Bitnami Helm Charts
This report summarizes scanner evidence for bitnami/charts, a Go Template project with 10,415 GitHub stars. SynthScan examined 894,228 lines of code across 3733 source files, recording 8443 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 6.2 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 8424 finding(s).
Are imports declared and package/API names verified? 1 finding(s).
Are wrappers, guards, and repeated structures necessary? 18 finding(s).
Which changes need focused human review? 8443 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 8443 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bitnami/multus-cni/values.yaml | 1 | # Copyright Broadcom, Inc. All Rights Reserved. | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 21 | imagePullSecrets: [] | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 41 | ## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 61 | extraDeploy: [] | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 81 | ## @param image.registry [default: REGISTRY_NAME] Multus CNI image registry | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 101 | ## e.g: | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 121 | ## ref: https://github.com/bitnami/containers/tree/main/bitnami/multus-cni#configuration | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 141 | ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 161 | # value: true | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 181 | ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 201 | ## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations. | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 221 | ## e.g: | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 241 | ingressNSPodMatchLabels: {} | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 261 | key: "" | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 281 | ## | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 301 | ## | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 341 | ## @param startupProbe.successThreshold Success threshold for startupProbe | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 381 | successThreshold: 1 | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 401 | podLabels: {} | COMMENT |
| LOW | bitnami/multus-cni/values.yaml | 421 | name: "" | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 1 | # Copyright Broadcom, Inc. All Rights Reserved. | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 21 | imagePullSecrets: [] | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 41 | COMMENT | |
| LOW | bitnami/neo4j/values.yaml | 61 | ## | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 81 | args: | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 101 | digest: "" | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 121 | bolt: 7687 | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 161 | ## @param startupProbe.enabled Enable startupProbe on neo4j containers | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 181 | ## @param customStartupProbe Custom startupProbe that overrides the default one | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 201 | ## Configure Pods Security Context | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 261 | ## | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 281 | configuration: "" | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 301 | ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 321 | ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 341 | ## @param affinity Affinity for neo4j pods assignment | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 361 | updateStrategy: | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 381 | ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 401 | ## | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 421 | ## - name: your-image-name | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 441 | ## @param autoscaling.vpa.enabled Enable VPA for neo4j pods | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 461 | ## | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 481 | ## NOTE: choose port between <30000-32767> | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 501 | ## | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 521 | ## timeoutSeconds: 300 | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 541 | ## @param networkPolicy.addExternalClientAccess Allow access from pods with client label set to "true". Ignored if `ne | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 561 | ## e.g: | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 581 | # | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 601 | ## @param ingress.hostname Default host for the ingress record | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 621 | annotations: {} | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 641 | ## e.g: | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 661 | ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid cer | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 681 | ## extraRules: | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 701 | ## | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 721 | ## | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 741 | ## 'volumePermissions' init container parameters | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 761 | pullPolicy: IfNotPresent | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 781 | ## memory: 512Mi | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 801 | ## @section Other Parameters | COMMENT |
| LOW | bitnami/neo4j/values.yaml | 821 | rules: [] | COMMENT |
| LOW | bitnami/kube-state-metrics/values.yaml | 1 | # Copyright Broadcom, Inc. All Rights Reserved. | COMMENT |
| 8305 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bitnami/argo-cd/values.yaml | 3940 | ## Create a secret with optional repository credentials | COMMENT |
| MEDIUM | bitnami/valkey-cluster/templates/configmap.yaml | 355 | # Creating a pid file is best effort: if Valkey is not able to create it | COMMENT |
| MEDIUM | bitnami/oauth2-proxy/values.yaml | 337 | ## Create a new secret with the following command openssl rand -base64 32 | head -c 32 | base64 | COMMENT |
| MEDIUM | bitnami/redis-cluster/templates/configmap.yaml | 356 | # Creating a pid file is best effort: if Redis is not able to create it | COMMENT |
| MEDIUM | bitnami/mongodb/values.yaml | 1583 | ## Defining a spec ignores the above values. | COMMENT |
| MEDIUM | bitnami/mongodb/templates/common-scripts-cm.yaml | 101 | #Create the client/server cert | COMMENT |
| MEDIUM | bitnami/thanos/values.yaml | 862 | ## Create an ingress object for the GRPC service. This requires an HTTP/2 | COMMENT |
| MEDIUM | bitnami/thanos/values.yaml | 3498 | ## Create an ingress object for the GRPC service. This requires an HTTP/2 | COMMENT |
| MEDIUM | bitnami/kube-prometheus/values.yaml | 349 | ## Create a servicemonitor for the operator | COMMENT |
| MEDIUM | bitnami/kube-prometheus/values.yaml | 1751 | ## Create a ServiceMonitor to monitor Prometheus thanos sidecar | COMMENT |
| MEDIUM | bitnami/kube-prometheus/values.yaml | 1849 | ## Create a ServiceMonitor to monitor Prometheus config-reloader sidecar | COMMENT |
| MEDIUM | bitnami/kube-prometheus/values.yaml | 3213 | ## Create a ServiceMonitor to scrape coredns service | COMMENT |
| MEDIUM | bitnami/kube-prometheus/values.yaml | 3803 | ## Create a servicemonitor for Thanos ruler | COMMENT |
| MEDIUM | bitnami/argo-workflows/values.yaml | 286 | # Create a ClusterRole and CRB for the controller to access ClusterWorkflowTemplates. | COMMENT |
| MEDIUM | .github/workflows/markdown-linter.yml | 34 | # Create an empty file, useful when the PR changes ignored files | COMMENT |
| MEDIUM | .github/workflows/values-ascii-check.yml | 31 | # Create an empty file, useful when the PR changes ignored files | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | bitnami/valkey-cluster/templates/configmap.yaml | 645 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | bitnami/valkey-cluster/templates/configmap.yaml | 651 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | bitnami/valkey-cluster/templates/configmap.yaml | 775 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | bitnami/valkey-cluster/templates/configmap.yaml | 1066 | # ------------------------------------------------------------------------ | COMMENT |
| MEDIUM | bitnami/valkey-cluster/templates/configmap.yaml | 1070 | # ------------------------------------------------------------------------ | COMMENT |
| MEDIUM | bitnami/valkey-cluster/templates/configmap.yaml | 2188 | # ------------------------------- | COMMENT |
| MEDIUM⚡ | bitnami/redis-cluster/templates/configmap.yaml | 646 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | bitnami/redis-cluster/templates/configmap.yaml | 652 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | bitnami/redis-cluster/templates/configmap.yaml | 776 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | bitnami/redis-cluster/templates/configmap.yaml | 1073 | # ------------------------------------------------------------------------ | COMMENT |
| MEDIUM | bitnami/redis-cluster/templates/configmap.yaml | 1077 | # ------------------------------------------------------------------------ | COMMENT |
| MEDIUM | bitnami/redis-cluster/templates/configmap.yaml | 2202 | # ------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bitnami/harbor/values.yaml | 339 | ## For storing images and charts, you can also use "azure", "gcs", "s3", | COMMENT |
| MEDIUM | bitnami/valkey-cluster/templates/configmap.yaml | 1166 | # used least recently, you can change the sample size using the following | COMMENT |
| MEDIUM | bitnami/valkey-cluster/templates/configmap.yaml | 2083 | # strings, are normally limited to 512 mb. However you can change this limit | COMMENT |
| LOW | bitnami/valkey-cluster/templates/configmap.yaml | 165 | # make sure to raise both the value of somaxconn and tcp_max_syn_backlog | COMMENT |
| LOW | bitnami/valkey-cluster/templates/configmap.yaml | 1196 | # and so forth). So make sure you monitor your replicas and make sure they | COMMENT |
| LOW | bitnami/opensearch/values.yaml | 257 | ## NOTE: If autoGenerated certs are enabled and a new node type is enabled using helm upgrade, make sure you remove | COMMENT |
| LOW | bitnami/opensearch/values.yaml | 3463 | ## NOTE: If autoGenerated certs are enabled and a new node type is enabled using helm upgrade, make sure you remove | COMMENT |
| MEDIUM | bitnami/redis-cluster/templates/configmap.yaml | 1173 | # used least recently, you can change the sample size using the following | COMMENT |
| MEDIUM | bitnami/redis-cluster/templates/configmap.yaml | 2097 | # strings, are normally limited to 512 mb. However you can change this limit | COMMENT |
| LOW | bitnami/redis-cluster/templates/configmap.yaml | 165 | # make sure to raise both the value of somaxconn and tcp_max_syn_backlog | COMMENT |
| LOW | bitnami/redis-cluster/templates/configmap.yaml | 1203 | # and so forth). So make sure you monitor your replicas and make sure they | COMMENT |
| LOW | bitnami/redis-cluster/templates/configmap.yaml | 1775 | # In order to setup your cluster make sure to read the documentation | COMMENT |
| MEDIUM | bitnami/zookeeper/values.yaml | 908 | ## message: The number of synced followers for the leader node in ZooKeeper deployment my-release is less than | COMMENT |
| MEDIUM | bitnami/metallb/templates/speaker/configmap.yaml | 95 | # or you can use "all_wrap" for all daemons, e.g. to use perf record: | COMMENT |
| LOW | bitnami/elasticsearch/values.yaml | 255 | ## NOTE: If autoGenerated certs are enabled and a new node type is enabled using helm upgrade, make sure you remove | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …mi/cloudnative-pg/crds/postgresql.cnpg.io_poolers.yaml | 0 | type: string resourcefieldref: description: |- selects a resource of the container: only resources limits and requests ( | STRING |
| HIGH | bitnami/contour/templates/crds/contour-crds.yaml | 0 | type: string resourcefieldref: description: |- selects a resource of the container: only resources limits and requests ( | STRING |
| HIGH | …ts/kube-prometheus-crds/crds/crd-prometheusagents.yaml | 0 | type: string resourcefieldref: description: |- selects a resource of the container: only resources limits and requests ( | STRING |
| HIGH | …charts/kube-prometheus-crds/crds/crd-prometheuses.yaml | 0 | type: string resourcefieldref: description: |- selects a resource of the container: only resources limits and requests ( | STRING |
| HIGH | …harts/kube-prometheus-crds/crds/crd-alertmanagers.yaml | 0 | type: string resourcefieldref: description: |- selects a resource of the container: only resources limits and requests ( | STRING |
| HIGH | …charts/kube-prometheus-crds/crds/crd-thanosrulers.yaml | 0 | type: string resourcefieldref: description: |- selects a resource of the container: only resources limits and requests ( | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bitnami/mastodon/templates/init-job/init-job.yaml | 162 | # as it follows the Job Pattern best practices | COMMENT |
| LOW⚡ | bitnami/valkey-cluster/templates/configmap.yaml | 636 | # it entirely just set it to 0 seconds and the transfer will start ASAP. | COMMENT |
| LOW | bitnami/valkey-cluster/templates/configmap.yaml | 375 | # To enable logging to the system logger, just set 'syslog-enabled' to yes, | COMMENT |
| LOW | bitnami/valkey-cluster/templates/configmap.yaml | 1144 | # noeviction -> Don't evict anything, just return an error on write operations. | COMMENT |
| LOW | bitnami/valkey-cluster/templates/configmap.yaml | 1308 | # Setting io-threads to 1 will just use the main thread as usual. | COMMENT |
| LOW | bitnami/valkey-cluster/templates/configmap.yaml | 1665 | # one replica). To disable migration just set it to a very large value or | COMMENT |
| LOW | bitnami/valkey-cluster/templates/configmap.yaml | 1688 | # covered. In order to do so, just set the cluster-require-full-coverage | COMMENT |
| LOW⚡ | bitnami/redis-cluster/templates/configmap.yaml | 637 | # it entirely just set it to 0 seconds and the transfer will start ASAP. | COMMENT |
| LOW | bitnami/redis-cluster/templates/configmap.yaml | 376 | # To enable logging to the system logger, just set 'syslog-enabled' to yes, | COMMENT |
| LOW | bitnami/redis-cluster/templates/configmap.yaml | 1151 | # noeviction -> Don't evict anything, just return an error on write operations. | COMMENT |
| LOW | bitnami/redis-cluster/templates/configmap.yaml | 1315 | # Setting io-threads to 1 will just use the main thread as usual. | COMMENT |
| LOW | bitnami/redis-cluster/templates/configmap.yaml | 1675 | # one replica). To disable migration just set it to a very large value or | COMMENT |
| LOW | bitnami/redis-cluster/templates/configmap.yaml | 1698 | # covered. In order to do so, just set the cluster-require-full-coverage | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bitnami/valkey-cluster/templates/configmap.yaml | 2167 | # NOTE: The above table was obtained by running the following commands: | COMMENT |
| LOW | bitnami/redis/README.md | 352 | #### Step 1: Backup the deployment | COMMENT |
| LOW | bitnami/redis/README.md | 371 | #### Step 2: Restore the data on the destination cluster | COMMENT |
| LOW | bitnami/redis-cluster/templates/configmap.yaml | 2181 | # NOTE: The above table was obtained by running the following commands: | COMMENT |
| LOW | bitnami/valkey/README.md | 310 | #### Step 1: Back up the deployment | COMMENT |
| LOW | bitnami/valkey/README.md | 329 | #### Step 2: Restore the data on the destination cluster | COMMENT |
| LOW | bitnami/jenkins/values.yaml | 282 | ## NOTE: This value will only take effect if agent.enabled=true | COMMENT |
| LOW | bitnami/jenkins/values.yaml | 286 | ## NOTE: This value will only take effect if agent.enabled=true | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bitnami/redis/templates/scripts-configmap.yaml | 642 | # Check if both variables are not empty | COMMENT |
| LOW | bitnami/redis/templates/scripts-configmap.yaml | 655 | # Check if both variables are not empty | COMMENT |
| LOW | bitnami/redis/templates/scripts-configmap.yaml | 787 | # Check if both variables are not empty | COMMENT |
| LOW | bitnami/redis/templates/scripts-configmap.yaml | 800 | # Check if both variables are not empty | COMMENT |
| LOW | …tgresql-ha/templates/postgresql/scripts-configmap.yaml | 98 | # Check if PG is ready | COMMENT |
| LOW | …tgresql-ha/templates/postgresql/scripts-configmap.yaml | 103 | # Check if repmgr has split-brain issues | COMMENT |
| LOW | .github/workflows/license-headers.yml | 39 | # Check if a given path contains one of the excluded paths | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bitnami/wordpress/values.yaml | 190 | ## wp core multisite-install --url=example.com --title="Welcome to the WordPress Multisite" --admin_user="doesntmatt | COMMENT |