5.5

Adjusted Signal

5.5

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

8.3K

Stars

Ruby

Language

88.2K

Lines of Code

1.2K

Files

315

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 18.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 291 finding(s).

Hallucinated Dependency & Supply Chain Risk 7.1/100 · LOW

Are imports declared and package/API names verified? 22 finding(s).

Agent Over-Engineering Ratio 7.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 121 finding(s).

PR Review Velocity Impact 23.7/100 · LOW

Which changes need focused human review? 315 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 12HIGH 0MEDIUM 27LOW 276

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 315 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block133 hits · 133 pts

Severity	File	Line	Snippet	Context
LOW	mise.saas.toml	1	# SaaS-only mise overlay, loaded when MISE_ENV=saas (mise environment	COMMENT
LOW	app/models/oauth.rb	41		COMMENT
LOW	app/models/oauth.rb	81	# Dynamic client registration is open and unauthenticated, so a remote	COMMENT
LOW	app/models/token_digester.rb	1	# Bearer credentials (access tokens, refresh tokens, client secrets) are	COMMENT
LOW	app/models/oauth/availability.rb	1	# Availability switches for the OAuth authorization server, so it can ship dark.	COMMENT
LOW	app/models/oauth/availability.rb	21	#	COMMENT
LOW	app/models/oauth/availability.rb	41	# The switches above choose clients. staff_only chooses people: while it's on,	COMMENT
LOW	app/models/oauth/first_party_clients.rb	1	# Canonical registry of the OAuth clients Fizzy ships with, as bc3's	COMMENT
LOW	app/models/oauth/first_party_clients.rb	41	}.freeze	COMMENT
LOW	app/models/oauth/first_party_clients.rb	101	else	COMMENT
LOW	app/models/oauth/client_metadata.rb	1	# Client ID Metadata Documents (CIMD, draft-ietf-oauth-client-id-metadata-document):	COMMENT
LOW	app/models/oauth/retired_refresh_token.rb	1	# A refresh token its grant has rotated away from. Presenting one again is	COMMENT
LOW	app/models/oauth/client.rb	1	class Oauth::Client < ApplicationRecord	COMMENT
LOW	app/models/oauth/client.rb	21	GRANT_TYPES = %w[ authorization_code refresh_token ]	COMMENT
LOW	app/models/oauth/client.rb	121	personal_access.take or raise	COMMENT
LOW	app/models/oauth/audit.rb	1	# OAuth lifecycle events, in the 37signals OAuth Standard's vocabulary	COMMENT
LOW	app/models/oauth/token_delegation.rb	1	# RFC 8693 token delegation (hosted plan, phase C): the hosted Fizzy MCP	COMMENT
LOW	app/models/oauth/token_delegation.rb	21	# own expiry; the server exchanges again when it lapses.	COMMENT
LOW	app/models/oauth/token_delegation.rb	101		COMMENT
LOW	app/models/oauth/client_metadata/fetcher.rb	1	require "net/http"	COMMENT
LOW	app/models/oauth/client_metadata/fetcher.rb	21	# and would send the request somewhere else. TLS verifies the peer against	COMMENT
LOW	app/models/oauth/client_metadata/document.rb	1	# Validates a fetched client metadata document and maps it to the attributes an	COMMENT
LOW	app/models/oauth/client_metadata/resolver.rb	1	# Looks up, fetches and persists metadata document clients for the authorization	COMMENT
LOW	app/models/identity/access_token.rb	1	class Identity::AccessToken < ApplicationRecord	COMMENT
LOW	app/models/identity/access_token.rb	21	# none and reach every account their identity belongs to.	COMMENT
LOW	app/models/identity/access_token.rb	41	# token, revocation by possession, Connected Apps) reads one of these, or	COMMENT
LOW	app/models/identity/access_token.rb	81	# memory, on the record that issued or rotated them, to be handed to their	COMMENT
LOW	app/models/identity/access_token.rb	101	# transaction would then wait on the client's lock. A replayed code exchange	COMMENT
LOW	app/models/identity/access_token.rb	121	# event always describes a grant that was really issued or really ended.	COMMENT
LOW	app/models/identity/access_token.rb	141	# replica, which may have neither the token nor, for a grant just	COMMENT
LOW	app/models/zip_file/reader.rb	1	class ZipFile::Reader	COMMENT
LOW	app/models/push/subscription.rb	21	# unlapsed grant to its app. That covers every way the two come apart (the	COMMENT
LOW	app/models/concerns/attachments.rb	1	module Attachments	COMMENT
LOW	app/javascript/lib/action_pack/passkey.js	1	// Web components for the ActionPack::Passkey Ruby helpers.	COMMENT
LOW	app/jobs/search_reindex_job.rb	1	# Repair task — reindexes every searchable Card and Comment in the database.	COMMENT
LOW	app/controllers/oauth/tokens_controller.rb	21	# that counted requests first would answer 429 to the eleventh, not 404.	COMMENT
LOW	app/controllers/oauth/tokens_controller.rb	361	client_authentication_failed	COMMENT
LOW	app/controllers/oauth/base_controller.rb	1	class Oauth::BaseController < ApplicationController	COMMENT
LOW	app/controllers/oauth/base_controller.rb	81	# The client a request acts for, if it names one.	COMMENT
LOW	app/controllers/oauth/revocations_controller.rb	1	# Token revocation (RFC 7009). The server validates the client's credentials	COMMENT
LOW	…ontrollers/oauth/authorizations/switches_controller.rb	1	# "Not you?" on the consent screen. Signs the person out, then brings whoever	COMMENT
LOW	app/controllers/concerns/authentication.rb	101	def bearer_authorization?	COMMENT
LOW	app/controllers/concerns/oauth/client_authentication.rb	1	# Client credentials arrive one of two ways (RFC 6749 §2.3.1):	COMMENT
LOW	app/controllers/concerns/oauth/client_authentication.rb	61	# A failed Basic authentication is a 401 challenging Basic (RFC 6749 §5.2):	COMMENT
LOW	app/helpers/pagination_helper.rb	1	module PaginationHelper	COMMENT
LOW	test/integration/pagination_blob_html_xss_test.rb	1	require "test_helper"	COMMENT
LOW	…t/test_helpers/trusted_types_violations_test_helper.rb	1	# Inventories the Trusted Types violations system tests trip, without failing	COMMENT
LOW	test/channels/solid_cable_adapter_test.rb	1	require "test_helper"	COMMENT
LOW	config/locales/en.yml	1	# Files in the config/locales directory are used for internationalization and	COMMENT
LOW	config/locales/en.yml	21	#	COMMENT
LOW	config/environments/production.rb	61	end	COMMENT
LOW	config/environments/production.rb	121		COMMENT
LOW	config/environments/production.rb	141		COMMENT
LOW	config/environments/test.rb	1	require "active_support/core_ext/integer/time"	COMMENT
LOW	config/initializers/permissions_policy.rb	1	# Be sure to restart your server when you modify this file.	COMMENT
LOW	config/initializers/content_security_policy.rb	1	# Be sure to restart your server when you modify this file.	COMMENT
LOW	config/initializers/content_security_policy.rb	21	# of HTML responses that carry the Trusted Types report-only policy below.	COMMENT
LOW	config/initializers/inflections.rb	1	# Be sure to restart your server when you modify this file.	COMMENT
LOW	config/initializers/active_storage_no_reuse.rb	1	# Enforce storage ledger integrity by preventing blob reuse in tracked contexts.	COMMENT
LOW	lib/rails_ext/active_record_replica_support.rb	1	# frozen_string_literal: true	COMMENT
73 more matches not shown…

Hyper-Verbose Identifiers119 hits · 125 pts

Severity	File	Line	Snippet	Context
LOW	app/mailers/user_mailer.rb	2	def email_change_confirmation(email_address:, token:, user:)	CODE
LOW	app/models/application_platform.rb	83	def extract_list_from_native_user_agent(prefix)	CODE
LOW	app/models/color.rb	17	def extract_from_legacy_export(value)	CODE
LOW	app/models/signup.rb	53	def handle_account_creation_error(error)	CODE
LOW	app/models/card/readable.rb	32	def inaccessible_notifications_from(sources, accessible_user_ids)	CODE
LOW	app/models/card/eventable.rb	35	def create_system_comment_for(event)	CODE
LOW	app/models/card/exportable.rb	41	def attachment_representation(attachment)	CODE
LOW	app/models/identity/access_token.rb	256	def find_honored_delegated_on_primary(token)	CODE
LOW	app/models/identity/access_token.rb	274	def find_and_digest_undigested(raw)	CODE
LOW	app/models/board/accessible.rb	43	def clean_inaccessible_data_for(user)	CODE
LOW	app/models/board/storage.rb	56	def sum_blob_bytes_in_batches(base_scope, record_ids)	CODE
LOW	app/models/notification/event_payload.rb	100	def card_url_with_comment_anchor(comment)	CODE
LOW	app/models/magic_link/code.rb	26	def remove_invalid_characters(code)	CODE
LOW	app/models/zip_file/reader.rb	95	def ensure_declared_within_budget(entry)	CODE
LOW	app/models/user/email_address_changeable.rb	7	def change_email_address_using_token(token)	CODE
LOW	app/models/user/email_address_changeable.rb	20	def send_email_address_change_confirmation(new_email_address)	CODE
LOW	app/models/user/email_address_changeable.rb	41	def generate_email_address_change_token(from: identity.email_address, to:, **options)	CODE
LOW	app/models/user/attachable.rb	7	def attachable_plain_text_representation(...)	CODE
LOW	app/models/user/notifiable.rb	18	def find_or_create_bundle_for(notification)	CODE
LOW	app/models/user/notifiable.rb	26	def expand_pending_bundle_for(notification)	CODE
LOW	app/models/search/query.rb	48	def remove_invalid_search_characters(terms)	CODE
LOW	app/models/account/data_transfer/record_set.rb	139	def check_associations_dont_exist(data)	CODE
LOW	app/models/account/data_transfer/record_set.rb	149	def check_association_doesnt_exist(data, association, associated_id)	CODE
LOW	app/models/account/data_transfer/record_set.rb	175	def check_unique_keys_available(data)	CODE
LOW	app/models/account/data_transfer/record_set.rb	187	def check_unique_key_available(column, value)	CODE
LOW	app/models/account/data_transfer/manifest.rb	81	def set_importable_model_names(record_sets)	CODE
LOW	…ount/data_transfer/action_text/rich_text_record_set.rb	57	def transform_body_for_export(content)	CODE
LOW	…ount/data_transfer/action_text/rich_text_record_set.rb	102	def transform_body_for_import(body)	CODE
LOW	app/models/concerns/storage/tracked.rb	71	def storage_attachments_for_records(recordables)	CODE
LOW	app/javascript/helpers/scroll_helpers.js	39	function findNearestScrollableYAncestor(refElement) {	CODE
LOW	app/javascript/helpers/scroll_helpers.js	50	function findNearestScrollableXAncestor(refElement) {	CODE
LOW	app/controllers/oauth/base_controller.rb	54	def refuse_malformed_parameters(names)	CODE
LOW	app/controllers/oauth/base_controller.rb	58	def malformed_parameters_description(names)	CODE
LOW	app/controllers/oauth/clients_controller.rb	40	def refuse_malformed_parameters(names)	CODE
LOW	app/controllers/oauth/clients_controller.rb	112	def dynamic_client_registration_response(client)	CODE
LOW	app/controllers/prompts/cards_controller.rb	32	def prepending_exact_matches_by_id(cards)	CODE
LOW	app/controllers/concerns/authentication.rb	18	def require_unauthenticated_access(**options)	CODE
LOW	app/controllers/concerns/authentication.rb	23	def allow_unauthenticated_access(**options)	CODE
LOW	app/controllers/concerns/authentication.rb	162	def request_bearer_authentication(status: :unauthorized, **params)	CODE
LOW	app/controllers/concerns/authorization.rb	9	def allow_unauthorized_access(**options)	CODE
LOW	app/controllers/concerns/authorization.rb	13	def require_access_without_a_user(**options)	CODE
LOW	…/controllers/concerns/authentication/via_magic_link.rb	15	def redirect_to_fake_session_magic_link(email_address, **options)	CODE
LOW	…/controllers/concerns/authentication/via_magic_link.rb	25	def redirect_to_session_magic_link(magic_link, return_to: nil)	CODE
LOW	…/controllers/concerns/authentication/via_magic_link.rb	36	def serve_development_magic_link(magic_link)	CODE
LOW	…/controllers/concerns/authentication/via_magic_link.rb	43	def set_pending_authentication_token(magic_link)	CODE
LOW	app/helpers/oauth_helper.rb	35	def oauth_client_display_identity(client, redirect_uri)	CODE
LOW	app/helpers/oauth_helper.rb	58	def oauth_client_remote_hosts(client)	CODE
LOW	app/helpers/oauth_helper.rb	74	def oauth_strongest_permission(tokens)	CODE
LOW	app/helpers/oauth_helper.rb	90	def oauth_connected_app_reach(tokens)	CODE
LOW	app/helpers/cards_helper.rb	42	def button_to_remove_card_image(card)	CODE
LOW	app/helpers/notifications_helper.rb	42	def notification_toggle_read_button(notification, url:)	CODE
LOW⚡	app/helpers/notifications_helper.rb	64	def notifications_next_page_link(page)	CODE
LOW⚡	app/helpers/notifications_helper.rb	70	def bundle_email_frequency_options_for(settings)	CODE
LOW⚡	app/helpers/notifications_helper.rb	80	def event_notification_action(event)	CODE
LOW⚡	app/helpers/notifications_helper.rb	88	def comment_notification_body(event)	CODE
LOW	app/helpers/filters_helper.rb	14	def filter_selected_boards_title(user_filtering)	CODE
LOW	app/helpers/accesses_helper.rb	18	def access_involvement_advance_button(board, user, show_watchers: true, icon_only: false)	CODE
LOW	app/helpers/bridge_helper.rb	24	def bridge_share_card_description(card)	CODE
LOW	app/helpers/bridge_helper.rb	32	def bridge_share_board_description(board)	CODE
LOW	app/helpers/clipboard_helper.rb	2	def button_to_copy_to_clipboard(url, &)	CODE
59 more matches not shown…

Hallucination Indicators12 hits · 120 pts

Severity	File	Line	Snippet	Context
CRITICAL	app/controllers/boards_controller.rb	40	@board.account.users.active.alphabetically.includes(:identity).partition { \|user\| selected_user_ids.include? user.	CODE
CRITICAL	app/controllers/notifications_controller.rb	6	@unread = Current.user.notifications.unread.ordered.preloaded.limit(max_unread_notifications) unless current_page_pa	CODE
CRITICAL	app/controllers/users_controller.rb	9	set_page_and_extract_portion_from Current.account.users.active.alphabetically.includes(:identity)	CODE
CRITICAL	app/controllers/cards/assignments_controller.rb	5	@assigned_to = @card.assignees.active.alphabetically.where.not(id: Current.user)	CODE
CRITICAL	app/controllers/cards/assignments_controller.rb	6	@users = @board.users.active.alphabetically.where.not(id: @card.assignees).where.not(id: Current.user)	CODE
CRITICAL	app/controllers/cards/taggings_controller.rb	6	@tags = Current.account.tags.all.alphabetically.where.not(id: @tagged_with)	CODE
CRITICAL	app/controllers/boards/accesses_controller.rb	5	set_page_and_extract_portion_from @board.account.users.active.alphabetically.includes(:identity)	CODE
CRITICAL	app/controllers/notifications/trays_controller.rb	17	Current.user.notifications.unread.preloaded.ordered.limit(MAX_ENTRIES_LIMIT)	CODE
CRITICAL	app/controllers/notifications/trays_controller.rb	21	Current.user.notifications.read.preloaded.ordered.limit(MAX_ENTRIES_LIMIT)	CODE
CRITICAL	script/load-prod-db-in-dev.rb	51	url = Rails.application.routes.url_helpers.root_url(Rails.application.config.action_controller.default_url_options.mer	CODE
CRITICAL	saas/test/integration/structured_log_redaction_test.rb	222	Rails.application.config.structured_logging.logger.stubs(:info).with { \|line\| lines << line }	CODE
CRITICAL	saas/test/controllers/sessions/reviewer_sign_in_test.rb	24	Rails.application.config.structured_logging.logger.stubs(:info).with { \|line\| lines << line }	CODE

Self-Referential Comments23 hits · 69 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/integration/active_storage_authorization_test.rb	110	# Create the draft card and attachment with proper Current context	COMMENT
MEDIUM	test/models/webhook/triggerable_test.rb	13	# Create a test event	COMMENT
MEDIUM	test/models/storage/attachment_tracking_test.rb	90	# Create a model that doesn't respond to :board	COMMENT
MEDIUM	test/models/storage/attachment_tracking_test.rb	104	# Create a card with nil board association won't happen in practice	COMMENT
MEDIUM	test/models/storage/totaled_test.rb	177	# Create a new account to destroy (don't destroy fixtures)	COMMENT
MEDIUM	test/models/account/import_test.rb	180	# Create a ZIP with no account.json	COMMENT
MEDIUM	…data_transfer/action_text/rich_text_record_set_test.rb	10	# Create a malicious ActionText record that points to the victim's card	COMMENT
MEDIUM	test/controllers/cards_controller_test.rb	310	# Create a card with custom timestamps (simulating import)	COMMENT
MEDIUM	config/initializers/permissions_policy.rb	3	# Define an application-wide HTTP permissions policy. For further	COMMENT
MEDIUM	config/initializers/content_security_policy.rb	3	# Define an application-wide Content Security Policy.	COMMENT
MEDIUM	lib/action_pack/web_authn/authenticator/attestation.rb	31	# The following methods are delegated to +authenticator_data+:	COMMENT
MEDIUM	db/schema.rb	1	# This file is auto-generated from the current state of the database. Instead	COMMENT
MEDIUM	db/schema.rb	5	# This file is the source Rails uses to define your schema when running `bin/rails	COMMENT
MEDIUM	db/queue_schema.rb	1	# This file is auto-generated from the current state of the database. Instead	COMMENT
MEDIUM	db/queue_schema.rb	5	# This file is the source Rails uses to define your schema when running `bin/rails	COMMENT
MEDIUM	db/cache_schema.rb	1	# This file is auto-generated from the current state of the database. Instead	COMMENT
MEDIUM	db/cache_schema.rb	5	# This file is the source Rails uses to define your schema when running `bin/rails	COMMENT
MEDIUM	db/cable_schema.rb	1	# This file is auto-generated from the current state of the database. Instead	COMMENT
MEDIUM	db/cable_schema.rb	5	# This file is the source Rails uses to define your schema when running `bin/rails	COMMENT
MEDIUM	db/schema_sqlite.rb	1	# This file is auto-generated from the current state of the database. Instead	COMMENT
MEDIUM	db/schema_sqlite.rb	5	# This file is the source Rails uses to define your schema when running `bin/rails	COMMENT
MEDIUM	saas/db/saas_schema.rb	1	# This file is auto-generated from the current state of the database. Instead	COMMENT
MEDIUM	saas/db/saas_schema.rb	5	# This file is the source Rails uses to define your schema when running `bin/rails	COMMENT

Fake / Example Data10 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	app/javascript/controllers/upload_preview_controller.js	4	static targets = [ "image", "input", "fileName", "placeholder" ]	CODE
LOW	…b_authn/public_key_credential/creation_options_test.rb	8	name: "user@example.com",	CODE
LOW	…b_authn/public_key_credential/creation_options_test.rb	16	assert_equal "user@example.com", @options.name	CODE
LOW	…b_authn/public_key_credential/creation_options_test.rb	42	assert_equal "user@example.com", user["name"]	CODE
LOW	…b_authn/public_key_credential/creation_options_test.rb	59	name: "user@example.com",	CODE
LOW	…b_authn/public_key_credential/creation_options_test.rb	81	name: "user@example.com",	CODE
LOW	…b_authn/public_key_credential/creation_options_test.rb	100	name: "user@example.com",	CODE
LOW	…b_authn/public_key_credential/creation_options_test.rb	113	name: "user@example.com",	CODE
LOW	…b_authn/public_key_credential/creation_options_test.rb	124	name: "user@example.com",	CODE
LOW	docs/api/sections/authentication.md	53	-d '{"email_address": "user@example.com"}' \	CODE

Decorative Section Separators2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	app/models/account/seeder.rb	24	# ---------------	COMMENT
MEDIUM	app/models/account/seeder.rb	26	# ---------------	COMMENT

Example Usage Blocks4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	app/jobs/search_reindex_job.rb	12	# Usage:	COMMENT
LOW	test/webmock_ipaddr_extension.rb	3	# Usage:	COMMENT
LOW	lib/rails_ext/active_record_replica_support.rb	6	# Usage:	COMMENT
LOW	lib/rails_ext/active_record_date_arithmetic.rb	6	# Usage:	COMMENT

Redundant / Tautological Comments4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	config/deploy.yml	19	ssl: true # Set this to false if you don't want SSL	CODE
LOW	config/environments/production.rb	25	# Set BASE_URL to your instance's public URL (e.g., https://fizzy.example.com)	COMMENT
LOW	config/environments/production.rb	109	# Set this to true and configure the email server for immediate delivery to raise delivery errors.	COMMENT
LOW	config/environments/test.rb	47	# Set host to be used by links generated in mailer templates.	COMMENT

Verbosity Indicators3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	test/integration/oauth_flow_test.rb	1994	# Step 1: Get consent screen	COMMENT
LOW	test/integration/oauth_flow_test.rb	2008	# Step 2: Grant consent	COMMENT
LOW	test/integration/oauth_flow_test.rb	2029	# Step 3: Exchange code for token	COMMENT

Structural Annotation Overuse3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	test/integration/oauth_flow_test.rb	1994	# Step 1: Get consent screen	COMMENT
LOW	test/integration/oauth_flow_test.rb	2008	# Step 2: Grant consent	COMMENT
LOW	test/integration/oauth_flow_test.rb	2029	# Step 3: Exchange code for token	COMMENT

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	lib/action_pack/web_authn/public_key_credential.rb	3	# Represents a WebAuthn public key credential and orchestrates the registration	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	db/migrate/20251113163145_ensure_account_id_index.rb	78	# a single index, since Triggerable only queries for `subscribed_actions` in conjunction with	COMMENT

basecamp/fizzy

Open-Source Code Quality, Security and Technical Debt Review