2.1

Adjusted Signal

2.1

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

30.5K

Stars

TypeScript

Language

531.9K

Lines of Code

1.9K

Files

907

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 635 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.5/100 · LOW

Are imports declared and package/API names verified? 215 finding(s).

Agent Over-Engineering Ratio 6.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 601 finding(s).

PR Review Velocity Impact 9.6/100 · LOW

Which changes need focused human review? 907 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 6HIGH 0MEDIUM 57LOW 844

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 907 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers544 hits · 552 pts

Severity	File	Line	Snippet	Context
LOW	demo/nextjs/app/dashboard/scim/settings.tsx	297	function createResourceConsoleUserBody(fixture: DirectoryFixture) {	CODE
LOW	demo/nextjs/app/dashboard/scim/settings.tsx	364	function createInitialOktaRecipeSteps(): OktaLocalRecipeStepState[] {	CODE
LOW	demo/nextjs/app/api/mcp/route.ts	8	function extractPresentedAccessToken(request: Request): string {	CODE
LOW	demo/nextjs/app/api/mcp/route.ts	32	function requireStringAccessTokenClaim(	CODE
LOW	demo/nextjs/app/(auth)/sign-in/_components/electron.tsx	12	export function ElectronManualSignInToast({	CODE
LOW	demo/nextjs/components/ui/chart.tsx	293	function getPayloadConfigFromPayload(	CODE
LOW	demo/nextjs/lib/scim-demo-identity.ts	30	export async function computeSCIMDemoWorkspaceId(operatorId: string) {	CODE
LOW	demo/nextjs/lib/scim-demo-identity.ts	44	function getSCIMDemoIdentitySecret() {	CODE
LOW	demo/nextjs/lib/scim-demo-identity.ts	138	export async function createSCIMDemoDirectoryFixtures(	CODE
LOW	demo/nextjs/lib/scim-demo-identity.ts	152	export async function createSCIMDemoOIDCManagementContext(	CODE
LOW	demo/nextjs/lib/scim-demo-identity.ts	195	export async function getConfiguredSCIMDemoOIDCManagementContext(	CODE
LOW	demo/nextjs/lib/scim-demo.ts	28	export function getSCIMDemoProvisioningDomainId(	CODE
LOW	demo/nextjs/lib/scim-demo.ts	48	export function isSCIMDemoEmployeePortalEnabled() {	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	176	function parseAuthorizationRequest(	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	254	export async function getSCIMDemoOIDCAuthorizationView(	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	289	export function getSCIMDemoOIDCAuthorizationPageURL(	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	304	export function getSCIMDemoOIDCAuthorizationFormFields(	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	324	export function getSCIMDemoOIDCRedirectURI() {	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	328	export function getSCIMDemoOIDCClientSecret() {	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	355	export function getSCIMDemoOIDCDiscoveryDocument() {	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	422	async function importConfiguredSigningKeys(value: string) {	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	486	export async function issueSCIMDemoOIDCAuthorizationCode(	CODE
LOW	demo/nextjs/lib/scim-demo-oidc.ts	573	export async function exchangeSCIMDemoOIDCAuthorizationCode(	CODE
LOW	demo/nextjs/lib/scim-demo-employee.ts	133	async function createVerificationIdentifier(	CODE
LOW	demo/nextjs/lib/scim-demo-employee.ts	192	export function inspectSCIMDemoEmployeeVerification(input: {	CODE
LOW	demo/nextjs/lib/scim-demo-employee.ts	234	async function resolveConnectionAndSource(	CODE
LOW	demo/nextjs/lib/scim-demo-employee.ts	266	async function resolveConnectionAndSourceByOrganization(	CODE
LOW	demo/nextjs/lib/scim-demo-employee.ts	532	export function getSCIMDemoEmployeePortalToken(	CODE
LOW	demo/nextjs/lib/scim-demo-employee.ts	655	function serializeSCIMDemoEmployeePortalCookie(token: string): string {	CODE
LOW	demo/nextjs/lib/scim-demo-management.ts	51	export function createSCIMDemoManagementError(	CODE
LOW	demo/nextjs/lib/scim-demo-management.ts	63	export function createSCIMDemoConnectionCreationRequestId(	CODE
LOW	demo/nextjs/lib/scim-demo-management.ts	69	export function isSCIMManagedCreationRequestConflict(error: unknown): boolean {	CODE
LOW	demo/nextjs/lib/scim-demo-management.ts	81	function getSCIMDemoManagementError(error: unknown): {	CODE
LOW	demo/nextjs/lib/scim-demo-management.ts	99	export function scimDemoManagementErrorResponse(error: unknown): Response {	CODE
LOW	demo/nextjs/lib/scim-demo-management.ts	139	export async function authorizeSCIMDemoManagementRequest(	CODE
LOW	demo/nextjs/lib/scim-demo-management.ts	166	export function assertSCIMDemoOrganizationContext(	CODE
LOW	demo/nextjs/lib/scim-demo-management.ts	178	export function assertSCIMDemoCredentialContext(	CODE
LOW	demo/nextjs/lib/scim-demo-management.ts	283	export function createSCIMDemoCredentialExpiry(expiresInDays = 90): Date {	CODE
LOW	test/unit/magic-link-secondary-storage.test.ts	14	function createStringSecondaryStorage(	CODE
LOW	test/unit/magic-link-secondary-storage.test.ts	40	function createParsedSecondaryStorage(	CODE
LOW	docs/app/changelog/page.tsx	31	function getContributorAvatarLinks(usernames: string[]) {	CODE
LOW	docs/app/api/og/route.tsx	38	function allowBreakAfterUnderscore(text: string) {	CODE
LOW	docs/scripts/validate-links.ts	75	function normalizeTrailingSlashAnchors(content: string) {	CODE
LOW	docs/scripts/sync-typesense.ts	10	export function getTypesenseSyncSkipReason(env: NodeJS.ProcessEnv) {	CODE
LOW	docs/scripts/update-docs-version-source.ts	17	function getDocsVersionSourceUpdate(	CODE
LOW	docs/lib/markdown-response.ts	10	export function createNegotiatedMarkdownResponse(	CODE
LOW	docs/lib/api-method.ts	379	export function generateApiMethodExamples(	CODE
LOW	packages/prisma-adapter/src/schema-check.ts	58	function introspectPrismaDataModel(	CODE
LOW	packages/scim/src/scim-metadata.ts	9	export function defineSCIMEndpointMetadata(	CODE
LOW	packages/scim/src/scim-create-uniqueness.test.ts	71	function createConcurrentCommitAdapter(	CODE
LOW	packages/scim/src/scim-create-uniqueness.test.ts	107	function createConcurrentUpdateAdapter(	CODE
LOW	packages/scim/src/user-profile.ts	55	export function createCanonicalSCIMUserProfile(	CODE
LOW	packages/scim/src/user-profile.ts	119	export function createSCIMEmailValueIndex(	CODE
LOW	packages/scim/src/user-profile.ts	138	export function createSCIMEmailValueToken(email: string): string {	CODE
LOW	packages/scim/src/identity.ts	62	export async function acquireActiveSCIMUserLink(	CODE
LOW	packages/scim/src/identity.ts	189	export function concurrentIdentityMutation(): never {	CODE
LOW	packages/scim/src/identity.ts	197	export function isSCIMIdentityMutationConflict(	CODE
LOW	packages/scim/src/identity.ts	285	export function createSCIMIdentityCoordinator(options: SCIMOptions) {	CODE
LOW	packages/scim/src/scim-active-normalization.test.ts	587	async function readPersistentMutationState(	CODE
LOW	packages/scim/src/group-state.ts	20	export function throwConcurrentSCIMGroupMutation(): never {	CODE
484 more matches not shown…

Fake / Example Data209 hits · 208 pts

Severity	File	Line	Snippet	Context
LOW	test/unit/proxy-agent/index.spec.ts	149	email: "user@example.com",	CODE
LOW	packages/core/src/social-providers/twitch.test.ts	14	email: "user@example.com",	CODE
LOW	packages/core/src/social-providers/twitter.test.ts	46	data: { data: { confirmed_email: "user@example.com" } },	CODE
LOW	packages/core/src/social-providers/twitter.test.ts	55	expect(result?.user.email).toBe("user@example.com");	CODE
LOW	packages/core/src/social-providers/facebook.test.ts	167	idToken: "placeholder",	CODE
LOW	packages/core/src/social-providers/facebook.test.ts	248	await expect(verifyProviderIdToken(provider, "placeholder")).resolves.toBe(	CODE
LOW	packages/core/src/social-providers/facebook.test.ts	252	idToken: "placeholder",	CODE
LOW	…s/core/src/social-providers/microsoft-entra-id.test.ts	178	email: "user@example.com",	CODE
LOW	…s/core/src/social-providers/microsoft-entra-id.test.ts	208	email: "user@example.com",	CODE
LOW	…s/core/src/social-providers/microsoft-entra-id.test.ts	231	email: "user@example.com",	CODE
LOW	…s/core/src/social-providers/microsoft-entra-id.test.ts	249	email: "user@example.com",	CODE
LOW	…s/core/src/social-providers/microsoft-entra-id.test.ts	268	email: "user@example.com",	CODE
LOW	…s/core/src/social-providers/microsoft-entra-id.test.ts	294	email: "user@example.com",	CODE
LOW	…s/core/src/social-providers/microsoft-entra-id.test.ts	328	email: "user@example.com",	CODE
LOW	packages/core/src/social-providers/google.test.ts	35	email: "user@example.com",	CODE
LOW	packages/core/src/social-providers/google.test.ts	141	expect(result?.user.email).toBe("user@example.com");	CODE
LOW	packages/core/src/social-providers/google.test.ts	186	expect(result?.user.email).toBe("user@example.com");	CODE
LOW	packages/core/src/social-providers/google.test.ts	215	expect(result?.user.email).toBe("user@example.com");	CODE
LOW	packages/core/src/social-providers/google.test.ts	262	email: "user@example.com",	CODE
LOW	packages/core/src/social-providers/paybin.test.ts	13	email: "user@example.com",	CODE
LOW	packages/core/src/social-providers/apple.test.ts	30	email: "user@example.com",	CODE
LOW	packages/core/src/social-providers/cloudflare.test.ts	155	email: "user@example.com",	CODE
LOW	packages/core/src/social-providers/cloudflare.test.ts	170	email: "user@example.com",	CODE
LOW	…ges/core/src/social-providers/social-providers.test.ts	288	loginHint: "user@example.com",	CODE
LOW	…ges/core/src/social-providers/social-providers.test.ts	290	expect(url.searchParams.get("login_hint")).toBe("user@example.com");	CODE
LOW	packages/oauth-provider/src/resource-startup.test.ts	125	user: { email: "test@test.com" },	CODE
LOW	…/oauth-provider/src/oauth-endpoint.integration.test.ts	162	token: "placeholder",	CODE
LOW	packages/oauth-provider/src/userinfo.test.ts	814	body: { email: "test@test.com", password: "test123456" },	CODE
LOW	packages/oauth-provider/src/authorize.test.ts	187	reorderedParams.append("utm_email", "user@example.com");	CODE
LOW	packages/oauth-provider/src/signed-query.test.ts	24	reorderedParams.append("utm_email", "user@example.com");	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	74	.get("admin@example.com") as {	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	81	email: "admin@example.com",	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	89	email: "admin@example.com",	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	93	expect(signIn.user.email).toBe("admin@example.com");	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	102	email: "admin@example.com",	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	108	.get("admin@example.com") as { name: string };	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	119	email: "admin@example.com",	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	127	.get("admin@example.com") as { image: string };	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	137	email: "admin@example.com",	CODE
LOW⚡	packages/cli/test/create-admin.test.ts	146	email: "admin@example.com",	CODE
LOW	packages/cli/test/create-admin.test.ts	161	email: "admin@example.com",	CODE
LOW	packages/cli/test/create-admin.test.ts	197	email: "admin@example.com",	CODE
LOW	packages/cli/test/create-admin.test.ts	205	email: "admin@example.com",	CODE
LOW	packages/cli/test/create-admin.test.ts	217	email: "user@example.com",	CODE
LOW	packages/cli/test/create-admin.test.ts	226	email: "admin@example.com",	CODE
LOW	packages/sso/src/saml.test.ts	8034	cert: "placeholder",	CODE
LOW	packages/sso/src/saml.test.ts	8067	cert: "placeholder",	CODE
LOW	packages/sso/src/saml.test.ts	8098	cert: "placeholder",	CODE
LOW	packages/sso/src/providers.test.ts	568	email: "admin@example.com",	CODE
LOW	packages/sso/src/providers.test.ts	2649	email: "admin@example.com",	CODE
LOW	packages/sso/src/providers.test.ts	2655	(u) => u.email === "admin@example.com",	CODE
LOW	packages/sso/src/providers.test.ts	3608	email: "admin@example.com",	CODE
LOW	packages/sso/src/providers.test.ts	3614	(u) => u.email === "admin@example.com",	CODE
LOW	packages/sso/src/providers.test.ts	3910	email: "admin@example.com",	CODE
LOW	packages/sso/src/providers.test.ts	3916	(u) => u.email === "admin@example.com",	CODE
LOW	packages/sso/src/providers.test.ts	4029	email: "user@example.com",	CODE
LOW	packages/sso/src/providers.test.ts	4034	{ email: "user@example.com", password: "password123" },	CODE
LOW	packages/sso/src/oidc.test.ts	298	loginHint: "user@example.com",	CODE
LOW	packages/sso/src/oidc.test.ts	668	token.payload.name = "Jane Doe";	CODE
LOW	packages/better-auth/src/social.test.ts	1933	email: "test@test.com",	CODE
149 more matches not shown…

Decorative Section Separators57 hits · 171 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/components/command-menu.tsx	33	// ─── Context ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/command-menu.tsx	50	// ─── AI Suggestions ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/command-menu.tsx	59	// ─── Provider ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/command-menu.tsx	117	// ─── Dialog ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/command-menu.tsx	227	// ─── Search Mode ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/command-menu.tsx	399	// ─── AI Mode ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/command-menu.tsx	620	// ─── AI Text Input ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/command-menu.tsx	663	// ─── AI Message ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/command-menu.tsx	729	// ─── Thinking Indicator ──────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	31	// ─── Context ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	49	// ─── Root ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	104	// ─── Trigger ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	127	// ─── Panel ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	282	// ─── Panel Header ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	307	// ─── Panel Messages ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	397	// ─── Panel Input ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	591	// ─── Thinking Indicator ──────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	612	// ─── Message ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/ai-chat.tsx	673	// ─── Hot Key ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/mdx-components.tsx	19	// ─── GenerateSecret ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/mdx-components.tsx	62	// ─── APIMethod ───────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/mdx-components.tsx	89	// ─── DatabaseTable ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/mdx-components.tsx	517	// ─── Endpoint ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/mdx-components.tsx	552	// ─── ForkButton ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/mdx-components.tsx	585	// ─── AddToCursor ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/mdx-components.tsx	615	// ─── DividerText ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/mdx-components.tsx	629	// ─── GenerateAppleJwt ────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/mdx-components.tsx	639	// ─── Features (placeholder) ─────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/custom-sidebar.tsx	14	// ─── Item ───────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/custom-sidebar.tsx	40	// ─── Folder ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/custom-sidebar.tsx	95	// ─── Separator ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/custom-sidebar.tsx	111	// ─── Search Button (sidebar banner) ─────────────────────────────────────────	COMMENT
MEDIUM	docs/components/docs/custom-sidebar.tsx	145	// ─── Helpers ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	243	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	245	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	408	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	410	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	471	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	473	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	571	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	573	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	653	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	655	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	762	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	764	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	857	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	859	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	988	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/oauth-provider/src/resources-e2e.test.ts	990	// ────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/cli/src/commands/ai.ts	34	// ── Main ──────────────────────────────────────────	COMMENT
MEDIUM	packages/cli/src/commands/ai.ts	74	// ── Client Integration ────────────────────────────	COMMENT
MEDIUM	packages/cli/src/commands/ai.ts	104	// ── Server Selection ──────────────────────────────	COMMENT
MEDIUM	packages/cli/src/commands/ai.ts	125	// ── MCP Server Setup ──────────────────────────────	COMMENT
MEDIUM	packages/cli/src/commands/ai.ts	367	// ── CLI Setup ─────────────────────────────────────	COMMENT
MEDIUM	packages/cli/src/commands/ai.ts	433	// ── Server Setup ──────────────────────────────────	COMMENT
MEDIUM	packages/cli/src/commands/ai.ts	658	// ── Helpers ───────────────────────────────────────	COMMENT
MEDIUM	packages/cli/src/commands/ai.ts	803	// ── Export ─────────────────────────────────────────	COMMENT

Verbosity Indicators39 hits · 61 pts

Severity	File	Line	Snippet	Context
LOW	test/unit/proxy-agent/index.spec.ts	106	// Step 1: Initiate OAuth sign in	COMMENT
LOW	test/unit/proxy-agent/index.spec.ts	127	// Step 2: Complete OAuth callback - this will trigger requests through the proxy	COMMENT
LOW	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	156	// Step 1: RP initiates OAuth flow	COMMENT
LOW⚡	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	173	// Step 2: Follow the authorize redirect → login page	COMMENT
LOW⚡	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	183	// Step 3: Stub window for the login flow	COMMENT
LOW⚡	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	193	// Step 4: Sign in at the authorization server	COMMENT
LOW	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	204	// Step 5: Follow callback to RP — this triggers the token exchange	COMMENT
LOW⚡	packages/sso/src/saml.test.ts	7775	// Step 1: initiate sign-in (constructs SP/IdP from indented keys)	COMMENT
LOW⚡	packages/sso/src/saml.test.ts	7784	// Step 2: get SAML response from mock IdP	COMMENT
LOW⚡	packages/sso/src/saml.test.ts	7793	// Step 3: post to ACS and verify session is created	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	984	// Step 1: Start OAuth on preview	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	997	// Step 2: Complete OAuth callback on production - passthrough mode	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1026	// Step 3: Call oauth-proxy-callback on preview instance	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1037	// Step 4: Verify user was created ONLY in preview DB	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1589	// Step 1: Start OAuth on preview	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1602	// Step 2: Complete OAuth callback on production	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1636	// Step 3: Preview can decrypt and create user	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1783	// Step 1: Initiate OAuth flow	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1796	// Step 2: Complete OAuth callback to get encrypted profile	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1816	// Step 3: Call oauth-proxy-callback WITHOUT cookies (simulating cross-origin)	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1959	// Step 1: Start OAuth on preview	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1974	// Step 2: OAuth callback arrives at production	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	2042	// Step 1: Start OAuth on preview (the non-production environment)	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	2056	// Step 2: OAuth callback arrives at production	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	2080	// Step 3: Preview receives the callback	COMMENT
LOW	…rc/plugins/last-login-method/last-login-method.test.ts	1583	// Step 1: Sign in to get the cookie set with domain attribute	COMMENT
LOW	…rc/plugins/last-login-method/last-login-method.test.ts	1603	// Step 2: Simulate clearing the cookie on the client side.	COMMENT
LOW	…tter-auth/src/api/routes/cookie-cache-fallback.test.ts	444	// Step 1: User signs in - gets session_token and session_data	COMMENT
LOW	…tter-auth/src/api/routes/cookie-cache-fallback.test.ts	508	// Step 3: Simulate visibilitychange -> useSession() refetch	COMMENT
LOW	packages/stripe/test/subscription.test.ts	1970	// Step 1: Create a subscription that was trialing (simulates checkout completed	COMMENT
LOW	packages/stripe/test/subscription.test.ts	1985	// Step 2: Simulate customer.subscription.deleted with trial data from Stripe	COMMENT
LOW	packages/stripe/test/subscription.test.ts	2035	// Step 3: User tries to subscribe again — should NOT get a trial	COMMENT
LOW	packages/stripe/src/index.ts	435	// We need to check if the Stripe customer's email matches	COMMENT
LOW	e2e/smoke/test/session-token-refresh.spec.ts	94	// Step 1: Initiate Google OAuth sign-in	COMMENT
LOW	e2e/smoke/test/session-token-refresh.spec.ts	117	// Step 2: Complete OAuth callback — this creates the session	COMMENT
LOW	e2e/smoke/test/session-token-refresh.spec.ts	136	// Step 3: Call getSession to populate cookie cache	COMMENT
LOW⚡	e2e/smoke/test/session-token-refresh.spec.ts	148	// Step 4: Advance time past the refreshCache window	COMMENT
LOW⚡	e2e/smoke/test/session-token-refresh.spec.ts	154	// Step 5: Call getSession — this should trigger refreshCache	COMMENT
LOW	e2e/smoke/test/session-token-refresh.spec.ts	166	// Step 6: Verify session_token cookie has extended max-age	COMMENT

Hallucination Indicators6 hits · 60 pts

Severity	File	Line	Snippet	Context
CRITICAL	packages/oauth-provider/src/device-code.test.ts	273	oauthDevicePlugin.endpoints.deviceCode.options.error.safeParse({	CODE
CRITICAL	…r-auth/src/plugins/device-authorization/schema.test.ts	40	plugin.endpoints.deviceCode.options.error.safeParse({	CODE
CRITICAL	packages/better-auth/src/plugins/email-otp/routes.ts	1069	const email = ctx.context.session.user.email.toLowerCase();	CODE
CRITICAL	packages/better-auth/src/api/routes/update-user.ts	526	ctx.context.options.user.deleteUser.sendDeleteAccountVerification(	CODE
CRITICAL	packages/electron/test/electron.test.ts	670	const authenticateHandler = mockElectron.ipcMain.handle.mock.calls.find(	CODE
CRITICAL	packages/stripe/test/stripe-organization.test.ts	1935	mockStripeCustomerType.customers.search.mock.calls.find(	CODE

Structural Annotation Overuse38 hits · 59 pts

Severity	File	Line	Snippet	Context
LOW	test/unit/proxy-agent/index.spec.ts	106	// Step 1: Initiate OAuth sign in	COMMENT
LOW	test/unit/proxy-agent/index.spec.ts	127	// Step 2: Complete OAuth callback - this will trigger requests through the proxy	COMMENT
LOW	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	156	// Step 1: RP initiates OAuth flow	COMMENT
LOW⚡	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	173	// Step 2: Follow the authorize redirect → login page	COMMENT
LOW⚡	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	183	// Step 3: Stub window for the login flow	COMMENT
LOW⚡	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	193	// Step 4: Sign in at the authorization server	COMMENT
LOW	packages/oauth-provider/src/private-key-jwt-e2e.test.ts	204	// Step 5: Follow callback to RP — this triggers the token exchange	COMMENT
LOW⚡	packages/sso/src/saml.test.ts	7775	// Step 1: initiate sign-in (constructs SP/IdP from indented keys)	COMMENT
LOW⚡	packages/sso/src/saml.test.ts	7784	// Step 2: get SAML response from mock IdP	COMMENT
LOW⚡	packages/sso/src/saml.test.ts	7793	// Step 3: post to ACS and verify session is created	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	984	// Step 1: Start OAuth on preview	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	997	// Step 2: Complete OAuth callback on production - passthrough mode	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1026	// Step 3: Call oauth-proxy-callback on preview instance	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1037	// Step 4: Verify user was created ONLY in preview DB	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1589	// Step 1: Start OAuth on preview	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1602	// Step 2: Complete OAuth callback on production	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1636	// Step 3: Preview can decrypt and create user	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1783	// Step 1: Initiate OAuth flow	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1796	// Step 2: Complete OAuth callback to get encrypted profile	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1816	// Step 3: Call oauth-proxy-callback WITHOUT cookies (simulating cross-origin)	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1959	// Step 1: Start OAuth on preview	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	1974	// Step 2: OAuth callback arrives at production	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	2042	// Step 1: Start OAuth on preview (the non-production environment)	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	2056	// Step 2: OAuth callback arrives at production	COMMENT
LOW	…etter-auth/src/plugins/oauth-proxy/oauth-proxy.test.ts	2080	// Step 3: Preview receives the callback	COMMENT
LOW	…rc/plugins/last-login-method/last-login-method.test.ts	1583	// Step 1: Sign in to get the cookie set with domain attribute	COMMENT
LOW	…rc/plugins/last-login-method/last-login-method.test.ts	1603	// Step 2: Simulate clearing the cookie on the client side.	COMMENT
LOW	…tter-auth/src/api/routes/cookie-cache-fallback.test.ts	444	// Step 1: User signs in - gets session_token and session_data	COMMENT
LOW	…tter-auth/src/api/routes/cookie-cache-fallback.test.ts	508	// Step 3: Simulate visibilitychange -> useSession() refetch	COMMENT
LOW	packages/stripe/test/subscription.test.ts	1970	// Step 1: Create a subscription that was trialing (simulates checkout completed	COMMENT
LOW	packages/stripe/test/subscription.test.ts	1985	// Step 2: Simulate customer.subscription.deleted with trial data from Stripe	COMMENT
LOW	packages/stripe/test/subscription.test.ts	2035	// Step 3: User tries to subscribe again — should NOT get a trial	COMMENT
LOW	e2e/smoke/test/session-token-refresh.spec.ts	94	// Step 1: Initiate Google OAuth sign-in	COMMENT
LOW	e2e/smoke/test/session-token-refresh.spec.ts	117	// Step 2: Complete OAuth callback — this creates the session	COMMENT
LOW	e2e/smoke/test/session-token-refresh.spec.ts	136	// Step 3: Call getSession to populate cookie cache	COMMENT
LOW⚡	e2e/smoke/test/session-token-refresh.spec.ts	148	// Step 4: Advance time past the refreshCache window	COMMENT
LOW⚡	e2e/smoke/test/session-token-refresh.spec.ts	154	// Step 5: Call getSession — this should trigger refreshCache	COMMENT
LOW	e2e/smoke/test/session-token-refresh.spec.ts	166	// Step 6: Verify session_token cookie has extended max-age	COMMENT

Over-Commented Block14 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	docs/components/icons/sections.tsx	121	// <svg	COMMENT
LOW	packages/prisma-adapter/src/prisma-adapter.ts	741	}	COMMENT
LOW	packages/test-utils/src/adapter/suites/basic.ts	3401	expect(result!.name).toBe("null-where-updated");	COMMENT
LOW	packages/redis-storage/src/redis-storage.ts	61	error instanceof Error &&	COMMENT
LOW	packages/core/src/db/adapter/get-default-model-name.ts	21	*/	COMMENT
LOW	packages/oauth-provider/src/oauth.ts	541		COMMENT
LOW	packages/oauth-provider/src/resources.ts	401	// not a gate.	COMMENT
LOW	packages/oauth-provider/src/resources.ts	441	refreshTokenTtl === null	COMMENT
LOW	packages/oauth-provider/src/introspect.ts	181	throw error;	COMMENT
LOW	packages/drizzle-adapter/src/drizzle-adapter.ts	1201	// Pin the update to one selected id so a non-unique guard mutates at	COMMENT
LOW	packages/better-auth/src/plugins/jwt/sign.ts	141	// that alg. If the requested alg isn't found, lazy-mint it on demand	COMMENT
LOW	packages/better-auth/src/plugins/jwt/sign.ts	181	}	COMMENT
LOW	.github/zizmor.yml	1	# Policy: fix shell-injection, cache, and credential-persistence findings.	COMMENT
LOW	.github/zizmor.yml	21	- backport.yml	COMMENT

better-auth/better-auth

Open-Source Code Quality, Security and Technical Debt Review