Hits
2026-10-31
Scan Date
0.01
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 92 finding(s).

Hallucinated Dependency & Supply Chain Risk 3.3/100 · LOW

Are imports declared and package/API names verified? 8 finding(s).

Agent Over-Engineering Ratio 8.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 43 finding(s).

PR Review Velocity Impact 17.2/100 · LOW

Which changes need focused human review? 136 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 4HIGH 0MEDIUM 39LOW 93

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 136 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators36 hits · 108 pts
SeverityFileLineSnippetContext
MEDIUMtest/unit/virtual-request-interpreter.test.js27 // ╚═╝ ╚═╝╚══════╝╚══════╝╚═╝╚═╝ ╚═╝╚══════╝╚═════╝ ╚═╝╚═╝ ╚═╝╚══════╝ ╚═════╝ ╚═╝ ╚═╝╚═╝COMMENT
MEDIUMtest/unit/virtual-request-interpreter.test.js106 // ╚═╝ ╚═╝╚══════╝╚══════╝╚═╝╚══════╝╚══════╝╚═╝ ╚═══╝╚═════╝ ╚═╝╚═╝ ╚═════╝COMMENT
MEDIUMtest/unit/virtual-request-interpreter.test.js113 // ╚═╝ ╚═╝╚══════╝╚══════╝╚═╝ ╚════╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═══╝ ╚═╝╚═╝COMMENT
MEDIUMtest/integration/hook.i18n.test.js19// ╚═╝ ╚═╝ ╚════╝ ╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝COMMENT
MEDIUMtest/integration/hook.i18n.test.js26// ╚═╝ ╚═════╝ ╚═══╝ ╚══════╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚══════╝╚═╝COMMENT
MEDIUMtest/integration/hook.i18n.test.js149// ╚═╝ ╚═╝ ╚════╝ ╚═╝ ╚═══╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═══╝╚═╝ ╚═╝ ╚═════╝COMMENT
MEDIUM…ntegration/hook.pubsub.modelEvents.subscribers.test.js106 // ╚═════╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ ╚══════╝COMMENT
MEDIUM…ntegration/hook.pubsub.modelEvents.subscribers.test.js329 // ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚══════╝COMMENT
MEDIUM…ntegration/hook.pubsub.modelEvents.subscribers.test.js458 // ╚═╝ ╚═╝╚═════╝ ╚═════╝COMMENT
MEDIUM…ntegration/hook.pubsub.modelEvents.subscribers.test.js592 // ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═══╝ ╚══════╝COMMENT
MEDIUM…ntegration/hook.pubsub.modelEvents.subscribers.test.js677 // ╚═╝ ╚═╝╚══════╝╚═╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚══════╝COMMENT
MEDIUM…ntegration/hook.pubsub.modelEvents.subscribers.test.js808 // ╚═════╝ ╚══════╝╚══════╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝COMMENT
MEDIUMtest/integration/hook.blueprints.restful.routes.test.js521 // ╚═╝ ╚═╝╚══════╝╚══════╝ ╚═════╝ ╚═════╝╚═╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═══╝╚══════╝COMMENT
MEDIUMlib/app/load.js154 // ╚═╝ ╚═╝╚═╝ ╚═══╝╚══════╝╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═══╝ ╚═════╝ ╚══════╝╚═╝ ╚══════╝ ╚COMMENT
MEDIUMlib/app/load.js288 // ╚═╝╚═╝ ╚═╝╚═╝ ╚═══╝╚══════╝╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═══╝ ╚═════╝ ╚══════╝╚═╝ ╚═════COMMENT
MEDIUMlib/app/private/loadHooks.js45 // ╚═╝ ╚═╝╚═╝ ╚═══╝╚══════╝╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═══╝ ╚═════╝ ╚══════╝╚═╝ ╚══════╝ COMMENT
MEDIUMlib/app/private/loadHooks.js250 // ╚═╝╚═╝ ╚═╝╚═╝ ╚═══╝╚══════╝╚═╝╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═══╝ ╚═════╝ ╚══════╝╚═╝ ╚═══COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js42 // ╚══════╝╚══════╝ ╚═╝ ╚═════╝ ╚═╝COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js98 // ╚═╝ ╚═╝╚═╝ ╚═══╝╚═════╝ ╚═╝COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js105 // ╚═╝ ╚═╝╚═╝ ╚═══╝╚═════╝ ╚═════╝ ╚═╝ ╚═══╝╚══════╝COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js250 // ╚═════╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ ╚══════╝COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js290 // ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚══════╝COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js333 // ╚═════╝ ╚══════╝╚══════╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js356 // ╚═╝ ╚═╝╚═════╝ ╚═════╝COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js375 // ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═══╝ ╚══════╝COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js394 // ╚═╝ ╚═╝╚══════╝╚═╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝╚══════╝COMMENT
MEDIUMlib/hooks/blueprints/parse-blueprint-options.js434 // ╚═╝ ╚═════╝ ╚═╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚══════╝COMMENT
MEDIUMlib/hooks/security/index.js51 // ╚═════╝ ╚═════╝ ╚═╝ ╚═══╝╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝COMMENT
MEDIUMlib/hooks/security/index.js58 // ╚═════╝╚══════╝╚═╝ ╚═╝╚═╝COMMENT
MEDIUMlib/hooks/security/index.js116 // ╚═════╝ ╚═════╝ ╚═╝ ╚═══╝╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝COMMENT
MEDIUMlib/hooks/security/index.js123 // ╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝COMMENT
MEDIUMlib/hooks/pubsub/index.js185 // ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝ ╚═════╝COMMENT
MEDIUMlib/hooks/pubsub/index.js355 // ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝ ╚══════╝COMMENT
MEDIUMlib/hooks/views/html-scriptify.js57 // ╚═══╝ ╚═╝ ╚═╝╚══════╝╚═╝╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚══════╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚══════╝COMMENT
MEDIUMlib/hooks/views/html-scriptify.js135 // ╚═════╝ ╚═════╝ ╚═╝╚══════╝╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝╚══════╝COMMENT
MEDIUMlib/hooks/views/html-scriptify.js142 // ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝COMMENT
Over-Commented Block77 hits · 77 pts
SeverityFileLineSnippetContext
LOWappveyor.yml1# # # # # # # # # # # # # # # # # # # # # # # # # #COMMENT
LOWappveyor.yml41# (Not sure what this is for, it's just in Appveyor's example.COMMENT
LOWtest/init.js1// Initialization script that runs once before any tests.COMMENT
LOWtest/unit/virtual-request-interpreter.test.js101 // ██████╗ ███████╗███████╗ ███████╗███████╗███╗ ██╗██████╗ ██╗██╗ ██╗COMMENT
LOWtest/unit/virtual-request-interpreter.test.js121 // return res.send(false); // 215b (sends down the string `false`, content len ==> 5)COMMENT
LOW…st/helpers/test-spawning-sails-child-process-in-cwd.js41 * Also if it is set AND `httpRequestInstructions` are set, then the HTTP requestCOMMENT
LOWtest/helpers/router.js121// var helper = {COMMENT
LOWtest/helpers/router.js141// // Emit a request event (will be intercepted by the Router)COMMENT
LOWtest/helpers/router.js161// return function () {COMMENT
LOWtest/helpers/router.js181// url: '/',COMMENT
LOWtest/helpers/router.js201// var _enhancedRes = util.defaults(res || {}, {COMMENT
LOWtest/helpers/router.js221COMMENT
LOWtest/helpers/router.js241// *COMMENT
LOWtest/helpers/router.js261// return {COMMENT
LOWtest/helpers/router.js281// var expectedResponse = { status: 200 };COMMENT
LOWtest/helpers/router.js301// __it('should have sent the proper response', expect.equal('response', expectedResponse));COMMENT
LOWbin/sails.js161// FUTURE: ^^ Consider simplifying this into a script.COMMENT
LOWbin/sails-run.js261 // Maybe as an option at least.COMMENT
LOWbin/sails-run.js281 // ```COMMENT
LOWbin/sails-console.js41COMMENT
LOWbin/sails-console.js141 // Return the new writable stream.COMMENT
LOWbin/sails-console.js161 preview: false,COMMENT
LOWdocs/concepts/Security/XSS.md41// },COMMENT
LOWdocs/concepts/Realtime/Realtime.md101 // are _listening_. In other words, to actually handle the socket message,COMMENT
LOWdocs/concepts/ORM/Associations/OneWayAssociation.md41}COMMENT
LOWdocs/concepts/ORM/Associations/OnetoMany.md81 // lastName: 'Bar',COMMENT
LOWlib/index.js1/**COMMENT
LOWlib/app/load.js101 controller: ['hooks', function(results, cb) {COMMENT
LOWlib/app/load.js141COMMENT
LOWlib/app/load.js281 }COMMENT
LOWlib/app/lower.js121 // Allow process to exit once this server is closedCOMMENT
LOWlib/app/configuration/rc.js21COMMENT
LOWlib/app/private/bootstrap.js21module.exports = function runBootstrap(done) {COMMENT
LOWlib/app/private/loadHooks.js81 // // If so, something is wrong.COMMENT
LOWlib/app/private/loadHooks.js241 process.nextTick(function(){ cb(); });COMMENT
LOWlib/app/private/isLocalSailsValid.js81 log.debug(requiredSailsVersion);COMMENT
LOWlib/hooks/moduleloader/index.js21 // • 'js' (.js)COMMENT
LOWlib/hooks/moduleloader/index.js61 // Paths for application modules and key filesCOMMENT
LOWlib/hooks/moduleloader/index.js121 // ConfigurationCOMMENT
LOWlib/hooks/moduleloader/index.js421 // Look inside namespaced folders e.g. node_modules/@sailsjs/sails-hook-fooCOMMENT
LOWlib/hooks/blueprints/index.js61 // Blueprint/Shadow-Routes EnabledCOMMENT
LOWlib/hooks/blueprints/actions/create.js81 // e.g.COMMENT
LOWlib/hooks/blueprints/actions/add.js41COMMENT
LOWlib/hooks/blueprints/actions/replace.js141 return res.serverError(err);COMMENT
LOWlib/hooks/blueprints/actions/replace.js161 // blueprint action would have been rolled back along with the transactionCOMMENT
LOWlib/hooks/security/index.js41 },COMMENT
LOWlib/hooks/http/initialize.js21 // or if it is disabled, then go ahead and proceedCOMMENT
LOWlib/hooks/http/initialize.js201 // (see https://github.com/balderdashy/sails/pull/3599#issuecomment-195665040)COMMENT
LOWlib/hooks/http/initialize.js321 }COMMENT
LOWlib/hooks/http/initialize.js341COMMENT
LOWlib/hooks/http/index.js61 // and `./get-configured-http-middleware-fns.js` in this hook for details.COMMENT
LOWlib/hooks/http/index.js121 // If no _explicit_ middleware order is specified, make sure the implicit default orderCOMMENT
LOWlib/hooks/http/get-configured-http-middleware-fns.js21 * @property {Function} *COMMENT
LOWlib/hooks/request/params.all.js41 }COMMENT
LOWlib/hooks/request/params.all.js61 // value: function (){COMMENT
LOWlib/hooks/request/metadata.js21module.exports = function _mixinServerMetadata(req) {COMMENT
LOWlib/hooks/views/default-view-rendering-fn.js201COMMENT
LOWlib/hooks/views/res.view.js261 // Note:COMMENT
LOWlib/hooks/views/res.view.js381 if (err) {COMMENT
LOW…s/views/unescape-html-entities-deep-lite.min.string.js1// This module exports the `toString()`-ed, minified version of the function defined below (`unescapeHtmlEntitiesDeepLitCOMMENT
17 more matches not shown…
Hallucination Indicators4 hits · 40 pts
SeverityFileLineSnippetContext
CRITICALlib/hooks/security/index.js159 sails.config.security.cors.allowOrigins = _.map(sails.config.security.cors.allowOrigins.split(','), function(oriCODE
CRITICALlib/hooks/security/index.js207 sails.config.security.cors.allowOrigins = _.map(sails.config.security.cors.allowOrigins.split(','), function(oriCODE
CRITICALlib/hooks/http/index.js233 if (!_.contains(sails.config.http.middleware.order.concat(['404', '500', 'startRequestTimer']), middlewareName))CODE
CRITICALlib/hooks/http/index.js249 _.each(_.difference(sails.config.http.middleware.order, sails.hooks.http.defaults.http.middleware.order.concat(['4CODE
Structural Annotation Overuse5 hits · 10 pts
SeverityFileLineSnippetContext
LOW⚡docs/upgrading/To1.0.md34##### Step 0: Check your Node version!COMMENT
LOW⚡docs/upgrading/To1.0.md38##### Step 1: Install hooks & update dependenciesCOMMENT
LOW⚡docs/upgrading/To1.0.md48##### Step 2: Update configurationCOMMENT
LOWdocs/upgrading/To1.0.md61##### Step 3: Modify client-side code for the new blueprint APICOMMENT
LOWdocs/upgrading/To1.0.md72##### Step 4: Adopt the new release of Waterline ORMCOMMENT
Hyper-Verbose Identifiers7 hits · 7 pts
SeverityFileLineSnippetContext
LOW…st/helpers/test-spawning-sails-child-process-in-cwd.js44module.exports = function testSpawningSailsLiftChildProcessInCwd (opts){CODE
LOW…lpers/test-spawning-sails-lift-child-process-in-cwd.js45module.exports = function testSpawningSailsLiftChildProcessInCwd (_opts){CODE
LOWbin/private/read-repl-history-and-start-transcribing.js23module.exports = function readReplHistoryAndBeginTranscribing(repl, file) {CODE
LOWlib/hooks/responses/index.js74 sails.modules.loadResponses(function loadedRuntimeErrorModules(err, responseDefs) {CODE
LOW…s/views/unescape-html-entities-deep-lite.min.string.js9module.exports = 'function unescapeHtmlEntitiesDeepLite(r){if("function"!=typeof Array.isArray||"function"!=typeof ArrayCODE
LOW…s/views/unescape-html-entities-deep-lite.min.string.js67function unescapeHtmlEntitiesDeepLite(data){CODE
LOWlib/router/index.js395Router.prototype.getActionIdentityForTarget = function getActionIdentityForTarget(target) {CODE
Fake / Example Data4 hits · 4 pts
SeverityFileLineSnippetContext
LOWtest/integration/middleware.compression.test.js19 var lipsum = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras fringilla mollis sapien sed consequat. CCODE
LOWtest/integration/middleware.compression.test.js19 var lipsum = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras fringilla mollis sapien sed consequat. CCODE
LOWdocs/concepts/Configuration/Configuration.md108// Set a custom "email" value to "foo@bar.com":COMMENT
LOWdocs/concepts/Configuration/Configuration.md109sails lift --custom.email='foo@bar.com'CODE
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMlib/hooks/request/metadata.js40 // But Express only delivers the host devoid of a port, so we have to delve intoCOMMENT
Slop Phrases1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMlib/hooks/views/res.view.js434// While unlikely this will change, it's worth noting that this implementationCOMMENT
Modern AI Meta-Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUM…s/concepts/extending-sails/Generators/generatorList.md63+ [sails-generate-scaffold](https://github.com/irlnathan/sails-generate-scaffold)CODE