0.9

Adjusted Signal

0.9

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

35.2K

Stars

Language

179.5K

Lines of Code

497

Files

144

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 141 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.3/100 · LOW

Are imports declared and package/API names verified? 3 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 4.5/100 · LOW

Which changes need focused human review? 144 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 2MEDIUM 1LOW 140

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 144 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block129 hits · 124 pts

Severity	File	Line	Snippet	Context
LOW	cluster/cluster_mesh.go	61		COMMENT
LOW	cluster/types.go	41	// prevention). Access changes do not need this, since peers reload their access cache and end	COMMENT
LOW	cluster/cluster.go	21	const (	COMMENT
LOW	cluster/cluster.go	101	// Local delivery to a node's own subscribers still happens inline in the server; the cluster	COMMENT
LOW	cluster/cluster.go	121	// enough (within NodeTTL) that peers still forward messages to it. Health checkers must	COMMENT
LOW	cluster/registry/registry.go	41	RolePassive Role = "passive"	COMMENT
LOW	cluster/registry/registry.go	201	}	COMMENT
LOW	cluster/registry/registry.go	221	// that cannot reach the database stops believing within the lease, and it stops before any	COMMENT
LOW	cluster/registry/registry_test.go	241	require.Len(t, r1.Peers(), 1) // Snapshot replaced	COMMENT
LOW	s3/client.go	21	const (	COMMENT
LOW	s3/client.go	41	// },	COMMENT
LOW	s3/client.go	81	// single PUT request without buffering. The read is limited to untrustedLength bytes;	COMMENT
LOW	tools/loadtest/main.go	1	// Load test program for ntfy staging server.	COMMENT
LOW	tools/s3cli/main.go	1	// Command s3cli is a minimal CLI for testing the s3 package. It supports put, get, rm, and ls.	COMMENT
LOW	util/linger_queue.go	1	package util	COMMENT
LOW	util/lookup_cache.go	1	package util	COMMENT
LOW	util/batching_queue.go	1	package util	COMMENT
LOW	util/sprig/defaults.go	21	func defaultValue(d any, given ...any) any {	COMMENT
LOW	util/sprig/defaults.go	121	// This function ignores any errors that occur during decoding.	COMMENT
LOW	util/sprig/defaults.go	141	// - any: The decoded value	COMMENT
LOW	util/sprig/defaults.go	181	// This function ignores any errors that occur during encoding.	COMMENT
LOW	util/sprig/defaults.go	201	// - string: The indented JSON string representation of the value	COMMENT
LOW	util/sprig/defaults.go	241	enc.SetEscapeHTML(false)	COMMENT
LOW	util/sprig/numeric.go	61	// Returns:	COMMENT
LOW	util/sprig/numeric.go	121	// add sums all the provided values.	COMMENT
LOW	util/sprig/numeric.go	141	// - a: The value to subtract from	COMMENT
LOW	util/sprig/numeric.go	161	// Panics:	COMMENT
LOW	util/sprig/numeric.go	201	//	COMMENT
LOW	util/sprig/numeric.go	241	//	COMMENT
LOW	util/sprig/numeric.go	301	}	COMMENT
LOW	util/sprig/numeric.go	361	// ceil returns the least integer value greater than or equal to the input.	COMMENT
LOW	util/sprig/numeric.go	421	}	COMMENT
LOW	util/sprig/reflect.go	21	// typeIsLike returns true if the src is the type named in target or a pointer to that type.	COMMENT
LOW	util/sprig/reflect.go	41	// Returns:	COMMENT
LOW	util/sprig/reflect.go	61	// The kind represents the specific Go type category (e.g., "string", "int", "map", "slice").	COMMENT
LOW	util/sprig/regex.go	21	// mustRegexMatch checks if a string matches a regular expression pattern.	COMMENT
LOW	util/sprig/regex.go	41	// - n: The maximum number of matches to return (negative means all matches)	COMMENT
LOW	util/sprig/regex.go	101	// regexReplaceAll replaces all matches of a regular expression with a replacement string.	COMMENT
LOW	util/sprig/regex.go	121	// Parameters:	COMMENT
LOW	util/sprig/regex.go	141	// Parameters:	COMMENT
LOW	util/sprig/regex.go	161	//	COMMENT
LOW	util/sprig/regex.go	181	// Returns:	COMMENT
LOW	util/sprig/strings.go	41	// base32encode encodes a string to base32 using standard encoding.	COMMENT
LOW	util/sprig/strings.go	101	return strings.Join(out, " ")	COMMENT
LOW	util/sprig/strings.go	121	// Parameters:	COMMENT
LOW	util/sprig/strings.go	141	// Parameters:	COMMENT
LOW	util/sprig/strings.go	181	// strslice converts a value to a slice of strings.	COMMENT
LOW	util/sprig/strings.go	241	newSlice = append(newSlice, i)	COMMENT
LOW	util/sprig/strings.go	301	//	COMMENT
LOW	util/sprig/strings.go	321	// split splits a string by a separator and returns a map.	COMMENT
LOW	util/sprig/strings.go	341	//	COMMENT
LOW	util/sprig/strings.go	361	// Returns:	COMMENT
LOW	util/sprig/strings.go	401	// - count: The number of times to repeat the string	COMMENT
LOW	util/sprig/strings.go	421	//	COMMENT
LOW	util/sprig/strings.go	441	// - string: The string with the prefix removed, or the original string if it doesn't start with the prefix	COMMENT
LOW	util/sprig/strings.go	461	//	COMMENT
LOW	util/sprig/strings.go	481	return strings.HasPrefix(str, substr)	COMMENT
LOW	util/sprig/date.go	21		COMMENT
LOW	util/sprig/date.go	41	// If the timezone is invalid, UTC is used.	COMMENT
LOW	util/sprig/date.go	81		COMMENT
69 more matches not shown…

Synthetic Comment Markers2 hits · 12 pts

Severity	File	Line	Snippet	Context
HIGH	docs/releases.md	559	if things are working (or not working). There is a [one-off migration tool](https://github.com/binwiederhier/ntfy/tree/m	CODE
HIGH	docs/static/js/config-generator.js	5	// This code is entirely AI generated, but this very comment is not. Phil wrote this. Hi!	COMMENT

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	web/public/sw.js	316	const action = event.notification.data.message.actions.find(({ label }) => event.action === label);	CODE

Structural Annotation Overuse5 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW⚡	s3/client_multipart.go	99	// Step 1: Initiate multipart upload	COMMENT
LOW⚡	s3/client_multipart.go	105	// Step 2: Upload parts	COMMENT
LOW	s3/client_multipart.go	131	// Step 3: Complete multipart upload	COMMENT
LOW	docs/index.md	5	## Step 1: Get the app	COMMENT
LOW	docs/index.md	24	## Step 2: Send a message	COMMENT

Verbosity Indicators3 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW⚡	s3/client_multipart.go	99	// Step 1: Initiate multipart upload	COMMENT
LOW⚡	s3/client_multipart.go	105	// Step 2: Upload parts	COMMENT
LOW	s3/client_multipart.go	131	// Step 3: Complete multipart upload	COMMENT

Slop Phrases2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	template/gotext/doc.go	463	constant. Here is a simple example:	CODE
LOW	server/server.go	96	// If changed, don't forget to update Android App and auth_sqlite.go	COMMENT

Fake / Example Data2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	docs/config.md	325	<input type="text" data-key="web-push-email-address" placeholder="admin@example.com">	CODE
LOW	docs/static/js/config-generator.js	858	prefill(modal, "web-push-email-address", "admin@example.com");	CODE

binwiederhier/ntfy

Open-Source Code Quality, Security and Technical Debt Review