1.6

Adjusted Signal

1.6

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

3.8K

Stars

Language

355.9K

Lines of Code

1.6K

Files

407

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 397 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.9/100 · LOW

Are imports declared and package/API names verified? 10 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2 finding(s).

PR Review Velocity Impact 6.6/100 · LOW

Which changes need focused human review? 407 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 6HIGH 3MEDIUM 4LOW 394

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 407 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block264 hits · 258 pts

Severity	File	Line	Snippet	Context
LOW	config.example.yml	1	# This is an example config.yml file with some sensible defaults.	COMMENT
LOW	.goreleaser.yml	161	# hooks:	COMMENT
LOW	.goreleaser.yml	181	# goarch:	COMMENT
LOW	.goreleaser.yml	201	# - PKG_CONFIG_PATH=/tmp/install_aarch64/usr/local/lib/pkgconfig	COMMENT
LOW	cmd/ipsw/cmd/symbolicate.go	121	# Show disassembly around panic frames with --peek (default 5 instructions)	COMMENT
LOW	cmd/ipsw/cmd/dyld/dyld_mg.go	181	// for _, key := range lookHere {	COMMENT
LOW	internal/syms/jsonl.go	341	// In facts mode, a "comparison_facts_collection_start" line follows the "ipsw"	COMMENT
LOW	internal/diff/tasks_sandbox.go	61	// does not alter its parser output. parseSandboxProfiles always walks the fixed	COMMENT
LOW	internal/diff/tasks_sandbox.go	81		COMMENT
LOW	internal/diff/tasks_sandbox.go	441	return slug	COMMENT
LOW	internal/diff/jobs_ents.go	21	// code-signature blob extraction piggybacks on the same walk that feeds	COMMENT
LOW	internal/diff/jobs_ents.go	161	appendLaunchConstraint(&out, "Responsible", cs.LaunchConstraintsResponsible)	COMMENT
LOW	internal/diff/md.go	321	// list renders as a plain, always-visible bullet list. At or above it (but below	COMMENT
LOW	internal/diff/md.go	481	fmt.Fprintf(&body, "## %s\n\n", bin)	COMMENT
LOW	internal/diff/jobs_dsc.go	61	if j == nil \|\| j.d == nil {	COMMENT
LOW	internal/diff/jobs_dsc.go	101	j.d.Old.Webkit = j.hydrated.OldWebkit	COMMENT
LOW	internal/diff/jobs_dsc.go	121	// machosJob, but DSC image diffs suppress load-command comparison because cache	COMMENT
LOW	internal/diff/jobs_dsc.go	201	}	COMMENT
LOW	internal/diff/task.go	21	// uses html/template so renderers may compose pre-escaped fragments without	COMMENT
LOW	internal/diff/task.go	41	//	COMMENT
LOW	internal/diff/task.go	61	//	COMMENT
LOW	internal/diff/task.go	101	// MachoWalkTask is a mount-scoped Task that participates in the shared	COMMENT
LOW	internal/diff/task.go	121	// MachoVolumeAborter is optionally implemented by [MachoWalkTask]s that keep	COMMENT
LOW	internal/diff/tasks_firmwares.go	61		COMMENT
LOW	internal/diff/tasks_firmwares.go	81	hashMachoDiffConfig(h, t.firmwareDiffConfig())	COMMENT
LOW	internal/diff/jobs_localizations.go	101	// extraction), or the rendered Localizations section semantics change in a way	COMMENT
LOW	internal/diff/jobs_localizations.go	121	// InputHash digests the task-scope inputs: the old and new BuildManifest DMG	COMMENT
LOW	internal/diff/ipsw_artifacts.go	361	}	COMMENT
LOW	internal/diff/ipsw_artifacts.go	441	}	COMMENT
LOW	internal/diff/ipsw_artifacts.go	541	}	COMMENT
LOW	internal/diff/tasks_kexts.go	61	return d.parseKernelcache()	COMMENT
LOW	internal/diff/tasks_kexts.go	281	func (t kextsTask) Markdown(w strings.Builder, outputDir string) error {	COMMENT
LOW	internal/diff/sandbox_buildtag.go	1	//go:build sandbox	COMMENT
LOW	internal/diff/diff.go	121		COMMENT
LOW	internal/diff/diff.go	801	}	COMMENT
LOW	internal/diff/diff.go	841	// extractOldKernelcache resolves a single Old-side kernelcache on disk and	COMMENT
LOW	internal/diff/diff.go	961	}	COMMENT
LOW	internal/diff/tasks_kdks.go	41	// so the dwarf parse + markdown rendering pipeline is unchanged.	COMMENT
LOW	internal/diff/tasks_kdks.go	61	// thing that can change the rendered bytes is the parse/diff/render logic itself,	COMMENT
LOW	internal/diff/tasks_kdks.go	81	return filepath.Join(path+".dSYM/Contents/Resources/DWARF", filepath.Base(path))	COMMENT
LOW	internal/diff/tasks_kdks.go	101	// without writing real KDK files (which are multi-GB dSYM DWARF binaries). ok is	COMMENT
LOW	internal/diff/tasks_kdks.go	121	// InputHash digests the EXTERNAL KDK inputs: the user-passed d.Old.KDK and	COMMENT
LOW	internal/diff/tasks_kdks.go	241	return nil	COMMENT
LOW	internal/diff/cache_idempotency_test.go	21	// bug.	COMMENT
LOW	internal/diff/sandbox_buildtag_stub.go	1	//go:build !sandbox	COMMENT
LOW	internal/diff/tasks_kdks_cache_test.go	61		COMMENT
LOW	internal/diff/jobs_machos.go	21	// participates in the shared per-volume Mach-O walk via [MachoWalkTask],	COMMENT
LOW	internal/diff/jobs_machos.go	241	// Version reports the cache payload / output-semantics version. See	COMMENT
LOW	internal/diff/jobs_machos.go	261	// - IgnoreBuildTimestamps (only when enabled; false preserves legacy scope)	COMMENT
LOW	internal/diff/jobs_machos.go	281	hashMachoDiffConfig(h, j.conf)	COMMENT
LOW	internal/diff/volume_jobs.go	61	// the loop without real mounts.	COMMENT
LOW	internal/diff/volume_jobs.go	301	}	COMMENT
LOW	internal/diff/jobs_files.go	141	const filesCacheVersion = 1	COMMENT
LOW	internal/diff/jobs_files.go	361	// JSON returns the per-task report payload: the per-bucket [FileDiff]	COMMENT
LOW	internal/diff/jobs_launchd.go	61	// launchdJob. Bump it whenever the persisted row layout (the rendered launchd	COMMENT
LOW	internal/diff/jobs_launchd.go	81		COMMENT
LOW	internal/diff/jobs_features.go	101	// featuresJob. Bump it whenever the persisted row layout (per-volume	COMMENT
LOW	internal/diff/jobs_features.go	121	}	COMMENT
LOW	internal/diff/report.go	1	package diff	COMMENT
LOW	internal/diff/tasks_iboot.go	61	// no output-affecting flags: parseIBoot always extracts the iBoot strings,	COMMENT
204 more matches not shown…

TODO Padding96 hits · 168 pts

Severity	File	Line	Snippet	Context
LOW	cmd/ipsw/cmd/idev/idev_restore_ramdisk.go	41	panic("not implemented") // TODO: implement	CODE
LOW	cmd/ipsw/cmd/idev/idev_restore_update.go	41	panic("not implemented") // TODO: implement	CODE
LOW	cmd/ipsw/cmd/idev/idev_restore_tss.go	41	panic("not implemented") // TODO: implement	CODE
LOW	internal/commands/macho/swift.go	28	Addrs bool // TODO: implement in swift string formatters	CODE
LOW⚡	api/server/routes/idev/routes.go	23	// ig.GET("/apps", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	24	// ig.GET("/apps/install", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	25	// ig.GET("/apps/ls", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	26	// ig.GET("/apps/uninstall", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	28	// ig.GET("/comp", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	30	// ig.GET("/crash", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	31	// ig.GET("/crash/clear", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	32	// ig.GET("/crash/ls", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	33	// ig.GET("/crash/pull", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	35	// ig.GET("/diag", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	44	// ig.GET("/fsyms", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	46	// ig.GET("/img", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	47	// ig.GET("/img/lookup", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	48	// ig.GET("/img/ls", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	49	// ig.GET("/img/mount", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	50	// ig.GET("/img/unmount", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	63	// ig.GET("/loc", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	64	// ig.GET("/loc/clear", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	65	// ig.GET("/loc/play", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	66	// ig.GET("/loc/set", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	68	// ig.GET("/noti", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	70	// ig.GET("/pcap", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	72	// ig.GET("/prof", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	73	// ig.GET("/prof/cloud", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	74	// ig.GET("/prof/install", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	75	// ig.GET("/prof/ls", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	76	// ig.GET("/prof/rm", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	77	// ig.GET("/prof/wifi", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	79	// ig.GET("/prov", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	80	// ig.GET("/prov/clear", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	81	// ig.GET("/prov/dump", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	82	// ig.GET("/prov/install", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	83	// ig.GET("/prov/ls", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	84	// ig.GET("/prov/rm", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	86	// ig.GET("/proxy", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	88	// ig.GET("/ps", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	90	// ig.GET("/restore", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	91	// ig.GET("/restore/enter", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	92	// ig.GET("/restore/exit", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	94	// ig.GET("/screen", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	96	// ig.GET("/springb", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	97	// ig.GET("/springb/icon", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	98	// ig.GET("/springb/orient", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	99	// ig.GET("/springb/wallpaper", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	101	// ig.GET("/syslog", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/idev/routes.go	103	// ig.GET("/wifi", handler) // TODO: implement this	COMMENT
LOW	api/server/routes/idev/routes.go	11	// ig.GET("/afc", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/macho/routes.go	10	// m.GET("/a2o", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/macho/routes.go	11	// m.GET("/a2s", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/macho/routes.go	12	// m.GET("/bbl", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/macho/routes.go	13	// m.GET("/disass", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/macho/routes.go	14	// m.GET("/dump", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/macho/routes.go	67	// m.GET("/lipo", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/macho/routes.go	68	// m.GET("/o2a", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/macho/routes.go	69	// m.GET("/patch", handler) // TODO: implement this	COMMENT
LOW⚡	api/server/routes/macho/routes.go	70	// m.GET("/search", handler) // TODO: implement this	COMMENT
36 more matches not shown…

Hallucination Indicators6 hits · 60 pts

Severity	File	Line	Snippet	Context
CRITICAL	internal/diff/md.go	73	d.Old.Kernel.Version.KernelVersion.Date.Format("Mon, 02Jan2006 15:04:05 MST"),	CODE
CRITICAL	internal/diff/md.go	76	d.New.Kernel.Version.KernelVersion.Date.Format("Mon, 02Jan2006 15:04:05 MST"),	CODE
CRITICAL	internal/diff/format.go	1672	data.OldKernelDate = d.Old.Kernel.Version.KernelVersion.Date.Format(	CODE
CRITICAL	internal/diff/format.go	1679	data.NewKernelDate = d.New.Kernel.Version.KernelVersion.Date.Format(	CODE
CRITICAL	internal/diff/tasks_kexts_cache_test.go	223	if !dst.d.New.Kernel.Version.KernelVersion.Date.Equal(newVer.KernelVersion.Date) {	CODE
CRITICAL	internal/diff/tasks_kexts_cache_test.go	227	if zone, _ := dst.d.New.Kernel.Version.KernelVersion.Date.Zone(); zone != "PDT" {	CODE

Verbosity Indicators12 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	internal/commands/ent/replacement.go	360	// Step 1: Delete old IPSW data	COMMENT
LOW⚡	pkg/img4/payload_test.go	231	// Step 1: Create payload	COMMENT
LOW⚡	pkg/img4/payload_test.go	237	// Step 2: Marshal	COMMENT
LOW⚡	pkg/img4/payload_test.go	243	// Step 3: Parse	COMMENT
LOW⚡	pkg/img4/payload_test.go	249	// Step 4: Verify parsed matches original	COMMENT
LOW⚡	pkg/img4/payload_test.go	257	// Step 5: Test decompression and data integrity	COMMENT
LOW	pkg/img4/img4_test.go	712	// Step 1: Create IMG4 from real data	COMMENT
LOW⚡	pkg/img4/img4_test.go	733	// Step 2: Marshal the IMG4	COMMENT
LOW⚡	pkg/img4/img4_test.go	741	// Step 3: Parse the IMG4 back	COMMENT
LOW⚡	pkg/img4/img4_test.go	747	// Step 4: Extract and validate individual components	COMMENT
LOW	pkg/img4/img4_test.go	778	// Step 5: Test decompression and extra data	COMMENT
LOW	pkg/img4/img4_test.go	798	// Step 6: Test roundtrip creation from extracted components	COMMENT

Structural Annotation Overuse12 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	internal/commands/ent/replacement.go	360	// Step 1: Delete old IPSW data	COMMENT
LOW⚡	pkg/img4/payload_test.go	231	// Step 1: Create payload	COMMENT
LOW⚡	pkg/img4/payload_test.go	237	// Step 2: Marshal	COMMENT
LOW⚡	pkg/img4/payload_test.go	243	// Step 3: Parse	COMMENT
LOW⚡	pkg/img4/payload_test.go	249	// Step 4: Verify parsed matches original	COMMENT
LOW⚡	pkg/img4/payload_test.go	257	// Step 5: Test decompression and data integrity	COMMENT
LOW	pkg/img4/img4_test.go	712	// Step 1: Create IMG4 from real data	COMMENT
LOW⚡	pkg/img4/img4_test.go	733	// Step 2: Marshal the IMG4	COMMENT
LOW⚡	pkg/img4/img4_test.go	741	// Step 3: Parse the IMG4 back	COMMENT
LOW⚡	pkg/img4/img4_test.go	747	// Step 4: Extract and validate individual components	COMMENT
LOW	pkg/img4/img4_test.go	778	// Step 5: Test decompression and extra data	COMMENT
LOW	pkg/img4/img4_test.go	798	// Step 6: Test roundtrip creation from extracted components	COMMENT

AI Response Leakage2 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	internal/srp/srp.go	26	// In this implementation:	COMMENT
HIGH	pkg/dyld/prebuilt.go	148	// FIXME: REMOVE once I have added iOS 18.x support	COMMENT

AI Slop Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	pkg/kernelcache/kernelcache.go	284	// Essentially: lipo -thin arm64e	COMMENT
MEDIUM	pkg/kernelcache/ref/joker.c	2550	// Definitely clean this up sometime... especially now that INFO is used..	COMMENT
MEDIUM	pkg/img4/manifest.go	759	// Scan for certificate patterns in the data (more robust approach)	COMMENT

Synthetic Comment Markers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	README.md	156	- [DeepWiki](https://deepwiki.com/blacktop/ipsw), an AI-generated guide to the codebase	CODE

Redundant / Tautological Comments4 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	cmd/ipsw/cmd/download/download_tss.go	82	# Check if iOS version is still being signed	COMMENT
LOW	cmd/ipsw/cmd/download/download_tss.go	85	# Check if latest iOS version is still being signed	COMMENT
LOW	.github/workflows/update-fcs-keys.yml	256	# Check if normalization or cache update actually changed anything.	COMMENT
LOW	pkg/crashlog/ida.go	225	# Check if address exists in the database	STRING

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	cmd/ipsw/cmd/symbolicate.go	136	# Shows runtime addresses you can use with lldb breakpoints	COMMENT

Fake / Example Data3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	internal/download/ota_records_test.go	80	releaseVariant.ArchiveDecryptionKey = "other-fake-key"	CODE
LOW	internal/download/ota_records_test.go	89	alternate.ArchiveDecryptionKey = "fake-key"	CODE
LOW	internal/commands/ent/templates/static/highlight.min.js	313	}),ae=["a","abbr","address","article","aside","audio","b","blockquote","body","button","canvas","caption","cite","code",	CODE

Hyper-Verbose Identifiers2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	hack/extras/webdriver.py	7	def test_feature_status_page_search(self):	CODE
LOW	hack/extras/webdriver.py	21	def test_feature_status_page_filters(self):	CODE

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	internal/commands/ida/scripts/decomp.py	7		CODE

blacktop/ipsw

Open-Source Code Quality, Security and Technical Debt Review