Open-source backend-as-a-service. Postgres, auth, storage, functions, AI gateway, MCP.
This report presents the forensic synthetic code analysis of butterbase-ai/butterbase, a TypeScript project with 3,302 GitHub stars. SynthScan v2.0 examined 304,657 lines of code across 1529 source files, recording 888 pattern matches distributed across 18 syntactic categories. The overall adjusted score of 6.2 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 888 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/cli/bin/butterbase.ts | 1079 | // ─── ai meetings ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 3 | // ─── SDK mock ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 34 | // ─── Fixtures ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 65 | // ─── search-person ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 127 | // ─── search-company ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | packages/cli/src/__tests__/people.test.ts | 174 | // ─── profile ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 244 | // ─── email-lookup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/__tests__/people.test.ts | 286 | // ─── email-status ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/lib/api-client.ts | 592 | // ─── RLS wrappers ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/lib/api-client.ts | 631 | // ─── Billing wrappers ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/lib/api-client.ts | 670 | // ─── Functions invoke + env wrappers ───────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/lib/api-client.ts | 684 | // ─── RAG wrappers ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/rag.ts | 29 | // ─── Collections ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/rag.ts | 129 | // ─── Ingest ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/rag.ts | 207 | // ─── Documents ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/rag.ts | 249 | // ─── Query ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 7 | // ─── Helpers ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 54 | // ─── search-person ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 127 | // ─── search-company ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 201 | // ─── profile ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 277 | // ─── email-lookup ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/people.ts | 310 | // ─── email-status ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/app-billing.ts | 22 | // ─── Plans ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/app-billing.ts | 80 | // ─── Products ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/app-billing.ts | 138 | // ─── Subscriptions ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/app-billing.ts | 193 | // ─── Orders ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/cli/src/commands/ai.ts | 124 | // ─── Meetings ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 39 | // ─── existing tests ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 114 | // ─── set with options ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 132 | // ─── setex ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 143 | // ─── incr / decr ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 172 | // ─── setnx ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 189 | // ─── cas ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 207 | // ─── exists ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 217 | // ─── ttl ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 233 | // ─── expire ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 245 | // ─── mget ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 267 | // ─── mset ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 284 | // ─── new error classes ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/kv.test.ts | 343 | // ─── quota / rate-limit error mapping ──────────────────────────────────── | COMMENT |
| MEDIUM | packages/sdk/src/auth/session-manager.ts | 149 | // ── Internal helpers ───────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 41 | // ── Helpers ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 152 | // ── Test cases ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 156 | // ── Rate limit ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 192 | // ── Credits exhausted ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 216 | // ── Value too large ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 234 | // ── Storage cap ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 255 | // ── Successful write: storage counter updated ──────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 283 | // ── Successful read: storage counter unchanged ────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 308 | // ── Overwrite: delta is net change ────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 338 | // ── Delete: storage counter decrements ────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 363 | // ── Key count: increments on new key ──────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 384 | // ── Key count: decrements on delete ──────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 410 | // ── Key count: unchanged on overwrite ──────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 437 | // ── Key count: batch operations ──────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 474 | // ── Migration sentinel tests ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.test.ts | 545 | // ── Unit tests for pure helpers ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.ts | 199 | // ── (1) Rate limit ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.ts | 210 | // ── (2) Value size cap (writes only) ────────────────────────────────── | COMMENT |
| MEDIUM | services/control-api/src/plugins/kv-quota.ts | 224 | // ── (3) Credits balance ─────────────────────────────────────────────── | COMMENT |
| 336 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/helpers/move-app-flow.ts | 191 | export async function runForwardMoveAppToCompleted(opts: { | CODE |
| LOW | packages/shared/src/regions.ts | 131 | export function butterbaseRegionToFlyRegion( | CODE |
| LOW | packages/cli/src/lib/api-client.ts | 474 | export async function rotateIntegrationCredentials( | CODE |
| LOW | packages/cli/src/lib/api-client.ts | 598 | export async function createUserIsolationPolicy(appId: string, body: { | CODE |
| LOW | packages/cli/src/lib/lockfile-hash.ts | 5 | export function detectPackageManagerAndLockfile(projectDir: string): { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 89 | export async function integrationsConfigCommand(options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 114 | export async function integrationsConfigureCommand( | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 144 | export async function integrationsRotateCommand( | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 168 | export async function integrationsDisableCommand(toolkit: string, options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 181 | export async function integrationsConnectCommand(toolkit: string, options: { app?: string; redirectUrl?: string; userId? | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 199 | export async function integrationsConnectionsCommand(options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 226 | export async function integrationsDisconnectCommand(connectionId: string, options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/integrations.ts | 263 | export async function integrationsExecuteCommand(toolName: string, options: { app?: string; data?: string; userId?: stri | CODE |
| LOW | packages/cli/src/commands/rag.ts | 31 | export async function ragCollectionsListCommand(options: { app?: string; json?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/rag.ts | 58 | export async function ragCollectionsCreateCommand( | CODE |
| LOW | packages/cli/src/commands/rag.ts | 116 | export async function ragCollectionsDeleteCommand(name: string, options: { app?: string }) { | CODE |
| LOW | packages/cli/src/commands/people.ts | 56 | export async function peopleSearchPersonCommand( | CODE |
| LOW | packages/cli/src/commands/people.ts | 129 | export async function peopleSearchCompanyCommand( | CODE |
| LOW | packages/cli/src/commands/apps.ts | 168 | export async function appsUnlinkSubstrateCommand(appId: string) { | CODE |
| LOW | packages/cli/src/commands/apps.ts | 187 | export async function appsSubstrateAutopropagateCommand(appId: string, opts: { users?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/ai.ts | 199 | export async function aiMeetingsEstimateCommand(options: { app?: string; durationMinutes: number; transcript?: boolean; | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 55 | export async function substrateEntitiesListCommand(opts: { type?: string; limit?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 64 | export async function substrateEntitiesGetCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 71 | export async function substrateArtifactsListCommand(opts: { kind?: string; q?: string; limit?: string; json?: boolean }) | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 82 | export async function substrateArtifactsGetCommand(id: string, _opts: { json?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 100 | export async function substrateMemoryListCommand(opts: { | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 124 | export async function substrateOutboxListCommand(opts: { state?: string; json?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 133 | export async function substrateRulesListCommand(opts: { enabled?: boolean; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 149 | export async function substrateRulesFiringsCommand(id: string, opts: { limit?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 158 | export async function substrateSnapshotsCommand(opts: { days?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 167 | export async function substrateSettingsShowCommand(opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 174 | export async function substrateLedgerInspectCommand(actionId: string, _opts: { json?: boolean }) { | CODE |
| LOW | packages/cli/src/commands/substrate.ts | 211 | export async function substrateEntitiesUpdateCommand(id: string, opts: { patch?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 223 | export async function substrateOutboxCancelCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 230 | export async function substrateOutboxRetryCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 237 | export async function substrateRulesCreateCommand(opts: { file?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 246 | export async function substrateRulesUpdateCommand(id: string, opts: { file?: string; json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 255 | export async function substrateRulesDeleteCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 262 | export async function substrateRulesEnableCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 269 | export async function substrateRulesDisableCommand(id: string, opts: { json?: boolean }) { | CODE |
| LOW⚡ | packages/cli/src/commands/substrate.ts | 276 | export async function substrateSettingsYoloCommand(state: string, opts: { json?: boolean }) { | CODE |
| LOW | services/mcp-server/src/create-server.ts | 85 | export async function createButterbaseMcpServer() { | CODE |
| LOW | services/mcp-server/src/request-auth-context.ts | 47 | export function getRequestAuthorizationHeader(): string | undefined { | CODE |
| LOW | services/mcp-server/src/active-window-cache.ts | 22 | export async function fetchAndCacheActiveWindow(): Promise<boolean> { | CODE |
| LOW | services/mcp-server/src/eligibility-listener.ts | 11 | export async function startActiveWindowListener(connectionString: string) { | CODE |
| LOW | services/mcp-server/src/tools/deploy-frontend.ts | 5 | export function registerCreateFrontendDeployment(server: McpServer) { | CODE |
| LOW | services/mcp-server/src/tools/submit-hackathon-entry.ts | 85 | export function registerSubmitHackathonEntry(server: McpServer) { | CODE |
| LOW | services/mcp-server/src/tools/manage-durable-objects.ts | 5 | export function registerManageDurableObjects(server: McpServer) { | CODE |
| LOW | services/control-api/src/config.ts | 352 | export function assertInternalEmailSecret(): void { | CODE |
| LOW | services/control-api/src/routes/hackathons-mcp.ts | 13 | function extractButterbaseSubdomain(value: unknown): string | null { | CODE |
| LOW | services/control-api/src/routes/durable-objects.ts | 98 | export async function registerDurableObjectRoutes(fastify: FastifyInstance) { | CODE |
| LOW | services/control-api/src/routes/edge-ssr-from-source.ts | 37 | export async function registerEdgeSsrFromSourceRoutes(fastify: FastifyInstance) { | CODE |
| LOW | services/control-api/src/routes/frontend-from-source.ts | 33 | export async function registerFrontendFromSourceRoutes(fastify: FastifyInstance) { | CODE |
| LOW | services/control-api/src/routes/notification-actions.ts | 47 | export async function notificationActionsRoutes(app: FastifyInstance) { | CODE |
| LOW | services/control-api/src/routes/ai-images.ts | 378 | export function buildPublicImageJobResponse(absoluteBase: string, appId: string, job: ImageJobRow) { | CODE |
| LOW | …ntrol-api/src/routes/__tests__/admin-apps-orgs.test.ts | 90 | function makeFanOutRuntimeRegionsMock( | CODE |
| LOW | …s/control-api/src/routes/__tests__/resolved-by.test.ts | 21 | async function seedPausedOperatorApproval(toolName: string) { | CODE |
| LOW | services/control-api/src/services/app-pool.ts | 124 | export function getAppPoolByConnectionString(appId: string, connectionString: string): pg.Pool { | CODE |
| LOW | services/control-api/src/services/platform-db.ts | 7 | export function resolveActivePlatformDbUrl(cfg: PlatformDbConfig): string { | CODE |
| LOW | …ces/control-api/src/services/neon-tenant-reconciler.ts | 132 | export async function collectReferencedProjectIds( | CODE |
| 141 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Examples/agents/support-readonly/README.md | 32 | --input '{"message": "Why was I charged twice last month?", "email": "user@example.com"}' \ | CODE |
| LOW | packages/cli/src/__tests__/people.test.ts | 59 | name: 'Acme Corp', | CODE |
| LOW⚡ | packages/cli/src/__tests__/people.test.ts | 160 | expect(output).toContain('Acme Corp'); | CODE |
| LOW⚡ | packages/cli/src/__tests__/people.test.ts | 170 | expect(parsed.data.results[0].name).toBe('Acme Corp'); | CODE |
| LOW | packages/sdk/README.md | 79 | email: 'user@example.com', | CODE |
| LOW | packages/sdk/README.md | 85 | email: 'user@example.com', | CODE |
| LOW | packages/sdk/README.md | 310 | to: 'user@example.com', | CODE |
| LOW | services/mcp-server/src/tools/integrations.ts | 72 | Input: { app_id: "app_abc123", action: "execute_action", tool_name: "GMAIL_SEND_EMAIL", params: { to: "user@example.c | CODE |
| LOW | services/mcp-server/src/tools/invoke-function.ts | 14 | body: { email: "user@example.com", message: "hello" } | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 440 | "client_secret": "placeholder", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 522 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 524 | "display_name": "Jane Doe" | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 545 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 559 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 561 | "display_name": "Jane Doe", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 607 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 624 | "email": "user@example.com" | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 638 | "email": "user@example.com", | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 2908 | email: 'user@example.com', | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 2914 | email: 'user@example.com', | CODE |
| LOW | services/mcp-server/src/docs/user-documentation.ts | 3711 | butterbase integrations execute <tool-name> --data '{"to":"user@example.com","subject":"Hi"}' [--user-id <id>] [--app <a | CODE |
| LOW | services/control-api/src/routes/people.test.ts | 117 | fullName: 'Jane Doe', | CODE |
| LOW | …ces/control-api/src/routes/admin/organizations.test.ts | 33 | return { rows: [{ id: 'admin-uid', email: 'admin@example.com', display_name: null, is_admin: isAdmin }] }; | CODE |
| LOW | …s/control-api/src/routes/admin/special-pricing.test.ts | 20 | return { rows: [{ id: 'admin-uid', email: 'admin@example.com', display_name: null, is_admin: isAdmin }] }; | CODE |
| LOW | …ntrol-api/src/routes/__tests__/admin-apps-orgs.test.ts | 69 | return { rows: [{ id: 'admin-uid', email: 'admin@example.com', display_name: null, is_admin: isAdmin }] }; | CODE |
| LOW | …trol-api/src/routes/__tests__/admin-users-orgs.test.ts | 62 | email: 'user@example.com', | CODE |
| LOW | …trol-api/src/routes/__tests__/admin-users-orgs.test.ts | 135 | email: 'user@example.com', | CODE |
| LOW | …trol-api/src/routes/__tests__/admin-users-orgs.test.ts | 216 | email: 'user@example.com', | CODE |
| LOW | …trol-api/src/routes/__tests__/admin-users-orgs.test.ts | 260 | email: 'user@example.com', | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 69 | organization_name: 'Acme Corp', | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 106 | expect(sub1.organization_name).toBe('Acme Corp'); | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 135 | owner_email: 'user@example.com', | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 277 | email: 'user@example.com', | CODE |
| LOW | …/src/routes/__tests__/admin-billing-plans-orgs.test.ts | 300 | expect(body.recentEvents[0].email).toBe('user@example.com'); | CODE |
| LOW⚡ | …auth/__tests__/email-service-suggestion-status.test.ts | 20 | await sendSuggestionStatusUpdateEmail('user@example.com', { | CODE |
| LOW⚡ | …auth/__tests__/email-service-suggestion-status.test.ts | 28 | expect(command.Destination.ToAddresses).toEqual(['user@example.com']); | CODE |
| LOW⚡ | …auth/__tests__/email-service-suggestion-status.test.ts | 35 | await sendSuggestionStatusUpdateEmail('user@example.com', { | CODE |
| LOW | …auth/__tests__/email-service-suggestion-status.test.ts | 51 | sendSuggestionStatusUpdateEmail('user@example.com', { | CODE |
| LOW | …i/src/services/__tests__/clone-replay-env-vars.test.ts | 151 | JSON.stringify({ BUTTERBASE_API_KEY: 'placeholder' }), | CODE |
| LOW | …/services/__tests__/durable-objects-clone-mint.test.ts | 188 | BUTTERBASE_API_KEY: 'placeholder', | CODE |
| LOW | …/services/__tests__/durable-objects-clone-mint.test.ts | 256 | BUTTERBASE_API_KEY: 'placeholder', | CODE |
| LOW | services/control-api/src/services/people/cache.test.ts | 12 | fullName: 'Jane Doe', | CODE |
| LOW | …ices/docs/src/content/docs/api-reference/people-api.md | 104 | "fullName": "Jane Doe", | CODE |
| LOW | …ices/docs/src/content/docs/api-reference/people-api.md | 230 | "fullName": "Jane Doe", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 70 | "client_secret": "placeholder", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 88 | "email": "user@example.com", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 90 | "display_name": "Jane Doe" | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 106 | "email": "user@example.com", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 108 | "display_name": "Jane Doe", | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 119 | { "email": "user@example.com" } | CODE |
| LOW | …rvices/docs/src/content/docs/api-reference/auth-api.md | 135 | { "email": "user@example.com", "code": "123456" } | CODE |
| LOW | services/docs/src/content/docs/guides/lead-finder.md | 185 | // → { data: { fullName: "Jane Doe", headline: "VP at InwestCo", ... }, | COMMENT |
| LOW | …/docs/src/content/docs/core-concepts/authentication.md | 78 | "email": "user@example.com", | CODE |
| LOW | …/docs/src/content/docs/core-concepts/authentication.md | 80 | "display_name": "Jane Doe" | CODE |
| LOW | …/docs/src/content/docs/core-concepts/authentication.md | 96 | "email": "user@example.com", | CODE |
| LOW | …/docs/src/content/docs/core-concepts/authentication.md | 111 | "email": "user@example.com", | CODE |
| LOW | …/docs/src/content/docs/core-concepts/authentication.md | 113 | "display_name": "Jane Doe", | CODE |
| LOW | …/docs/src/content/docs/core-concepts/authentication.md | 133 | "email": "user@example.com" | CODE |
| LOW | …/docs/src/content/docs/core-concepts/authentication.md | 147 | "email": "user@example.com", | CODE |
| LOW | …/docs/src/content/docs/core-concepts/authentication.md | 165 | const { data, error } = await client.auth.sendMagicLink('user@example.com'); | CODE |
| 14 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/rotate-do-invoker-token.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …es/static-frontend-worker/src/worker.miniflare.test.ts | 1 | // Integration tests for the static frontend worker against a real workerd | COMMENT |
| LOW | …tatic-frontend-worker/src/worker-source.generated.d.ts | 1 | // Type declaration for the generated dist/worker-source.generated.js, written | COMMENT |
| LOW | packages/static-frontend-worker/src/redirects-parser.ts | 1 | // Cloudflare Pages-compatible `_redirects` parser. | COMMENT |
| LOW | packages/static-frontend-worker/src/worker.ts | 1 | // Per-app static frontend worker. | COMMENT |
| LOW | services/storage-indexer/wrangler.toml | 21 | # NEON_RUNTIME_PROJECT_ID_US_EAST_1 — runtime DB URL for us-east-1 | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 11881 | // auth was used. | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 11941 | // Types that can be used through `Stub`s | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 11981 | [K in keyof T]: Unstubify<T[K]>; | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 12001 | // Unwrapping `Stub`s allows calling with `Stubable` arguments. | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 12021 | // You can use `wrangler types` to generate the `Env` type automatically. | COMMENT |
| LOW | services/storage-indexer/worker-configuration.d.ts | 13101 | } | COMMENT |
| LOW | services/mcp-server/src/request-auth-context.ts | 1 | import { AsyncLocalStorage } from 'node:async_hooks'; | COMMENT |
| LOW | services/control-api/src/plugins/cors.ts | 1 | import fp from 'fastify-plugin'; | COMMENT |
| LOW | services/control-api/src/plugins/auth.ts | 181 | scopes: [], | COMMENT |
| LOW | …ontrol-api/src/__tests__/clone-preflight-route.test.ts | 1 | // Unit tests for GET /v1/templates/:source_app_id/clone-preflight | COMMENT |
| LOW | …ices/control-api/src/__tests__/edge-ssr-routes.test.ts | 461 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | …rvices/control-api/src/__tests__/agent-test-helpers.ts | 1 | // Shared test fixtures for the agent route tests. | COMMENT |
| LOW | …pi/src/__tests__/app-state-capture.integration.test.ts | 41 | // Regression coverage for the schema drift that let captureAppState ship | COMMENT |
| LOW | …rvices/control-api/src/__tests__/clone-lineage.test.ts | 41 | }); | COMMENT |
| LOW | services/control-api/src/routes/people-webhook.ts | 1 | // services/control-api/src/routes/people-webhook.ts | COMMENT |
| LOW | services/control-api/src/routes/init.ts | 141 | COMMENT | |
| LOW | services/control-api/src/routes/people.e2e.test.ts | 1 | // services/control-api/src/routes/people.e2e.test.ts | COMMENT |
| LOW | services/control-api/src/routes/auto-api.ts | 481 | callerType = 'service_key'; | COMMENT |
| LOW | services/control-api/src/routes/auto-api.ts | 521 | } | COMMENT |
| LOW | services/control-api/src/routes/templates-discovery.ts | 1 | // Anonymous-readable template discovery — fans out across all runtime regions | COMMENT |
| LOW | services/control-api/src/routes/templates-discovery.ts | 121 | [unique], | COMMENT |
| LOW | services/control-api/src/routes/templates-discovery.ts | 241 | COMMENT | |
| LOW | services/control-api/src/routes/people.ts | 541 | status: row.status, | COMMENT |
| LOW | services/control-api/src/routes/dashboard-agent.ts | 401 | resolvedBy: input.userId, | COMMENT |
| LOW | services/control-api/src/routes/dashboard-agent.ts | 1181 | // route with operator-traces.ts and the dashboard's `features/operator-traces` | COMMENT |
| LOW | services/control-api/src/routes/admin/organizations.ts | 1 | // GET /admin/organizations — list endpoint. | COMMENT |
| LOW | services/control-api/src/routes/admin/organizations.ts | 481 | // 2. If Stripe is in play (live sub + new price_id): retrieve, sanity- | COMMENT |
| LOW | …i/src/routes/__tests__/operator-approval-wedge.test.ts | 281 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | services/control-api/src/services/spa-routing-probe.ts | 1 | // Post-deploy SPA routing probe. | COMMENT |
| LOW | services/control-api/src/services/app-resolver.ts | 101 | const row = result.rows[0]; | COMMENT |
| LOW | services/control-api/src/services/digest-notifier.ts | 1 | // Weekly digest scanner. | COMMENT |
| LOW | services/control-api/src/services/neon-client.ts | 301 | // Neon but failed downstream (grantSchemaPrivileges, migrations, etc.), | COMMENT |
| LOW | services/control-api/src/services/clone-replay.ts | 401 | try { | COMMENT |
| LOW | services/control-api/src/services/clone-replay.ts | 621 | // apps.allowed_origins text[] — copy verbatim (CORS whitelist) | COMMENT |
| LOW | services/control-api/src/services/lease-service.test.ts | 561 | // nulled out every row in the same migration that the deploy-order rule | COMMENT |
| LOW | services/control-api/src/services/clone-jobs-reaper.ts | 1 | // services/control-api/src/services/clone-jobs-reaper.ts | COMMENT |
| LOW | …ontrol-api/src/services/edge-ssr-deployment.service.ts | 1 | // services/control-api/src/services/edge-ssr-deployment.service.ts | COMMENT |
| LOW | …es/control-api/src/services/durable-objects.service.ts | 1 | // services/control-api/src/services/durable-objects.service.ts | COMMENT |
| LOW | services/control-api/src/services/failure-notifier.ts | 1 | // services/control-api/src/services/failure-notifier.ts | COMMENT |
| LOW | services/control-api/src/services/failure-notifier.ts | 41 | ): Promise<void> { | COMMENT |
| LOW | services/control-api/src/services/app-state-capture.ts | 121 | introspectRls(appPool), | COMMENT |
| LOW | services/control-api/src/services/app-state-capture.ts | 141 | // consumers (release publish/clone-replay) expect, so this query folds | COMMENT |
| LOW | services/control-api/src/services/neon-task-worker.ts | 861 | { err: mintErr, destAppId: resolvedDestAppId }, | COMMENT |
| LOW | services/control-api/src/services/neon-task-worker.ts | 1041 | logger.info( | COMMENT |
| LOW | services/control-api/src/services/neon-task-worker.ts | 1121 | // A7: Ensure dest.db_provisioned=true. provisionAppBackground already sets this | COMMENT |
| LOW | services/control-api/src/services/app-db-provision.ts | 101 | // Idempotency: a retried neon_task must adopt the project a crashed | COMMENT |
| LOW | …rvices/control-api/src/services/auto-refill-service.ts | 81 | const monthly = parseFloat(u.monthly_allowance_usd); | COMMENT |
| LOW | services/control-api/src/services/auth/email-layout.ts | 1 | // Minimal HTML email layout helpers. | COMMENT |
| LOW | …ontrol-api/src/services/dashboard-agent/tool-bridge.ts | 121 | */ | COMMENT |
| LOW | …vices/control-api/src/services/dashboard-agent/loop.ts | 641 | COMMENT | |
| LOW | …vices/control-api/src/services/dashboard-agent/loop.ts | 781 | // | COMMENT |
| LOW | …vices/control-api/src/services/dashboard-agent/loop.ts | 1281 | toolCallId: tc.id, | COMMENT |
| LOW | …vices/control-api/src/services/dashboard-agent/loop.ts | 1301 | // all five sit at the 'approval' tier in OPERATOR_TOOL_TIERS — the same | COMMENT |
| LOW | …ces/control-api/src/services/dashboard-agent/resume.ts | 161 | } | COMMENT |
| 12 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 5 | ## Step 1: Initialize app | COMMENT |
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 20 | ## Step 2: Apply schema | COMMENT |
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 85 | ## Step 3: Row-level security | COMMENT |
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 97 | ## Step 4: CORS | COMMENT |
| LOW | Examples/grocery-list-2026-04-03/BUTTERBASE_SETUP.md | 108 | ## Step 5: Recipe assistant (serverless function) | COMMENT |
| LOW | Examples/todo-2026-04-02/BUTTERBASE_SETUP.md | 5 | ## Step 1: Initialize App | COMMENT |
| LOW | Examples/todo-2026-04-02/BUTTERBASE_SETUP.md | 15 | ## Step 2: Apply Schema | COMMENT |
| LOW | Examples/todo-2026-04-02/BUTTERBASE_SETUP.md | 77 | ## Step 3: Enable RLS | COMMENT |
| LOW | Examples/todo-2026-04-02/BUTTERBASE_SETUP.md | 94 | ## Step 4: Configure CORS | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 98 | // Step 1: Create deployment (get upload URL) | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 101 | // Step 2: Zip the directory | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 105 | // Step 3: Upload zip to presigned URL | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 109 | // Step 4: Start the deployment pipeline | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 113 | // Step 5: Poll until terminal state (5 s × 60 = 5 min max) | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 81 | // Step 1: Create deployment | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 84 | // Step 2: Zip directory | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 88 | // Step 3: Upload | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 92 | // Step 4: Start deployment | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 96 | // Step 5: Poll until done | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 105 | // Step 1: Upload file to storage to get an object ID | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 123 | // Step 2: Upload the file to the presigned URL | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 134 | // Step 3: Ingest using the storage object ID | COMMENT |
| LOW⚡ | services/control-api/src/plugins/auth.ts | 346 | // Step 1: Create a candidate personal org (may be discarded on conflict). | COMMENT |
| LOW⚡ | services/control-api/src/plugins/auth.ts | 355 | // Step 2: Upsert platform_users. | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 807 | // Step 1: Embed the query | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 818 | // Step 2: Similarity search with RLS | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 851 | // Step 3: Optional synthesis | COMMENT |
| LOW⚡ | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 338 | // Step 1: USER_A creates conversation | COMMENT |
| LOW⚡ | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 348 | // Step 2: USER_A posts one message (mock a simple no-tool-call pass) | COMMENT |
| LOW | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 391 | // Step 4: USER_A can still access their conversation (DELETE was a no-op) | COMMENT |
| LOW | services/control-api/src/services/neon-task-worker.ts | 1100 | // Step 7: replay the source's most recent published frontend by copying | COMMENT |
| LOW⚡ | services/control-api/src/services/app-plan-resolver.ts | 33 | // Step 1: get owner_id from runtime DB (apps is a runtime-tier table) | COMMENT |
| LOW⚡ | services/control-api/src/services/app-plan-resolver.ts | 40 | // Step 2: get plan_id from the owner's personal org (Plan 07 moved | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 189 | // Step 1: Download and parse the document | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 208 | // Step 2: Chunk the text | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 224 | // Step 3: Batch embed chunks | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 246 | // Step 4: Insert chunks into app database | COMMENT |
| LOW | services/docs/src/content/docs/guides/monetization.md | 20 | ### Step 1: Onboard your Connect account | COMMENT |
| LOW | services/docs/src/content/docs/guides/monetization.md | 28 | ### Step 2: Check onboarding status | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 98 | // Step 1: Create deployment (get upload URL) | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 101 | // Step 2: Zip the directory | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 105 | // Step 3: Upload zip to presigned URL | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 109 | // Step 4: Start the deployment pipeline | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy-edge-ssr.ts | 113 | // Step 5: Poll until terminal state (5 s × 60 = 5 min max) | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 81 | // Step 1: Create deployment | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 84 | // Step 2: Zip directory | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 88 | // Step 3: Upload | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 92 | // Step 4: Start deployment | COMMENT |
| LOW⚡ | packages/cli/src/commands/deploy.ts | 96 | // Step 5: Poll until done | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 105 | // Step 1: Upload file to storage to get an object ID | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 123 | // Step 2: Upload the file to the presigned URL | COMMENT |
| LOW | packages/sdk/src/rag/rag-client.ts | 134 | // Step 3: Ingest using the storage object ID | COMMENT |
| LOW⚡ | services/control-api/src/plugins/auth.ts | 346 | // Step 1: Create a candidate personal org (may be discarded on conflict). | COMMENT |
| LOW⚡ | services/control-api/src/plugins/auth.ts | 355 | // Step 2: Upsert platform_users. | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 807 | // Step 1: Embed the query | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 818 | // Step 2: Similarity search with RLS | COMMENT |
| LOW | services/control-api/src/routes/rag.ts | 851 | // Step 3: Optional synthesis | COMMENT |
| LOW⚡ | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 338 | // Step 1: USER_A creates conversation | COMMENT |
| LOW⚡ | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 348 | // Step 2: USER_A posts one message (mock a simple no-tool-call pass) | COMMENT |
| LOW | …l-api/src/routes/__tests__/dashboard-agent.e2e.test.ts | 391 | // Step 4: USER_A can still access their conversation (DELETE was a no-op) | COMMENT |
| LOW | services/control-api/src/services/neon-task-worker.ts | 1100 | // Step 7: replay the source's most recent published frontend by copying | COMMENT |
| LOW⚡ | services/control-api/src/services/app-plan-resolver.ts | 33 | // Step 1: get owner_id from runtime DB (apps is a runtime-tier table) | COMMENT |
| LOW⚡ | services/control-api/src/services/app-plan-resolver.ts | 40 | // Step 2: get plan_id from the owner's personal org (Plan 07 moved | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 189 | // Step 1: Download and parse the document | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 208 | // Step 2: Chunk the text | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 224 | // Step 3: Batch embed chunks | COMMENT |
| LOW | services/control-api/src/services/rag-worker.ts | 246 | // Step 4: Insert chunks into app database | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | services/agent-runtime/tests/test_runner.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/test_e2e_smoke.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_workflow.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_run.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_tools.py | 0 | insert into agent_runs (app_id, agent_id, caller_kind, input, status) values ($1, $2, 'function', $3::jsonb, 'queued') r | STRING |
| HIGH | services/agent-runtime/tests/test_e2e_smoke.py | 0 | insert into platform_users (id, email) values (gen_random_uuid(), $1) on conflict (email) do update set email = excluded | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_workflow.py | 0 | insert into platform_users (id, email) values (gen_random_uuid(), $1) on conflict (email) do update set email = excluded | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_run.py | 0 | insert into platform_users (id, email) values (gen_random_uuid(), $1) on conflict (email) do update set email = excluded | STRING |
| HIGH | services/agent-runtime/tests/live/e2e_tools.py | 0 | insert into platform_users (id, email) values (gen_random_uuid(), $1) on conflict (email) do update set email = excluded | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ontrol-api/src/services/move-app/saga-executor.test.ts | 59 | const calls: string[] = ctx._client.query.mock.calls.map((c: any[]) => | CODE |
| CRITICAL | …ontrol-api/src/services/move-app/saga-executor.test.ts | 62 | const updateCall = ctx._client.query.mock.calls.find( | CODE |
| CRITICAL | …ontrol-api/src/services/move-app/saga-executor.test.ts | 84 | const updateCall = ctx._client.query.mock.calls.find( | CODE |
| CRITICAL | …ontrol-api/src/services/move-app/saga-executor.test.ts | 105 | const errorUpdateCall = ctx._client.query.mock.calls.find( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 66 | - **Claude Code plugin** — `packages/plugin` (submodule of [butterbase-skills](https://github.com/butterbase-ai/butterba | CODE |
| MEDIUM | services/mcp-server/src/docs/user-documentation.ts | 2269 | ### Webhooks (event-driven flow) | COMMENT |
| MEDIUM | services/mcp-server/src/docs/user-documentation.ts | 3365 | rag: `## RAG (Retrieval-Augmented Generation) | CODE |
| MEDIUM | …c/routes/__tests__/dashboard-agent-builder.e2e.test.ts | 179 | // Return empty repo — triggers template scaffold path | COMMENT |
| MEDIUM | …vices/control-api/src/services/dashboard-agent/loop.ts | 893 | // Capture baseline BEFORE scaffold so every template file counts as | COMMENT |
| MEDIUM | …ol-api/src/services/dashboard-agent/build-hydration.ts | 157 | // empty" would send the build down a path that compiles a scaffold in | COMMENT |
| MEDIUM | …c/services/dashboard-agent/__tests__/repo-http.test.ts | 177 | // on a false here, and MUST NOT see a throw, or it would skip the scaffold. | COMMENT |
| MEDIUM | …c/services/dashboard-agent/__tests__/repo-http.test.ts | 191 | // scaffold behaviour is identical whichever implementation is in play. | COMMENT |
| MEDIUM | …c/services/dashboard-agent/__tests__/repo-http.test.ts | 204 | // the turn down the scaffold path and then try to PUSH a template into | COMMENT |
| MEDIUM | …vices/docs/src/content/docs/api-reference/mcp-tools.md | 137 | ## RAG (Retrieval-Augmented Generation) | COMMENT |
| MEDIUM | …ices/docs/src/content/docs/templates/butter-support.md | 25 | ### Docs ingestion and RAG | COMMENT |
| MEDIUM | …ices/docs/src/content/docs/templates/butter-support.md | 157 | ### 3. Create the RAG collection and ingest your docs | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | services/agent-runtime/tests/test_hitl.py | 7 | CODE | |
| LOW | services/agent-runtime/tests/test_safe_request.py | 2 | CODE | |
| LOW | services/agent-runtime/tests/test_recovery.py | 4 | CODE | |
| LOW | services/agent-runtime/tests/test_recovery.py | 4 | CODE | |
| LOW | services/agent-runtime/tests/test_recovery.py | 4 | CODE | |
| LOW | services/agent-runtime/tests/test_heartbeat.py | 3 | CODE | |
| LOW | services/agent-runtime/tests/test_webhooks.py | 3 | CODE | |
| LOW | services/agent-runtime/tests/test_runner.py | 9 | CODE | |
| LOW | services/agent-runtime/tests/test_tools_base.py | 2 | CODE | |
| LOW | services/agent-runtime/tests/test_routes_lifecycle.py | 12 | CODE | |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 8 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE | |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 3 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | services/mcp-server/src/docs/user-documentation.ts | 1562 | ### Creating the zip file correctly (Windows and AI assistants) | COMMENT |
| MEDIUM | services/mcp-server/src/docs/user-documentation.ts | 3052 | # Create a new app | COMMENT |
| MEDIUM | services/control-api/src/routes/llms-txt.ts | 20 | ### Creating a Todo App Backend | COMMENT |
| MEDIUM | services/agent-runtime/tests/test_hitl.py | 86 | # Create a registry with the interrupt tool | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | services/agent-runtime/src/agent_runtime/runner.py | 299 | except Exception as exc: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 78 | except Exception as e: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 154 | except Exception as e: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/cancel.py | 43 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/events.py | 45 | except Exception: | CODE |
| LOW | …rvices/agent-runtime/src/agent_runtime/safe_request.py | 41 | except Exception as exc: | CODE |
| LOW | …rvices/agent-runtime/src/agent_runtime/redis_client.py | 17 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/heartbeat.py | 41 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/webhooks.py | 54 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/webhooks.py | 62 | except Exception: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/webhooks.py | 92 | except Exception as exc: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/routes/runs.py | 79 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | services/agent-runtime/tests/test_runner_lifecycle.py | 158 | async def _set_graph_spec(pg_pool, run_id: str, graph_spec: dict) -> None: | CODE |
| LOW⚡ | services/agent-runtime/tests/test_runner_lifecycle.py | 171 | async def _set_run_input(pg_pool, run_id: str, input_data: dict) -> None: | CODE |
| LOW | services/agent-runtime/src/agent_runtime/cancel.py | 5 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/agent-runtime/src/agent_runtime/events.py | 8 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/agent-runtime/src/agent_runtime/app.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | services/agent-runtime/src/agent_runtime/webhooks.py | 11 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ices/agent-runtime/src/agent_runtime/tools/__init__.py | 16 | __all__ = [ | CODE |
| LOW | services/agent-runtime/src/agent_runtime/routes/runs.py | 21 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | services/agent-runtime/tests/live/fake_openrouter.py | 21 | CODE | |
| LOW | services/agent-runtime/src/agent_runtime/runner.py | 90 | CODE | |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 28 | CODE | |
| LOW | services/agent-runtime/src/agent_runtime/compiler.py | 174 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | services/control-api/src/services/neon-task-worker.ts | 1124 | // robust to any future refactor that might decouple those two writes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .gitleaks.toml | 17 | '''YOUR_API_KEY''', | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/rotate-do-invoker-token.sh | 14 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | dispatch-worker/index.js | 97 | export async function handleRequest(request, env, ctx) { | CODE |