The best way of working with Protocol Buffers.
This report summarizes scanner evidence for bufbuild/buf, a Go project with 11,478 GitHub stars. SynthScan examined 210,818 lines of code across 1485 source files, recording 1319 pattern matches distributed across 6 syntactic categories. The legacy adjusted pattern signal is 7.0 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1256 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 63 finding(s).
Which changes need focused human review? 1319 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1319 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .godoclint.yaml | 1 | # Configuration file version. | COMMENT |
| LOW | .godoclint.yaml | 21 | # files that their relative path (with respect to the config file path) does not | COMMENT |
| LOW | .godoclint.yaml | 41 | # List of rules to enable *in addition to* the default set. | COMMENT |
| LOW | .godoclint.yaml | 61 | - require-doc | COMMENT |
| LOW | packaging/python/buf_bin/__init__.py | 1 | # Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | packaging/python/scripts/generate_wheels.py | 1 | # Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/protoc-gen-buf-breaking/breaking.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/buf.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/buf_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/workspace_unix_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/workspace_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/workspace_windows_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/workspace_subdir_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/buf_unix_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/imports_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/breaking/breaking_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/breaking/breaking.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/beta/internal/internal.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …d/buf/internal/command/beta/bufpluginv2/bufpluginv2.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/beta/price/price.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …mmand/beta/registry/webhook/webhooklist/webhooklist.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …d/beta/registry/webhook/webhookdelete/webhookdelete.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …d/beta/registry/webhook/webhookcreate/webhookcreate.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …/command/beta/registry/plugin/pluginpush/pluginpush.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …mand/beta/registry/plugin/plugindelete/plugindelete.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …d/buf/internal/command/beta/bufpluginv1/bufpluginv1.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …rnal/command/beta/bufpluginv1beta1/bufpluginv1beta1.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …d/buf/internal/command/beta/studioagent/studioagent.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/lint/lint.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/lsfiles/lsfiles.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …/command/config/configlslintrules/configlslintrules.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …d/buf/internal/command/config/configinit/configinit.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …internal/command/config/configmigrate/configmigrate.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …nal/command/config/configmigrate/configmigrate_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/config/internal/internal.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …rnal/command/config/configlsmodules/configlsmodules.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …/config/configlsbreakingrules/configlsbreakingrules.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …/sourceedit/sourceeditdeprecate/sourceeditdeprecate.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …buf/internal/command/plugin/pluginprune/pluginprune.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …d/buf/internal/command/plugin/pluginpush/pluginpush.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | …f/internal/command/plugin/pluginupdate/pluginupdate.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/lsp/lspserve/lspserve.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/lsp/lspserve/debug.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/push/push.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/curl/curl.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/curl/curl.go | 1421 | } | COMMENT |
| LOW | cmd/buf/internal/command/curl/curl_completion_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/curl/curl_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/dep/depprune/depprune.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/dep/internal/internal.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/dep/depgraph/depgraph.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/dep/depgraph/depgraph_test.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/dep/depupdate/depupdate.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/generate/generate.go | 1 | // Copyright 2020-2026 Buf Technologies, Inc. | COMMENT |
| LOW | cmd/buf/internal/command/generate/generate.go | 81 | # Use the plugin hosted at buf.build/protocolbuffers/go at version v1.28.1. | COMMENT |
| LOW | cmd/buf/internal/command/generate/generate.go | 121 | # The generation strategy to use. There are two options: | COMMENT |
| LOW | cmd/buf/internal/command/generate/generate.go | 141 | # | COMMENT |
| LOW | cmd/buf/internal/command/generate/generate.go | 161 | # Each override rule specifies an option, the value for this option and | COMMENT |
| LOW | cmd/buf/internal/command/generate/generate.go | 181 | # - php_metadata_namespace_suffix | COMMENT |
| LOW | cmd/buf/internal/command/generate/generate.go | 241 | inputs: | COMMENT |
| 1191 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | private/buf/buflsp/buf_policy_yaml_lsp_test.go | 293 | // ── Top-level keys ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_lsp_test.go | 320 | // ── lint sub-keys ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_lsp_test.go | 352 | // ── breaking sub-keys ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_lsp_test.go | 369 | // ── Rule names as values in use/except ────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_lsp_test.go | 396 | // ── plugin entry keys ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_lsp_test.go | 408 | // ── Positions that should return no hover ──────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_completion_test.go | 38 | // ── Top-level key completions ────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_completion_test.go | 54 | // ── lint key completions ─────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_completion_test.go | 65 | // ── breaking key completions ─────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_completion_test.go | 76 | // ── plugins item key completions ─────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_completion_test.go | 85 | // ── Value completions ────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_completion_test.go | 101 | // ── Sequence value completions (lint.use / lint.except) ──────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_policy_yaml_completion_test.go | 126 | // ── Sequence after existing items ───────────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_policy_yaml_completion_test.go | 135 | // ── Blank lines between parent and child ────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_policy_yaml_completion_test.go | 144 | // ── Partial key in breaking block ───────────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_policy_yaml_completion_test.go | 153 | // ── Plugin item continuation ─────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_policy_yaml_completion_test.go | 163 | // ── Bare-parent-key heuristic ───────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_policy_yaml_completion_test.go | 181 | // ── No completions ───────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_completion_test.go | 110 | // ── module-level lint keys ───────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_completion_test.go | 119 | // ── plugins item key completions ─────────────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_completion_test.go | 128 | // ── policies item key completions ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_completion_test.go | 137 | // ── Value completions ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_completion_test.go | 263 | // ── Sibling key (except alongside use) ──────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_completion_test.go | 272 | // ── Blank lines between parent and child ────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_completion_test.go | 281 | // ── Partial key in lint block ────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_completion_test.go | 290 | // ── Second module item keys ──────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 40 | // ── Top-level key completions ────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 64 | // ── lint key completions ─────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 80 | // ── breaking key completions ─────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 89 | // ── modules item key completions ─────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 160 | // ── Sequence value completions (lint.use / lint.except) ──────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 199 | // ── ignore_only key completions ──────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 231 | // ── Sequence after existing items ───────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 247 | // ── Module-level lint and breaking sequence values ───────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 316 | // ── Bare-parent-key heuristic ───────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 357 | // ── Existing-key filtering ──────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 384 | // ── No completions ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_completion_test.go | 412 | // ── CRLF line endings ───────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_lsp_test.go | 349 | // ── Top-level keys ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_lsp_test.go | 376 | // ── managed sub-keys ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_lsp_test.go | 393 | // ── managed.disable rule keys ─────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_lsp_test.go | 405 | // ── managed.override rule keys ────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_lsp_test.go | 417 | // ── plugin entry keys ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_lsp_test.go | 474 | // ── input entry keys ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_lsp_test.go | 536 | // ── Positions that should return no hover ──────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_completion_test.go | 49 | // ── Top-level key completions ─────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_completion_test.go | 73 | // ── Plugin key completions ────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_completion_test.go | 125 | // ── Input key completions ──────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_completion_test.go | 193 | // ── Managed key completions ───────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_completion_test.go | 235 | // ── Value completions ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_completion_test.go | 286 | // ── Bare-parent-key heuristic ───────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_gen_yaml_completion_test.go | 305 | // ── No completions ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_lsp_test.go | 603 | // ── Top-level keys ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_lsp_test.go | 630 | // ── Module entry sub-keys ──────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_lsp_test.go | 652 | // ── lint sub-keys ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_lsp_test.go | 709 | // ── breaking sub-keys ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | private/buf/buflsp/buf_yaml_lsp_test.go | 741 | // ── Rule/category names as values in lint.use ───────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_lsp_test.go | 758 | // ── Rule/category names as values in lint.except ────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_lsp_test.go | 765 | // ── Rule names as keys in lint.ignore_only ──────────────────────────── | COMMENT |
| MEDIUM⚡ | private/buf/buflsp/buf_yaml_lsp_test.go | 772 | // ── Rule/category names as values in breaking.use ───────────────────── | COMMENT |
| 3 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cmd/buf/internal/command/dep/depgraph/depgraph.go | 189 | // We first scaffold a module with no deps populated yet. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | make/go/scripts/checknolintlint.bash | 15 | # Check if nolintlint linter is enabled in config | COMMENT |
| LOW | make/go/scripts/checknolintlint.bash | 35 | # Check if nolintlint is configured according to standards. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | private/bufpkg/bufimage/util.go | 82 | // potentialDirPaths are paths that we need to check if they are directories | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …bufpkg/bufimage/bufimagefuzz/bufimagefuzz_unix_test.go | 43 | // To focus on just one test in the corpus, put its file name here. Don't forget to revert before committing. | COMMENT |