AI Slop Code Risk Monitor

buger/jsonparser

SlopCodeMonitor badge for buger/jsonparser Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

THE fastest alternative JSON parser for Go that does not require schema

2.3 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for buger/jsonparser, a Go project with 5,662 GitHub stars. SynthScan examined 55,138 lines of code across 265 source files, recording 114 pattern matches distributed across 4 syntactic categories. The legacy adjusted pattern signal is 2.3 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

2.3
Adjusted Signal
2.3
Raw Pattern Score
100%
Time Factor
2026-10-05
Last Push
5.7K
Stars
Go
Language
55.1K
Lines of Code
265
Files
114
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 114 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 10.2/100 · LOW

Which changes need focused human review? 114 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 2LOW 112

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 114 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block104 hits · 104 pts
SeverityFileLineSnippetContext
LOWobligation_evidence_test.go1package jsonparserCOMMENT
LOWjson_fuzz_test.go1// Structure-aware JSON fuzzer for the jsonparser public surface.COMMENT
LOWjson_fuzz_test.go21// 3. ROUND-TRIP — Get(out, path) returns the set value.COMMENT
LOWjson_fuzz_test.go501 *buf = append(*buf, '\\', 'u',COMMENT
LOWjson_fuzz_test.go1061 return falseCOMMENT
LOWjson_fuzz_test.go1361 // valid and the path shape matches the container type at everyCOMMENT
LOWjson_fuzz_test.go1501//COMMENT
LOWjson_fuzz_test.go1521 // When the fuzz engine mutates data into non-JSON garbage (or ~30%COMMENT
LOWjson_fuzz_test.go1561 if r.Intn(5) == 0 { // 20% chanceCOMMENT
LOWoptimization_bench_test.go1package jsonparserCOMMENT
LOWescape.go21// untranslated, so no lemma is attached here.COMMENT
LOWescape.go41// r := h2I(c)COMMENT
LOWescape.go101//COMMENT
LOWescape.go121COMMENT
LOWescape.go141 // Lone high surrogate (0xD800-0xDBFF): the high-surrogate escape is notCOMMENT
LOWescape.go261COMMENT
LOWoptimization_equiv_test.go1package jsonparserCOMMENT
LOWmcdc_spec_witnesses_test.go1package jsonparserCOMMENT
LOWmcdc_spec_witnesses_test.go21// - Invariant-violation rows (formula evaluates FALSE in the table) areCOMMENT
LOWparser_test.go1381 returnCOMMENT
LOWparser_test.go1401// MCDC SYS-REQ-021: N/ACOMMENT
LOWparser_test.go1861 {COMMENT
LOWparser_test.go2361// MCDC SYS-REQ-040: raw_int_token_is_well_formed=F, raw_int_token_overflows_int64=F, returns_parseint_malformed_error=TCOMMENT
LOWmcdc_supplement_test.go421 })COMMENT
LOWmcdc_supplement_test.go661}COMMENT
LOWmcdc_supplement_test.go761 count++COMMENT
LOWencoding_json_fuzz_test.go1// Differential fuzzer targeting Go's official encoding/json package.COMMENT
LOWencoding_json_fuzz_test.go21// encoding/json. encoding/json is treated as the reference oracle. AnyCOMMENT
LOWencoding_json_fuzz_test.go161COMMENT
LOWencoding_json_fuzz_test.go221// sides, so DeepEqual still holds. This is the spec-literal gate.COMMENT
LOWencoding_json_fuzz_test.go321 // error are both acceptable. Only a panic is a failure.COMMENT
LOWencoding_json_fuzz_test.go381 }COMMENT
LOWencoding_json_fuzz_test.go421 })COMMENT
LOWencoding_json_fuzz_test.go541//COMMENT
LOWencoding_json_fuzz_test.go641// FuzzEncodingJSON is the structure-aware differential fuzzer forCOMMENT
LOWmcdc_code_supplement_test.go1package jsonparserCOMMENT
LOWcoverage_closure_test.go1package jsonparserCOMMENT
LOWcoverage_closure_test.go101// already covered by TestDelete. Rows 1 and 3 need explicit witnesses.COMMENT
LOWpath_fuzz_test.go1// Path-mutating fuzzer for the jsonparser public surface.COMMENT
LOWpath_fuzz_test.go21// (1) No-panic invariant. The fuzz body uses the recover-and-recordCOMMENT
LOWpath_fuzz_test.go101 "stack": string(stack),COMMENT
LOWpath_fuzz_test.go241 }COMMENT
LOWpath_fuzz_test.go381//COMMENT
LOWpath_fuzz_test.go401// mismatches (e.g. path "a.[0].[1]" where `a.[0]` resolves to an OBJECTCOMMENT
LOWpath_fuzz_test.go461 }COMMENT
LOWpath_fuzz_test.go601 case 1:COMMENT
LOWreference_oracle_test.go1// Reference-oracle property tests for the jsonparser public surface.COMMENT
LOWreference_oracle_test.go21// All generators are independent of the parser under test (they build JSONCOMMENT
LOWreference_oracle_test.go41// the RAW bytes from the input. The Get test compares canonicalizedCOMMENT
LOWreference_oracle_test.go61// D7. KNOWN BUG — Set with nested out-of-range array index silentlyCOMMENT
LOWreference_oracle_test.go81// when (a) the path's full lookup misses, (b) a subpath resolves toCOMMENT
LOWreference_oracle_test.go601 if knownBugPaths+knownBugPanics > 0 {COMMENT
LOWproperty_test.go1// Property-based tests for the jsonparser core surface.COMMENT
LOWparser.go21 OverflowIntegerError = errors.New("Value is number, but overflowed while parsing")COMMENT
LOWparser.go41// return tokenEnd(data) >= 0COMMENT
LOWparser.go181//COMMENT
LOWparser.go221// }COMMENT
LOWparser.go261//COMMENT
LOWparser.go301func stringEndConfig(_ Config, data []byte, quote byte) (int, bool) {COMMENT
LOWsys_req_110_111_witness_test.go1package jsonparserCOMMENT
44 more matches not shown…
Verbosity Indicators4 hits · 8 pts
SeverityFileLineSnippetContext
LOWparser.go1944 // Step 1: find the next keyCOMMENT
LOW⚡parser.go1982 // Step 2: skip the colonCOMMENT
LOW⚡parser.go1991 // Step 3: find the associated value, then invoke the callbackCOMMENT
LOW⚡parser.go2000 // Step 4: skip over the next comma to the following token, or stop if we hit the ending braceCOMMENT
Structural Annotation Overuse4 hits · 8 pts
SeverityFileLineSnippetContext
LOWparser.go1944 // Step 1: find the next keyCOMMENT
LOW⚡parser.go1982 // Step 2: skip the colonCOMMENT
LOW⚡parser.go1991 // Step 3: find the associated value, then invoke the callbackCOMMENT
LOW⚡parser.go2000 // Step 4: skip over the next comma to the following token, or stop if we hit the ending braceCOMMENT
AI Slop Vocabulary2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMjson_fuzz_test.go1627// Generous (5s) so the gate is robust on slow CI; tight enough that an O(n²)COMMENT
MEDIUMproof.yaml48 # oracle, fuzz-harness coverage) so `proof audit` stays fast on everyCOMMENT