blacklanternsecurity/bbot

13.9

Adjusted Score

13.9

Raw Score

100%

Time Factor

2026-07-13

Last Push

10.2K

Stars

Python

Language

129.5K

Lines of Code

581

Files

1.2K

Pattern Hits

2026-07-14

Scan Date

0.28

HC Hit Rate

What These Metrics Mean

Adjusted Score: Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score: The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor: The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits: Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate: High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files: Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 1HIGH 162MEDIUM 84LOW 904

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 1151 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Docstring Block Structure130 hits · 528 pts

Severity	File	Line	Snippet	Context
HIGH	bbot/core/modules.py	348	Preloads all BBOT modules. This function recursively iterates through each file in the module directories	STRING
HIGH	bbot/core/modules.py	596	Preloads a BBOT module to gather its meta-information and dependencies. This function reads a BBOT mod	STRING
HIGH	bbot/core/modules.py	866	Loads a BBOT module by its name. Imports the module from its namespace, locates its class, and returns it.	STRING
HIGH	bbot/core/modules.py	926	Generates a table of module information. Constructs a table to display information such as module name, type, a	STRING
HIGH	bbot/core/event/base.py	2318	Creates and returns a new event object. This function serves as a factory for creating new event objects from	STRING
HIGH	bbot/core/event/base.py	2413	Creates an event object from a JSON dictionary. This function deserializes a JSON dictionary to create a new e	STRING
HIGH	bbot/core/helpers/misc.py	33	Check if the given input represents a domain without subdomains. This function takes an input string `d` and r	STRING
HIGH	bbot/core/helpers/misc.py	68	Check if the given input represents a subdomain. This function takes an input string `d` and returns True if i	STRING
HIGH	bbot/core/helpers/misc.py	103	Check if the given input represents a PTR record domain. This function takes an input string `d` and returns T	STRING
HIGH	bbot/core/helpers/misc.py	126	Check if the given input represents a valid URL. This function takes an input string `u` and returns True if i	STRING
HIGH	bbot/core/helpers/misc.py	156	Check if the given input represents a URI and optionally return its scheme. This function takes an input strin	STRING
HIGH	bbot/core/helpers/misc.py	191	Parse a string containing a host and port into a tuple. This function takes an input string `d` and returns a	STRING
HIGH	bbot/core/helpers/misc.py	262	Retrieve the parent domain of a given subdomain string. This function takes an input string `d` representing a	STRING
HIGH	bbot/core/helpers/misc.py	297	Generate a list of parent domains for a given domain string. This function takes an input string `d` and gener	STRING
HIGH	bbot/core/helpers/misc.py	349	Retrieve the parent URL of a given URL. This function takes an input string `u` representing a URL and returns	STRING
HIGH	bbot/core/helpers/misc.py	381	Generate a list of parent URLs for a given URL string. This function takes an input string `u` representing a	STRING
HIGH	bbot/core/helpers/misc.py	411	Determine the better HTTP status code between two given codes. The 'better' status code is considered based on	STRING
HIGH	bbot/core/helpers/misc.py	455	Extracts the subdomain, domain, and suffix from a URL string. Args: data (str): The URL string to be p	STRING
HIGH	bbot/core/helpers/misc.py	478	Splits the hostname into its subdomain and registered domain components. Args: hostname (str): The ful	STRING
HIGH	bbot/core/helpers/misc.py	507	Returns an abbreviated representation of the hostname by removing the TLD (Top-Level Domain). Args: do	STRING
HIGH	bbot/core/helpers/misc.py	528	Generates all parent IP networks for a given IP address or network, optionally including the network itself. A	STRING
HIGH	bbot/core/helpers/misc.py	551	Checks if the given string represents a valid port number. Args: p (str or int): The port number to ch	STRING
HIGH	bbot/core/helpers/misc.py	572	Determines if the given string is a valid DNS name. Args: d (str): The string to be checked. Retu	STRING
HIGH	bbot/core/helpers/misc.py	598	Checks if the given string or object represents a valid IP address. Args: d (str or ipaddress.IPvXAddr	STRING
HIGH	bbot/core/helpers/misc.py	634	Checks if the given object is an instance of an IPv4 or IPv6 type from the ipaddress module. Args: i (	STRING
HIGH	bbot/core/helpers/misc.py	695	Convert a string to its corresponding IP address or network type. This function attempts to convert the input	STRING
HIGH	bbot/core/helpers/misc.py	737	Computes the SHA-1 hash of the given data. Args: data (str or dict): The data to hash. If a dictionary	STRING
HIGH	bbot/core/helpers/misc.py	758	Decodes the input data to a UTF-8 string, silently ignoring errors. Args: data (str or bytes): The dat	STRING
HIGH	bbot/core/helpers/misc.py	780	Encodes the input data to bytes using UTF-8 encoding, silently ignoring errors. Args: data (str or byt	STRING
HIGH	bbot/core/helpers/misc.py	809	Recursively decodes doubly or triply-encoded strings to their original form. Supports both URL-encoding and ba	STRING
HIGH	bbot/core/helpers/misc.py	851	Generates a random string of specified length. Args: length (int, optional): The length of the random	STRING
HIGH	bbot/core/helpers/misc.py	892	Extracts key-value pairs from a JSON object and returns them as a set of tuples. Used by the `paramminer_headers` m	STRING
HIGH	bbot/core/helpers/misc.py	936	Extracts tags and their text values from an XML object and returns them as a set of tuples. Args: xml_	STRING
HIGH	bbot/core/helpers/misc.py	997	Intelligently extracts words from given data. This function uses regular expressions and optionally wordninja to ex	STRING
HIGH	bbot/core/helpers/misc.py	1054	Finds the closest matching strings from a list of choices based on a given string. This function uses the difflib l	STRING
HIGH	bbot/core/helpers/misc.py	1138	Reads a string or file and yields its content line-by-line. This function tries to open the given string `s` as a f	STRING
HIGH	bbot/core/helpers/misc.py	1201	Chains together list elements, allowing for entries separated by commas. This function takes a list `l` and flatten	STRING
HIGH	bbot/core/helpers/misc.py	1260	Lists files in a given directory that meet a specified filter condition. Args: directory (str): The directo	STRING
HIGH	bbot/core/helpers/misc.py	1314	Reads a file line by line and yields each line without line breaks. Args: filename (str or Path): The path	STRING
HIGH	bbot/core/helpers/misc.py	1335	Generates numbers with variable padding and returns them as a set of strings. Args: n (int): The upper limi	STRING
HIGH	bbot/core/helpers/misc.py	1362	Constructs a network location string from a given host and port. Args: host (str): The hostname or IP addre	STRING
HIGH	bbot/core/helpers/misc.py	1395	Finds the full path of the first available executable from a list of executables. Args: *executables (str):	STRING
HIGH	bbot/core/helpers/misc.py	1420	Search a nested dictionary or list of dictionaries by a key and yield all matching values. Args: key (str):	STRING
HIGH	bbot/core/helpers/misc.py	1445	Recursively format string values in a dictionary or list using the provided keyword arguments. Args: d (Uni	STRING
HIGH	bbot/core/helpers/misc.py	1470	Recursively search a dictionary's values based on provided regex patterns. Args: d (Union[dict, list, str])	STRING
HIGH	bbot/core/helpers/misc.py	1512	Grouper groups an iterable into chunks of a given size. Args: iterable (iterable): The iterable to be	STRING
HIGH	bbot/core/helpers/misc.py	1533	Splits a list into a specified number of approximately equal parts. Args: alist (list): The list to be	STRING
HIGH	bbot/core/helpers/misc.py	1552	Creates a directory and optionally checks if it's writable. Args: path (str or Path): The directory to	STRING
HIGH	bbot/core/helpers/misc.py	1589	Generates a string representation of the current date and time, with optional microsecond precision. Args:	STRING
HIGH	bbot/core/helpers/misc.py	1621	Extracts the file extension from a given string representing a URL or file path. Args: s (str): The st	STRING
HIGH	bbot/core/helpers/misc.py	1647	Renames a file by appending an iteration number as a backup. Recursively renames files up to a specified maximu	STRING
HIGH	bbot/core/helpers/misc.py	1682	Get the latest modified time of any file or sub-directory in a given directory. This function takes a directory pat	STRING
HIGH	bbot/core/helpers/misc.py	1710	Get the file size of a given file. This function takes a file path as an argument and returns its size in bytes. If	STRING
HIGH	bbot/core/helpers/misc.py	1781	Extract email addresses from a body of text This function takes in a string and yields all email addresses fou	STRING
HIGH	bbot/core/helpers/misc.py	1803	Attempts to find and extract the host portion of a string. Args: s (str): The string from which to ext	STRING
HIGH	bbot/core/helpers/misc.py	1918	Verify if the given sudo password is correct. This function checks whether the sudo password provided is valid for	STRING
HIGH	bbot/core/helpers/misc.py	1947	Generate a formatted table from the given rows and headers. This function uses the `tabulate` package to generate a	STRING
HIGH	bbot/core/helpers/misc.py	2001	Convert a TimeDelta object into a human-readable string. This function takes a datetime.timedelta object and conver	STRING
HIGH	bbot/core/helpers/misc.py	2037	Convert a bytes size to a human-readable string. This function converts a numeric bytes value into a human-readable	STRING
HIGH	bbot/core/helpers/misc.py	2072	Convert a human-readable file size string to its bytes equivalent. This function takes a human-readable file size s	STRING
70 more matches not shown…

Hyper-Verbose Identifiers277 hits · 289 pts

Severity	File	Line	Snippet	Context
LOW	bbot/constants.py	34	def is_valid_scan_status_code(status):	CODE
LOW	bbot/core/config/models.py	181	def partition_sensitive_config(config, model, *, keep_sensitive: bool):	CODE
LOW	bbot/core/event/helpers.py	13	def _get_sorted_event_classes():	CODE
LOW	bbot/core/event/helpers.py	105	def _sanitize_and_extract_host(self, data):	CODE
LOW	bbot/core/event/helpers.py	158	def _sanitize_and_extract_host(data):	CODE
LOW	bbot/core/event/helpers.py	167	def _sanitize_and_extract_host(data):	CODE
LOW	bbot/core/event/helpers.py	183	def _sanitize_and_extract_host(data):	CODE
LOW	bbot/core/event/helpers.py	193	def _sanitize_and_extract_host(data):	CODE
LOW	bbot/core/event/helpers.py	209	def _sanitize_and_extract_host(data):	CODE
LOW	bbot/core/event/helpers.py	223	def _sanitize_and_extract_host(data):	CODE
LOW	bbot/core/helpers/misc.py	1893	def can_sudo_without_password():	CODE
LOW	bbot/core/helpers/misc.py	2681	async def _cancel_and_drain_remaining():	CODE
LOW	bbot/test/conftest.py	53	def _patch_python_module_loader():	CODE
LOW	bbot/test/conftest.py	176	async def patched_request_batch_stream(self, urls, threads=10, **kwargs):	CODE
LOW	bbot/test/conftest.py	224	def bbot_httpserver_allinterfaces():	CODE
LOW	bbot/test/test_step_1/test_field_metadata.py	13	def test_field_records_sensitive_and_mandatory_in_json_schema_extra():	CODE
LOW	bbot/test/test_step_1/test_field_metadata.py	31	def test_global_config_marks_known_secrets_sensitive():	CODE
LOW	bbot/test/test_step_1/test_field_metadata.py	40	def test_module_preload_extracts_sensitive_and_mandatory_sets():	CODE
LOW	bbot/test/test_step_1/test_field_metadata.py	59	def test_modules_table_needs_api_key_derived_from_mandatory():	CODE
LOW	bbot/test/test_step_1/test_field_metadata.py	72	def test_no_secrets_config_redacts_module_and_global_secrets():	CODE
LOW	bbot/test/test_step_1/test_field_metadata.py	105	def test_secrets_only_config_extracts_sensitive_fields():	CODE
LOW	bbot/test/test_step_1/test_field_metadata.py	131	def test_auth_required_property_derives_from_config():	CODE
LOW	bbot/test/test_step_1/test_field_metadata.py	148	def test_credential_connection_fields_are_sensitive():	CODE
LOW	bbot/test/test_step_1/test_manager_scope_accuracy.py	37	async def test_manager_scope_accuracy_correct(bbot_scanner, bbot_httpserver, bbot_other_httpservers, bbot_httpserver_ssl	CODE
LOW	bbot/test/test_step_1/test_manager_scope_accuracy.py	803	async def test_manager_scope_tagging(bbot_scanner):	CODE
LOW	bbot/test/test_step_1/test_manager_scope_accuracy.py	830	async def test_scope_accuracy_with_special_urls(bbot_scanner, bbot_httpserver):	CODE
LOW	bbot/test/test_step_1/test_manager_deduplication.py	6	async def test_manager_deduplication(bbot_scanner):	CODE
LOW	bbot/test/test_step_1/test_target.py	406	async def test_asn_targets_integration(bbot_scanner):	CODE
LOW	bbot/test/test_step_1/test_target.py	444	async def test_asn_targets_edge_cases(bbot_scanner):	CODE
LOW	bbot/test/test_step_1/test_target.py	494	async def test_asn_blacklist_functionality(bbot_scanner):	CODE
LOW	bbot/test/test_step_1/test_target.py	559	async def test_asn_event_json_serialization(bbot_scanner):	CODE
LOW	bbot/test/test_step_1/test_target.py	588	async def test_asn_resolution_failure_aborts_scan(bbot_scanner):	CODE
LOW	bbot/test/test_step_1/test_target.py	608	async def test_asn_resolution_failure_retries(bbot_scanner):	CODE
LOW	bbot/test/test_step_1/test_target.py	706	def test_blacklist_get_invalid_host():	CODE
LOW	bbot/test/test_step_1/test_target.py	783	def test_target_comments_url_fragment_not_stripped():	CODE
LOW	bbot/test/test_step_1/test_target.py	796	def test_target_comments_blacklist():	CODE
LOW	bbot/test/test_step_1/test_target.py	812	def test_target_comments_seeds():	CODE
LOW	bbot/test/test_step_1/test_target.py	827	def test_target_comments_from_file(tmp_path):	CODE
LOW	bbot/test/test_step_1/test_target.py	852	def test_strip_comments_helper():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	6	def test_validate_preset_valid():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	11	def test_validate_preset_typo_top_level():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	18	def test_validate_preset_typo_in_config():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	26	def test_validate_preset_wrong_type():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	34	def test_validate_preset_unknown_module():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	40	def test_validate_preset_unknown_module_option():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	49	def test_validate_preset_wrong_type_on_module_option():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	58	def test_validate_preset_unknown_module_in_config():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	65	def test_validate_preset_multiple_errors():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	83	def test_validate_preset_non_dict():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	89	def test_validate_preset_config_modules_as_list():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	97	def test_validate_preset_module_dirs_as_string():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	103	def test_validate_preset_modules_as_string_no_cascade():	CODE
LOW⚡	bbot/test/test_step_1/test_validate_preset.py	112	def test_validate_preset_non_string_module_entry_no_crash():	CODE
LOW	bbot/test/test_step_1/test_validate_preset.py	132	def test_validate_preset_top_level_typo_suggests_preset_field():	CODE
LOW	bbot/test/test_step_1/test_validate_preset.py	147	def test_validate_preset_file_missing_returns_error():	CODE
LOW	bbot/test/test_step_1/test_validate_preset.py	156	def test_from_dict_raises_on_typos():	CODE
LOW	bbot/test/test_step_1/test_validate_preset.py	169	def test_from_yaml_string_raises_on_top_level_typo():	CODE
LOW	bbot/test/test_step_1/test_validate_preset.py	181	def test_from_yaml_config_typo_deferred_to_validate():	CODE
LOW	bbot/test/test_step_1/test_validate_preset.py	195	def test_validate_preset_interactsh_server_accepts_valid():	CODE
LOW	bbot/test/test_step_1/test_validate_preset.py	202	def test_validate_preset_interactsh_server_rejects_invalid():	CODE
217 more matches not shown…

Deep Nesting240 hits · 222 pts

Severity	File	Line	Context
LOW	bbot/cli.py	39	CODE
LOW	bbot/cli.py	346	CODE
LOW	bbot/core/modules.py	197	CODE
LOW	bbot/core/modules.py	347	CODE
LOW	bbot/core/modules.py	457	CODE
LOW	bbot/core/modules.py	535	CODE
LOW	bbot/core/modules.py	595	CODE
LOW	bbot/core/modules.py	865	CODE
LOW	bbot/core/modules.py	1003	CODE
LOW	bbot/core/modules.py	572	CODE
LOW	bbot/core/config/models.py	181	CODE
LOW	bbot/core/config/logger.py	80	CODE
LOW	bbot/core/event/helpers.py	66	CODE
LOW	bbot/core/event/base.py	2307	CODE
LOW	bbot/core/event/base.py	460	CODE
LOW	bbot/core/event/base.py	660	CODE
LOW	bbot/core/event/base.py	1197	CODE
LOW	bbot/core/event/base.py	1228	CODE
LOW	bbot/core/event/base.py	1606	CODE
LOW	bbot/core/event/base.py	1752	CODE
LOW	bbot/core/helpers/misc.py	891	CODE
LOW	bbot/core/helpers/misc.py	1192	CODE
LOW	bbot/core/helpers/misc.py	1444	CODE
LOW	bbot/core/helpers/misc.py	1469	CODE
LOW	bbot/core/helpers/misc.py	2111	CODE
LOW	bbot/core/helpers/misc.py	2313	CODE
LOW	bbot/core/helpers/misc.py	2522	CODE
LOW	bbot/core/helpers/misc.py	2616	CODE
LOW	bbot/core/helpers/misc.py	2663	CODE
LOW	bbot/core/helpers/misc.py	2854	CODE
LOW	bbot/core/helpers/misc.py	2891	CODE
LOW	bbot/core/helpers/files.py	12	CODE
LOW	bbot/core/helpers/files.py	52	CODE
LOW	bbot/core/helpers/command.py	14	CODE
LOW	bbot/core/helpers/command.py	80	CODE
LOW	bbot/core/helpers/command.py	234	CODE
LOW	bbot/core/helpers/validators.py	78	CODE
LOW	bbot/core/helpers/yara_helper.py	38	CODE
LOW	bbot/core/helpers/wordcloud.py	89	CODE
LOW	bbot/core/helpers/wordcloud.py	327	CODE
LOW	bbot/core/helpers/wordcloud.py	368	CODE
LOW	bbot/core/helpers/wordcloud.py	499	CODE
LOW	bbot/core/helpers/url.py	105	CODE
LOW	bbot/core/helpers/helper.py	329	CODE
LOW	bbot/core/helpers/diff.py	218	CODE
LOW	bbot/core/helpers/diff.py	256	CODE
LOW	bbot/core/helpers/diff.py	350	CODE
LOW	bbot/core/helpers/interactsh.py	289	CODE
LOW	bbot/core/helpers/ratelimiter.py	38	CODE
LOW	bbot/core/helpers/web/web.py	99	CODE
LOW	bbot/core/helpers/web/web.py	346	CODE
LOW	bbot/core/helpers/web/web.py	429	CODE
LOW	bbot/core/helpers/web/web.py	518	CODE
LOW	bbot/core/helpers/web/envelopes.py	115	CODE
LOW	bbot/core/helpers/depsinstaller/installer.py	153	CODE
LOW	bbot/core/helpers/depsinstaller/installer.py	354	CODE
LOW	bbot/core/helpers/dns/brute.py	85	CODE
LOW	bbot/core/helpers/dns/dns.py	181	CODE
LOW	bbot/core/helpers/dns/helpers.py	19	CODE
LOW	bbot/test/conftest.py	136	CODE
180 more matches not shown…

Excessive Try-Catch Wrapping205 hits · 221 pts

Severity	File	Line	Snippet	Context
LOW	bbot/cli.py	389	except Exception as e:	STRING
LOW	bbot/cli.py	397	except Exception as e:	STRING
LOW	bbot/cli.py	443	except Exception as e:	STRING
MEDIUM	bbot/cli.py	381	def akeyboard_listen():	CODE
LOW	bbot/core/core.py	163	except Exception:	CODE
LOW	bbot/core/modules.py	112	except Exception as e:	CODE
LOW	bbot/core/modules.py	423	except Exception:	CODE
LOW	bbot/core/modules.py	563	except Exception as e:	CODE
MEDIUM	bbot/core/modules.py	554	def make_adapter(annotation):	CODE
LOW	bbot/core/config/files.py	72	except Exception as e:	CODE
LOW	bbot/core/config/__init__.py	6	except Exception:	CODE
LOW	bbot/core/event/spill.py	162	except Exception as e: # pragma: no cover — defensive	CODE
MEDIUM	bbot/core/event/base.py	366	def host_metadata(self):	CODE
MEDIUM	bbot/core/event/base.py	1829	def http_status(self):	CODE
LOW	bbot/core/event/base.py	279	except Exception as e:	CODE
LOW	bbot/core/event/base.py	501	except Exception as e:	CODE
LOW	bbot/core/event/base.py	1006	except Exception:	CODE
LOW	bbot/core/event/base.py	1840	except Exception:	CODE
LOW	bbot/core/event/base.py	2207	except Exception as e:	CODE
LOW	bbot/core/event/base.py	2235	except Exception as e:	CODE
LOW	bbot/core/event/base.py	2242	except Exception:	CODE
LOW	bbot/core/event/base.py	2377	except Exception as e:	CODE
LOW	bbot/core/event/base.py	2467	except Exception:	CODE
LOW	bbot/core/helpers/misc.py	622	except Exception:	CODE
LOW	bbot/core/helpers/misc.py	626	except Exception:	CODE
LOW	bbot/core/helpers/misc.py	1579	except Exception as e:	CODE
LOW	bbot/core/helpers/misc.py	1773	except Exception as e:	CODE
LOW	bbot/core/helpers/files.py	45	except Exception as e:	CODE
LOW	bbot/core/helpers/files.py	91	except Exception as e:	CODE
LOW	bbot/core/helpers/files.py	139	except Exception as e:	CODE
LOW	bbot/core/helpers/files.py	164	except Exception as e:	CODE
LOW	bbot/core/helpers/command.py	225	except Exception as e:	CODE
MEDIUM	bbot/core/helpers/command.py	220	def _write_proc_line(proc, chunk):	CODE
LOW	bbot/core/helpers/ntlm.py	71	except Exception:	CODE
LOW	bbot/core/helpers/ntlm.py	79	except Exception as e:	CODE
MEDIUM	bbot/core/helpers/ntlm.py	68	def ntlmdecode(authenticate_header):	CODE
LOW	bbot/core/helpers/validators.py	35	except Exception as e:	CODE
LOW	bbot/core/helpers/validators.py	115	except Exception:	CODE
LOW	bbot/core/helpers/validators.py	121	except Exception:	CODE
MEDIUM	bbot/core/helpers/validators.py	32	def validate_wrapper(args, *kwargs):	CODE
LOW	bbot/core/helpers/asn.py	77	except Exception as e:	CODE
LOW	bbot/core/helpers/asn.py	99	except Exception as e:	CODE
LOW	bbot/core/helpers/asn.py	111	except Exception:	CODE
LOW	bbot/core/helpers/wordcloud.py	361	except Exception as e:	CODE
LOW	bbot/core/helpers/wordcloud.py	394	except Exception as e:	CODE
LOW	bbot/core/helpers/url.py	171	except Exception:	CODE
LOW	bbot/core/helpers/diff.py	68	except Exception:	CODE
LOW	bbot/core/helpers/diff.py	205	except Exception as e:	CODE
LOW	bbot/core/helpers/interactsh.py	154	except Exception:	CODE
LOW	bbot/core/helpers/interactsh.py	266	except Exception as e:	CODE
LOW	bbot/core/helpers/bloom.py	73	except Exception:	CODE
MEDIUM	bbot/core/helpers/bloom.py	70	def __del__(self):	CODE
LOW	bbot/core/helpers/web/web.py	595	except Exception as e:	CODE
LOW	bbot/core/helpers/web/web.py	667	except Exception as e:	CODE
MEDIUM⚡	bbot/core/helpers/depsinstaller/sudo_askpass.py	28	print("Error: Encrypted password or encryption key not found in environment variables.", file=sys.stderr)	CODE
LOW⚡	bbot/core/helpers/depsinstaller/sudo_askpass.py	35	except Exception as e:	CODE
MEDIUM⚡	bbot/core/helpers/depsinstaller/sudo_askpass.py	36	print(f"Error decrypting sudo password: {str(e)}", file=sys.stderr)	CODE
LOW	bbot/test/conftest.py	438	except Exception as e:	CODE
MEDIUM	bbot/test/conftest.py	439	print(f"An error occurred: {str(e)}")	CODE
LOW	bbot/test/conftest.py	482	except Exception:	CODE
145 more matches not shown…

Unused Imports114 hits · 108 pts

Severity	File	Line	Context
LOW	bbot/cli.py	8	CODE
LOW	bbot/core/config/merge.py	9	CODE
LOW	bbot/core/config/models.py	14	CODE
LOW	bbot/core/event/__init__.py	1	CODE
LOW	bbot/core/event/__init__.py	1	CODE
LOW	bbot/core/event/__init__.py	1	CODE
LOW	bbot/core/event/__init__.py	1	CODE
LOW	bbot/core/event/base.py	24	CODE
LOW	bbot/core/helpers/misc.py	18	CODE
LOW	bbot/core/helpers/misc.py	20	CODE
LOW	bbot/core/helpers/misc.py	20	CODE
LOW	bbot/core/helpers/misc.py	21	CODE
LOW	bbot/core/helpers/misc.py	23	CODE
LOW	bbot/core/helpers/misc.py	24	CODE
LOW	bbot/core/helpers/misc.py	27	CODE
LOW	bbot/core/helpers/misc.py	27	CODE
LOW	bbot/core/helpers/misc.py	27	CODE
LOW	bbot/core/helpers/__init__.py	1	CODE
LOW	bbot/core/helpers/__init__.py	2	CODE
LOW	bbot/core/helpers/__init__.py	3	CODE
LOW	bbot/core/helpers/__init__.py	4	CODE
LOW	bbot/core/helpers/helper.py	76	CODE
LOW	bbot/core/helpers/helper.py	79	CODE
LOW	bbot/core/helpers/helper.py	79	CODE
LOW	bbot/core/helpers/helper.py	79	CODE
LOW	bbot/core/helpers/helper.py	79	CODE
LOW	bbot/core/helpers/helper.py	80	CODE
LOW	bbot/core/helpers/helper.py	80	CODE
LOW	bbot/core/helpers/helper.py	80	CODE
LOW	bbot/core/helpers/helper.py	80	CODE
LOW	bbot/core/helpers/helper.py	81	CODE
LOW	bbot/core/helpers/helper.py	81	CODE
LOW	bbot/core/helpers/helper.py	81	CODE
LOW	bbot/core/helpers/helper.py	81	CODE
LOW	bbot/core/helpers/web/__init__.py	1	CODE
LOW	bbot/core/helpers/depsinstaller/__init__.py	1	CODE
LOW	bbot/core/helpers/dns/dns.py	13	CODE
LOW	bbot/core/helpers/dns/__init__.py	1	CODE
LOW	bbot/test/bbot_fixtures.py	1	CODE
LOW	bbot/test/bbot_fixtures.py	2	CODE
LOW	bbot/test/bbot_fixtures.py	4	CODE
LOW	bbot/test/bbot_fixtures.py	5	CODE
LOW	bbot/test/bbot_fixtures.py	13	CODE
LOW	bbot/test/mock_blasthttp.py	33	CODE
LOW	bbot/test/mock_blasthttp.py	33	CODE
LOW	bbot/test/mock_blasthttp.py	33	CODE
LOW	bbot/test/test_step_1/test_command.py	2	CODE
LOW	bbot/test/test_step_1/test_field_metadata.py	10	CODE
LOW	bbot/test/test_step_1/test_db_models.py	7	CODE
LOW	bbot/test/test_step_1/test_manager_scope_accuracy.py	12	CODE
LOW	bbot/test/test_step_1/test_manager_deduplication.py	1	CODE
LOW	bbot/test/test_step_1/test_target.py	1	CODE
LOW	bbot/test/test_step_1/test_validate_preset.py	1	CODE
LOW	bbot/test/test_step_1/test_depsinstaller.py	1	CODE
LOW	bbot/test/test_step_1/test_python_api.py	1	CODE
LOW	bbot/test/test_step_1/test_web.py	5	CODE
LOW	bbot/test/test_step_1/test_scope.py	1	CODE
LOW	bbot/test/test_step_1/test_presets.py	4	CODE
LOW	bbot/test/test_step_1/test_dns.py	1	CODE
LOW	bbot/test/test_step_1/test_gitdumper_safeguards.py	10	CODE
54 more matches not shown…

Cross-File Repetition20 hits · 100 pts

Severity	File	Snippet	Context
HIGH	…_step_2/module_tests/test_module_paramminer_headers.py	<html> <title>the title</title> <body> <p>hello null!</p>'; </body> </html>	STRING
HIGH	…tep_2/module_tests/test_module_paramminer_getparams.py	<html> <title>the title</title> <body> <p>hello null!</p>'; </body> </html>	STRING
HIGH	…st_step_2/module_tests/test_module_url_manipulation.py	<html> <title>the title</title> <body> <p>hello null!</p>'; </body> </html>	STRING
HIGH	…_step_2/module_tests/test_module_paramminer_cookies.py	<html> <title>the title</title> <body> <p>hello null!</p>'; </body> </html>	STRING
HIGH	…_step_2/module_tests/test_module_paramminer_headers.py	<html> <title>the title</title> <body> <p>hello aaaaaaaaaaaaaa!</p>'; </body> </html>	STRING
HIGH	…tep_2/module_tests/test_module_paramminer_getparams.py	<html> <title>the title</title> <body> <p>hello aaaaaaaaaaaaaa!</p>'; </body> </html>	STRING
HIGH	…st_step_2/module_tests/test_module_url_manipulation.py	<html> <title>the title</title> <body> <p>hello aaaaaaaaaaaaaa!</p>'; </body> </html>	STRING
HIGH	…_step_2/module_tests/test_module_paramminer_cookies.py	<html> <title>the title</title> <body> <p>hello aaaaaaaaaaaaaa!</p>'; </body> </html>	STRING
HIGH	…_step_2/module_tests/test_module_paramminer_headers.py	<html> <title>the title</title> <body> <p>hello administrator!</p>'; </body> </html>	STRING
HIGH	…tep_2/module_tests/test_module_paramminer_getparams.py	<html> <title>the title</title> <body> <p>hello administrator!</p>'; </body> </html>	STRING
HIGH	…_step_2/module_tests/test_module_paramminer_cookies.py	<html> <title>the title</title> <body> <p>hello administrator!</p>'; </body> </html>	STRING
HIGH	…t/test/test_step_2/module_tests/test_module_apkpure.py	<!doctype html> <html> <head> <title>"blacklanternsecurity" - android apps on google play</title> </head> <body> <a href	STRING
HIGH	bbot/test/test_step_2/module_tests/test_module_jadx.py	<!doctype html> <html> <head> <title>"blacklanternsecurity" - android apps on google play</title> </head> <body> <a href	STRING
HIGH	…st_step_2/module_tests/test_module_google_playstore.py	<!doctype html> <html> <head> <title>"blacklanternsecurity" - android apps on google play</title> </head> <body> <a href	STRING
HIGH	…t/test/test_step_2/module_tests/test_module_apkpure.py	<!doctype html> <html> <head> <title>bbot</title> </head> <body> <meta name="appstore:developer_url" content="https://ww	STRING
HIGH	bbot/test/test_step_2/module_tests/test_module_jadx.py	<!doctype html> <html> <head> <title>bbot</title> </head> <body> <meta name="appstore:developer_url" content="https://ww	STRING
HIGH	…st_step_2/module_tests/test_module_google_playstore.py	<!doctype html> <html> <head> <title>bbot</title> </head> <body> <meta name="appstore:developer_url" content="https://ww	STRING
HIGH	bbot/modules/paramminer_headers.py	inspired by https://github.com/portswigger/param-miner	STRING
HIGH	bbot/modules/paramminer_cookies.py	inspired by https://github.com/portswigger/param-miner	STRING
HIGH	bbot/modules/paramminer_getparams.py	inspired by https://github.com/portswigger/param-miner	STRING

Decorative Section Separators34 hits · 86 pts

Severity	File	Line	Snippet	Context
MEDIUM	bbot/core/event/spill.py	92	# ── Public API ────────────────────────────────────────────────────	COMMENT
MEDIUM	bbot/core/event/spill.py	180	# ── Internal ──────────────────────────────────────────────────────	COMMENT
MEDIUM	bbot/core/helpers/dns/dns.py	104	# ------------------------------------------------------------------	COMMENT
MEDIUM	bbot/core/helpers/dns/dns.py	107	# ------------------------------------------------------------------	COMMENT
MEDIUM	bbot/core/helpers/dns/dns.py	173	# ------------------------------------------------------------------	COMMENT
MEDIUM	bbot/core/helpers/dns/dns.py	175	# ------------------------------------------------------------------	COMMENT
MEDIUM	bbot/core/helpers/dns/dns.py	354	# ------------------------------------------------------------------	COMMENT
MEDIUM	bbot/core/helpers/dns/dns.py	356	# ------------------------------------------------------------------	COMMENT
MEDIUM	bbot/core/helpers/dns/dns.py	420	# ------------------------------------------------------------------	COMMENT
MEDIUM	bbot/core/helpers/dns/dns.py	422	# ------------------------------------------------------------------	COMMENT
MEDIUM	bbot/test/mock_blasthttp.py	55	# should_intercept, request, request_batch, ...) ──────────────	COMMENT
MEDIUM	bbot/test/mock_blasthttp.py	156	# ── Batch-streaming entry point (per-call real_client) ──────────	COMMENT
MEDIUM⚡	bbot/test/test_step_1/test_body_spill.py	33	# ── BodySpillStore unit tests ─────────────────────────────────────────	COMMENT
MEDIUM⚡	bbot/test/test_step_1/test_body_spill.py	240	# ── _BaselineSnapshot unit tests ──────────────────────────────────────	COMMENT
MEDIUM	bbot/test/test_step_1/test_body_spill.py	145	# ── HTTP_RESPONSE event integration tests ────────────────────────────	COMMENT
MEDIUM	bbot/test/benchmarks/_eventloop_profiler.py	31	# ── Configuration ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	bbot/test/benchmarks/_eventloop_profiler.py	197	# ── Top coroutines by total time ────────────────────────	COMMENT
MEDIUM	bbot/test/benchmarks/_eventloop_profiler.py	210	# ── Top coroutines by max single step ───────────────────	COMMENT
MEDIUM	bbot/test/benchmarks/_eventloop_profiler.py	221	# ── Slow step log ───────────────────────────────────────	COMMENT
MEDIUM	bbot/test/benchmarks/_eventloop_profiler.py	228	# ── Task count timeline ─────────────────────────────────	COMMENT
MEDIUM	bbot/test/benchmarks/_eventloop_profiler.py	239	# ── Task breakdown at peak ──────────────────────────────	COMMENT
MEDIUM	…est/test_step_2/module_tests/test_module_cloudcheck.py	66	# ── Parent-inheritance regression tests ────────────────────────	COMMENT
MEDIUM	…est/test_step_2/module_tests/test_module_cloudcheck.py	126	# ── YARA prefilter short-circuit ───────────────────────────────	COMMENT
MEDIUM	…est/test_step_2/module_tests/test_module_cloudcheck.py	144	# ── LRU cache on cloudcheck.lookup() ───────────────────────────	COMMENT
MEDIUM	…test/test_step_2/module_tests/test_module_lightfuzz.py	4910	# ---------------------------------------------------------------------------	STRING
MEDIUM	…test/test_step_2/module_tests/test_module_lightfuzz.py	4912	# ---------------------------------------------------------------------------	STRING
MEDIUM	…test/test_step_2/module_tests/test_module_lightfuzz.py	5136	# ---------------------------------------------------------------------------	STRING
MEDIUM	…test/test_step_2/module_tests/test_module_lightfuzz.py	5138	# ---------------------------------------------------------------------------	STRING
MEDIUM	…test/test_step_2/module_tests/test_module_lightfuzz.py	5204	# ---------------------------------------------------------------------------	STRING
MEDIUM	…test/test_step_2/module_tests/test_module_lightfuzz.py	5206	# ---------------------------------------------------------------------------	STRING
MEDIUM	…test/test_step_2/module_tests/test_module_lightfuzz.py	5298	# ---------------------------------------------------------------------------	STRING
MEDIUM	…test/test_step_2/module_tests/test_module_lightfuzz.py	5300	# ---------------------------------------------------------------------------	STRING
MEDIUM	bbot/modules/templates/gitlab.py	90	# ------------------------------------------------------------------	COMMENT
MEDIUM	bbot/modules/templates/gitlab.py	92	# ------------------------------------------------------------------	COMMENT

Self-Referential Comments21 hits · 68 pts

Severity	File	Line	Snippet	Context
MEDIUM	bbot/core/event/base.py	796	# Create a shallow copy of the event first	COMMENT
MEDIUM	bbot/core/helpers/yara_helper.py	22	# Create the complete YARA rule	COMMENT
MEDIUM	bbot/core/helpers/bloom.py	23	# Create an anonymous mmap region, compatible with both Windows and Unix	COMMENT
MEDIUM	bbot/core/helpers/web/envelopes.py	29	# Create the class	COMMENT
MEDIUM	bbot/test/test_step_1/test_target.py	572	# Create an ASN event like the scanner does (bare int input)	COMMENT
MEDIUM	…ot/test/benchmarks/test_event_validation_benchmarks.py	14	# Create a minimal scanner config to isolate event validation performance	COMMENT
MEDIUM	bbot/test/benchmarks/test_excavate_benchmarks.py	124	# Create a mock HTTP_RESPONSE event	COMMENT
MEDIUM	…test/test_step_2/module_tests/test_module_websocket.py	19	# Define a coroutine for the server	COMMENT
MEDIUM	…st/test_step_2/module_tests/test_module_virtualhost.py	160	# Create a dummy module that will emit the URL event during the scan	COMMENT
MEDIUM	…st/test_step_2/module_tests/test_module_virtualhost.py	767	# Create a dummy module that will emit the URL event during the scan	COMMENT
MEDIUM	…test/test_step_2/module_tests/test_module_unarchive.py	26	# Create a text file to compress	COMMENT
MEDIUM	bbot/models/sql.py	1	# This file contains SQLModel (Pydantic + SQLAlchemy) models for BBOT events, scans, and targets.	COMMENT
MEDIUM	bbot/modules/hunt.py	302	# Create a comma-separated string of categories	COMMENT
MEDIUM	bbot/modules/lightfuzz/submodules/cmdi.py	62	) # Initialize the http_compare object and establish a baseline HTTP response	CODE
MEDIUM⚡	bbot/modules/output/postgres.py	31	# Create the engine for the initial connection to the server	COMMENT
MEDIUM⚡	bbot/modules/output/postgres.py	39	# Create the database if it does not exist	COMMENT
MEDIUM	bbot/modules/output/nmap_xml.py	86	# Create the root element	COMMENT
MEDIUM	bbot/modules/output/nmap_xml.py	164	# Create a new document with the doctype	COMMENT
MEDIUM⚡	bbot/modules/output/mysql.py	30	# Create the engine for the initial connection to the server	COMMENT
MEDIUM⚡	bbot/modules/output/mysql.py	38	# Create the database if it does not exist	COMMENT
MEDIUM	bbot/modules/templates/sql.py	91	# Create a session factory bound to the engine	COMMENT

Cross-Language Confusion12 hits · 50 pts

Severity	File	Line	Snippet	Context
HIGH	…ot/test/test_step_2/module_tests/test_module_medusa.py	9	stdout = "ACCOUNT FOUND: [snmp] Host: 127.0.0.1 User: (null) Password: public [ERROR]\n"	CODE
HIGH	…st/test_step_2/module_tests/test_module_docker_pull.py	268	"created_by": 'RUN /bin/sh -c set -eux; \t\tsavedAptMark="$(apt-mark showmanual)"; \tapt-get upd	CODE
HIGH	…st/test_step_2/module_tests/test_module_docker_pull.py	302	"created_by": 'RUN /bin/sh -c set -eux; \t\tsavedAptMark="$(apt-mark showmanual)"; \tapt-get upd	CODE
HIGH	…st/test_step_2/module_tests/test_module_docker_pull.py	336	"created_by": "RUN /bin/sh -c apt-get update && apt-get install -y openssl gcc git make unzip cu	CODE
HIGH	…st/test_step_2/module_tests/test_module_docker_pull.py	390	"v1Compatibility": '{"id":"e45a5af57b00862e5ef5782a9925979a02ba2b12dff832fd0991335f4a11e5c5","pa	CODE
HIGH	…st/test_step_2/module_tests/test_module_docker_pull.py	393	"v1Compatibility": '{"id":"e45a5af57b00862e5ef5782a9925979a02ba2b12dff832fd0991335f4a11e5c5","pa	CODE
HIGH	…t/test/test_step_2/module_tests/test_module_ajaxpro.py	9	null; r.error = {"Message":"Constructor on type 'AjaxPro.Services.ICartService' not found.","Type":"System.MissingMe	CODE
HIGH	…t/test/test_step_2/module_tests/test_module_ajaxpro.py	54	<script src="ajax/AMBusinessFacades.AjaxUtils,AMBusinessFacades.ashx" type="text/javascript"></script><script type='	CODE
HIGH	…est/test_step_2/module_tests/test_module_trufflehog.py	772	"created_by": 'RUN /bin/sh -c set -eux; \t\tsavedAptMark="$(apt-mark showmanual)"; \tapt-get upd	STRING
HIGH	…est/test_step_2/module_tests/test_module_trufflehog.py	806	"created_by": 'RUN /bin/sh -c set -eux; \t\tsavedAptMark="$(apt-mark showmanual)"; \tapt-get upd	STRING
HIGH	…est/test_step_2/module_tests/test_module_trufflehog.py	840	"created_by": "RUN /bin/sh -c apt-get update && apt-get install -y openssl gcc git make unzip cu	STRING
HIGH	bbot/modules/lightfuzz/submodules/ssti.py	14	collapse trick for engines that render `{{undefined}}` as ""),	STRING

Over-Commented Block33 hits · 32 pts

Severity	File	Line	Snippet	Context
LOW	docs/scanning/configuration.md	61		COMMENT
LOW	docs/scanning/configuration.md	81	# Redact secrets (API keys, tokens, etc.) in the saved preset.yml	COMMENT
LOW	docs/scanning/configuration.md	101		COMMENT
LOW	docs/scanning/configuration.md	121	search_distance: 1	COMMENT
LOW	docs/scanning/configuration.md	161	# Suffix to append to user-agent (e.g. for tracking or identification)	COMMENT
LOW	docs/scanning/configuration.md	181	api_retries: 2	COMMENT
LOW	bbot/defaults.yml	1	### BASIC OPTIONS ###	COMMENT
LOW	bbot/defaults.yml	21	max_mem_percent: 90	COMMENT
LOW	bbot/defaults.yml	61	# This is safe to change	COMMENT
LOW	bbot/defaults.yml	101	user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/5	COMMENT
LOW	bbot/defaults.yml	121	# which will retry API requests that don't return a successful status code	COMMENT
LOW	bbot/core/helpers/regexes.py	21	num_regex = re.compile(r"\d+")	COMMENT
LOW	bbot/test/benchmarks/__init__.py	1	# Benchmark tests for BBOT performance monitoring	COMMENT
LOW	…est/benchmarks/test_intercept_throughput_benchmarks.py	101	assert cloudcheck_idx >= 0, f"cloudcheck not in intercept chain: {[m.name for m in intercept_modules]}"	COMMENT
LOW	…test/test_step_2/module_tests/test_module_lightfuzz.py	4461	]	COMMENT
LOW	…test/test_step_2/module_tests/test_module_lightfuzz.py	4561	"URL_UNVERIFIED for /secret-endpoint not emitted — cookie refresh failed; "	COMMENT
LOW	…test/test_step_2/module_tests/test_module_lightfuzz.py	4641	# in event metadata). When lightfuzz fuzzes a sibling field, the None comes	COMMENT
LOW	…test/test_step_2/module_tests/test_module_unarchive.py	201	assert extract_path.is_file(), "Failed to extract the test file"	COMMENT
LOW	bbot/models/pydantic.py	41	return indexed_fields	COMMENT
LOW	bbot/presets/subdomain-enum.yml	21	# securitytrails:	COMMENT
LOW	bbot/modules/securitytxt.py	1	# securitytxt.py	COMMENT
LOW	bbot/modules/securitytxt.py	21	#	COMMENT
LOW	bbot/modules/medusa.py	181		COMMENT
LOW	bbot/modules/builtwith.py	1	############################################################	COMMENT
LOW	bbot/modules/newsletters.py	1	# Created a new module called 'newsletters' that will scrape the websites (or recursive websites,	COMMENT
LOW	bbot/modules/dnstlsrpt.py	1	# dnstlsrpt.py	COMMENT
LOW	bbot/modules/dnscaa.py	1	# dnscaa.py	COMMENT
LOW	bbot/modules/legba.py	161	# -C Combo wordlist delimited by ':'	COMMENT
LOW	bbot/modules/dnsbimi.py	1	# bimi.py	COMMENT
LOW	bbot/modules/dnsbimi.py	21	#	COMMENT
LOW	bbot/modules/internal/cloudcheck.py	21	# LRU cache for cloudcheck.lookup() results. Many subdomains in a single	COMMENT
LOW	.github/workflows/codeql.yml	1	# For most projects, this workflow file will not need changing; you simply need	COMMENT
LOW	.github/workflows/codeql.yml	61	# This includes steps like installing compilers or runtimes (`actions/setup-node`	COMMENT

Redundant / Tautological Comments19 hits · 28 pts

Severity	File	Line	Snippet	Context
LOW	bbot/core/helpers/misc.py	843	# Check if there's still URL-encoded or Unicode-escaped content	COMMENT
LOW	…t/test/test_step_2/module_tests/test_module_telerik.py	173	# Check if the expected requests were made	COMMENT
LOW	bbot/scripts/benchmark_report.py	57	# Check if benchmarks directory exists	COMMENT
LOW	bbot/modules/azure_tenant.py	289	# Check if Exchange Online is in the MX records	COMMENT
LOW	bbot/modules/virtualhost.py	739	# Check if this virtual host is externally accessible	COMMENT
LOW⚡	bbot/modules/virtualhost.py	882	# Check if HTTP codes are different first (hard failure)	COMMENT
LOW	bbot/modules/trajan.py	210	# Check if it's a specific job	COMMENT
LOW	bbot/modules/reflected_parameters.py	52	# Check if the probe parameter value is reflected AND the canary is not	COMMENT
LOW	bbot/modules/iis_shortnames.py	356	# Check if it's a ZIP file	COMMENT
LOW	bbot/modules/base.py	865	# Check if module accepts seeds and event is a seed (only if event type is watched)	COMMENT
LOW	bbot/modules/lightfuzz/submodules/crypto.py	268	# Check if the entropy of the data is greater than the threshold, indicating it is likely encrypted	COMMENT
LOW	bbot/modules/lightfuzz/submodules/crypto.py	800	# Check if cryptographic error strings are present in the response after performing the manipulation techniques	COMMENT
LOW	bbot/modules/lightfuzz/submodules/serial.py	200	# Check if the value starts with any of the PHP serialized prefixes	COMMENT
LOW	bbot/modules/lightfuzz/submodules/sqli.py	168	# Check if the status code change is due to a WAF, not SQL injection	COMMENT
LOW	bbot/modules/internal/excavate.py	398	# Check if the value is in the blacklist or starts with a blacklisted prefix.	COMMENT
LOW	bbot/modules/internal/excavate.py	1355	# Check if data and decoded_data are identical	STRING
LOW	bbot/modules/internal/excavate.py	1371	# Check if rule processing function exists	STRING
LOW⚡	bbot/modules/output/postgres.py	35	# Check if the database exists	COMMENT
LOW⚡	bbot/modules/output/mysql.py	34	# Check if the database exists	COMMENT

AI Slop Vocabulary11 hits · 20 pts

Severity	File	Line	Snippet	Context
LOW	bbot/core/helpers/web/envelopes.py	121	# if the value is empty, we just return the text envelope	COMMENT
LOW	bbot/core/helpers/web/envelopes.py	204	# if there's only one value to set, we can just set it directly	COMMENT
MEDIUM	bbot/test/benchmarks/_memory_helpers.py	81	# median over the last 25% of samples — robust to a single	COMMENT
MEDIUM⚡	bbot/test/benchmarks/test_bloom_filter_benchmarks.py	31	"""Benchmark comprehensive bloom filter operations (add, check, mixed) for DNS brute-forcing"""	STRING
MEDIUM	…ot/test/benchmarks/test_event_validation_benchmarks.py	283	"""Benchmark full scan startup event validation with large batch (1000 targets) for comprehensive testing"""	STRING
MEDIUM	…/test/test_step_2/module_tests/test_module_excavate.py	1793	# here because the wall-clock includes the rest of the scan harness.	STRING
MEDIUM	bbot/modules/azure_tenant.py	49	# 4. Merge all data sources into comprehensive event	COMMENT
MEDIUM	bbot/modules/azure_tenant.py	57	# 6. Emit comprehensive AZURE_TENANT event	COMMENT
MEDIUM	bbot/modules/azure_tenant.py	355	"""Merge data from all sources into single comprehensive event."""	STRING
LOW	bbot/modules/dnsbrute_mutations.py	33	# here we don't brute-force, we just add the subdomain to our end-of-scan	COMMENT
LOW	bbot/modules/telerik.py	335	# Sometimes webapps will just return 500 for everything, so rule out the false positive	COMMENT

AI Structural Patterns15 hits · 15 pts

Severity	File	Line	Context
LOW	bbot/core/event/base.py	2307	CODE
LOW	bbot/core/event/base.py	195	CODE
LOW	bbot/core/helpers/helper.py	170	CODE
LOW	bbot/core/helpers/diff.py	73	CODE
LOW	bbot/core/helpers/diff.py	256	CODE
LOW	bbot/scripts/docs.py	105	CODE
LOW	bbot/modules/fullhunt.py	37	CODE
LOW	bbot/modules/rapiddns.py	19	CODE
LOW	bbot/modules/securitytrails.py	28	CODE
LOW	bbot/modules/hackertarget.py	19	CODE
LOW	bbot/modules/subdomaincenter.py	19	CODE
LOW	bbot/modules/leakix.py	30	CODE
LOW	bbot/modules/reflected_parameters.py	92	CODE
LOW	bbot/modules/output/asset_inventory.py	78	CODE
LOW	bbot/scanner/preset/preset.py	114	CODE

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	docs/javascripts/vega-lite@5.js	1	!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports,require("vega")):"function"==typeof define	CODE

Modern Structural Boilerplate9 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	bbot/core/config/merge.py	94	__all__ = ["deep_merge", "dotted_get", "dotted_set", "iter_dotted_paths"]	CODE
LOW	bbot/core/config/models.py	469	__all__ = [	CODE
LOW	bbot/core/event/__init__.py	3	__all__ = ["make_event", "update_event", "is_event", "event_from_json"]	CODE
LOW	bbot/core/helpers/depsinstaller/__init__.py	3	__all__ = ["DepsInstaller"]	CODE
LOW	bbot/core/helpers/dns/dns.py	469	__all__ = ["DNSHelper", "all_rdtypes", "extract_targets", "record_to_text"]	CODE
LOW	…/test_step_2/module_tests/test_module_bucket_amazon.py	6	__all__ = ["random_bucket_name_1", "random_bucket_name_2", "random_bucket_name_3", "Bucket_Amazon_Base"]	CODE
LOW	bbot/scanner/__init__.py	18	__all__ = [	CODE
LOW	bbot/scanner/preset/__init__.py	16	__all__ = [	CODE
LOW	bbot/scanner/preset/validate.py	317	__all__ = ["PresetValidationError", "prevalidate_preset", "validate_preset", "validate_preset_file"]	CODE

Fake / Example Data6 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW⚡	…ot/test/benchmarks/test_event_validation_benchmarks.py	412	("admin@example.com", "EMAIL_ADDRESS"),	CODE
LOW	bbot/test/benchmarks/test_excavate_benchmarks.py	38	padding_pattern = "Lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididu	CODE
LOW	bbot/test/benchmarks/test_excavate_benchmarks.py	38	padding_pattern = "Lorem ipsum dolor sit amet consectetur adipiscing elit sed do eiusmod tempor incididu	CODE
LOW	bbot/wordlists/paramminer_cookies.txt	351	fake_user	CODE
LOW	bbot/modules/newsletters.py	3	# contains a 'placeholder'. The combination of these two HTML items usually signify the presence	COMMENT
LOW	bbot/modules/newsletters.py	33	regex = re.compile(r"placeholder")	CODE

Slop Phrases2 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	bbot/scanner/preset/environ.py	52	# if we're running in a virtual environment, make sure to include its /bin in PATH	COMMENT
MEDIUM	.github/workflows/codeql.yml	54	# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how	COMMENT

Overly Generic Function Names2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	bbot/test/test_step_1/test_helpers.py	807	async def do_stuff(r):	CODE
LOW	bbot/modules/base.py	994	async def run_task(self, coro, name, n=1):	CODE

Analysis Overview

What These Metrics Mean

Score History

Severity Breakdown

Directory Score Breakdown

Pattern Findings