A blazingly fast JSON serializing & deserializing library
This report summarizes scanner evidence for bytedance/sonic, a Go project with 9,645 GitHub stars. SynthScan examined 219,433 lines of code across 630 source files, recording 138 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 0.8 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 127 finding(s).
Are imports declared and package/API names verified? 5 finding(s).
Are wrappers, guards, and repeated structures necessary? 6 finding(s).
Which changes need focused human review? 138 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 138 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | api.go | 121 | COMMENT | |
| LOW | api.go | 201 | } | COMMENT |
| LOW | native/scanning.h | 1681 | return sp == end && kp == ke; | COMMENT |
| LOW | native/f32toa.c | 21 | * KIND, either express or implied. | COMMENT |
| LOW | native/f32toa.c | 441 | COMMENT | |
| LOW | native/f64toa.c | 21 | * KIND, either express or implied. | COMMENT |
| LOW | native/f64toa.c | 401 | #undef F64_EXP_MASK | COMMENT |
| LOW | native/native.h | 21 | #define SIMDE_ENABLE_NATIVE_ALIASES | COMMENT |
| LOW | native/native.h | 41 | #include <sys/types.h> | COMMENT |
| LOW | native/types.h | 1 | COMMENT | |
| LOW | native/types.h | 21 | COMMENT | |
| LOW | native/types.h | 41 | #define ERR_NOT_FOUND 33 | COMMENT |
| LOW | native/utf8.h | 261 | const uint8_t SURROGATE = 1<<4; // 11101101 101_____ | COMMENT |
| LOW | native/test/xprintf.h | 21 | COMMENT | |
| LOW | native/test/xassert.h | 21 | static always_inline void xpanic() {} | COMMENT |
| LOW | encoder/encoder_compat.go | 61 | COMMENT | |
| LOW | encoder/encoder_native.go | 81 | // Encode returns the JSON encoding of val, encoded with opts. | COMMENT |
| LOW | encoder/encoder_native.go | 101 | // order to reduce the first-hit latency. | COMMENT |
| LOW | internal/native/dispatch_arm64.go | 61 | COMMENT | |
| LOW | internal/native/dispatch_arm64.go | 81 | COMMENT | |
| LOW | internal/native/dispatch_arm64.go | 101 | COMMENT | |
| LOW | internal/native/avx2/get_by_path_text_amd64.go | 6101 | // // .set L0_2_set_726, LBB0_726-LJTI0_2 | COMMENT |
| LOW | internal/native/avx2/value_text_amd64.go | 3561 | // // .set L0_0_set_118, LBB0_118-LJTI0_0 | COMMENT |
| LOW | internal/native/sse/get_by_path_text_amd64.go | 6061 | 0x0d, 0xb7, 0xff, 0xff, //0x00005c10 .long L0_1_set_208 | COMMENT |
| LOW | internal/native/sse/skip_one_text_amd64.go | 4121 | 0x27, 0xf4, 0xff, 0xff, //0x00003e50 .long L0_0_set_576 | COMMENT |
| LOW | internal/native/sse/skip_array_text_amd64.go | 4461 | // // .set L0_0_set_35, LBB0_35-LJTI0_0 | COMMENT |
| LOW | internal/native/sse/skip_array_text_amd64.go | 4641 | 0x5b, 0xfe, 0xff, 0xff, //0x000045b8 .long L0_2_set_737 | COMMENT |
| LOW | internal/native/sse/validate_one_text_amd64.go | 4461 | // // .set L0_0_set_35, LBB0_35-LJTI0_0 | COMMENT |
| LOW | internal/native/sse/validate_one_text_amd64.go | 4641 | 0x5b, 0xfe, 0xff, 0xff, //0x000045b8 .long L0_2_set_737 | COMMENT |
| LOW | internal/native/sse/skip_object_text_amd64.go | 4461 | // // .set L0_0_set_35, LBB0_35-LJTI0_0 | COMMENT |
| LOW | internal/native/sse/skip_object_text_amd64.go | 4641 | 0x5b, 0xfe, 0xff, 0xff, //0x000045b8 .long L0_2_set_737 | COMMENT |
| LOW | internal/native/sse/value_text_amd64.go | 3321 | 0x48, 0x0f, 0x45, 0xca, //0x00003018 cmovneq %rdx, %rcx | COMMENT |
| LOW | internal/encoder/encoder.go | 41 | COMMENT | |
| LOW | internal/encoder/vm/vm.go | 1 | // Copyright 2024 CloudWeGo Authors | COMMENT |
| LOW | internal/encoder/vm/vm_test.go | 1 | // Copyright 2024 CloudWeGo Authors | COMMENT |
| LOW | internal/encoder/x86/asm_stubs_amd64_go121.go | 1 | //go:build go1.21 && !go1.28 | COMMENT |
| LOW | internal/encoder/x86/asm_stubs_amd64_go117.go | 1 | //go:build go1.17 && !go1.21 | COMMENT |
| LOW | internal/decoder/jitdec/asm_stubs_amd64_go121.go | 1 | //go:build go1.21 && !go1.28 | COMMENT |
| LOW | internal/decoder/jitdec/asm_stubs_amd64_go117.go | 1 | //go:build go1.17 && !go1.21 | COMMENT |
| LOW | internal/rt/table.go | 1 | // Copyright 2024 CloudWeGo Authors | COMMENT |
| LOW | decoder/decoder_native.go | 61 | // Pretouch compiles vt ahead-of-time to avoid JIT compilation on-the-fly, in | COMMENT |
| LOW | decoder/decoder_native_test.go | 161 | } | COMMENT |
| LOW | decoder/decoder_native_test.go | 181 | // Pass2 int `json:"pass2"` | COMMENT |
| LOW | decoder/decoder_native_test.go | 201 | // // assert.Equal(t, len(data), d.i) | COMMENT |
| LOW | issue_test/issue747_test.go | 1 | // Copyright 2025 CloudWeGo Authors | COMMENT |
| LOW | issue_test/issue923_test.go | 1 | // Copyright 2025 CloudWeGo Authors | COMMENT |
| LOW | issue_test/issue670_test.go | 1 | // Copyright 2024 CloudWeGo Authors | COMMENT |
| LOW | issue_test/issue539_test.go | 1 | // Copyright 2023 CloudWeGo Authors | COMMENT |
| LOW | issue_test/common_test.go | 1 | // Copyright 2025 CloudWeGo Authors | COMMENT |
| LOW | issue_test/sonic_snapshot_test.go | 1 | // Copyright 2026 ByteDance Inc. | COMMENT |
| LOW | issue_test/issue777_test.go | 61 | // return &a | COMMENT |
| LOW | issue_test/issue750_test.go | 1 | // Copyright 2025 CloudWeGo Authors | COMMENT |
| LOW | issue_test/jsonv1_compat_test.go | 21 | COMMENT | |
| LOW | issue_test/issue739_test.go | 1 | // Copyright 2025 CloudWeGo Authors | COMMENT |
| LOW | issue_test/issue716_test.go | 1 | // Copyright 2024 CloudWeGo Authors | COMMENT |
| LOW | issue_test/issue692_test.go | 1 | // Copyright 2024 CloudWeGo Authors | COMMENT |
| LOW | issue_test/jsonv2_compat_test.go | 21 | COMMENT | |
| LOW | loader/funcdata_compat.go | 101 | cuOffset uint32 // runtime.cutab offset of this function's CU | COMMENT |
| LOW | loader/funcdata_go120.go | 101 | // | COMMENT |
| LOW | loader/funcdata_go121.go | 101 | COMMENT | |
| 45 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | internal/native/avx2/get_by_path_text_amd64.go | 0 | "' 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, //0x00000090 quad $0x | STRING |
| HIGH | internal/native/avx2/skip_one_fast_text_amd64.go | 0 | "' 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, //0x00000090 quad $0x | STRING |
| HIGH | internal/native/avx2/skip_one_text_amd64.go | 0 | "' 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, //0x00000090 quad $0x | STRING |
| HIGH | internal/native/avx2/skip_array_text_amd64.go | 0 | "' 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, //0x000000f0 quad $0x | STRING |
| HIGH | internal/native/avx2/validate_one_text_amd64.go | 0 | "' 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, //0x000000f0 quad $0x | STRING |
| HIGH | internal/native/avx2/skip_object_text_amd64.go | 0 | "' 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, //0x000000f0 quad $0x | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | loader/internal/iasm/trim.py | 18 | # This file is used by sync.sh for trimming x86_64/instructions.go and x86_64/instructions_table.go | COMMENT |
| MEDIUM | scripts/build-x86.sh | 5 | # Define the directories | COMMENT |
| MEDIUM | scripts/build-x86.sh | 32 | # Create the output directory if it doesn't exist | COMMENT |
| MEDIUM | scripts/build-arm.sh | 3 | # Define the directories | COMMENT |
| MEDIUM | scripts/build-arm.sh | 14 | # Create the output directory if it doesn't exist | COMMENT |
| MEDIUM | scripts/build-arm.sh | 23 | # Define the output file path | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/asm2arm/arm.py | 2212 | CODE | |
| LOW | tools/asm2arm/arm.py | 74 | CODE | |
| LOW | tools/asm2arm/arm.py | 655 | CODE | |
| LOW | tools/asm2arm/arm.py | 668 | CODE | |
| LOW | tools/asm2arm/arm.py | 701 | CODE | |
| LOW | tools/asm2arm/arm.py | 861 | CODE | |
| LOW | tools/asm2arm/arm.py | 997 | CODE | |
| LOW | tools/asm2arm/arm.py | 1066 | CODE | |
| LOW | tools/asm2arm/arm.py | 1516 | CODE | |
| LOW | tools/asm2arm/arm.py | 1573 | CODE | |
| LOW | tools/asm2arm/arm.py | 1619 | CODE | |
| LOW | tools/asm2arm/arm.py | 1883 | CODE | |
| LOW | tools/asm2arm/arm.py | 1904 | CODE | |
| LOW | tools/asm2arm/arm.py | 2049 | CODE | |
| LOW | scripts/bench.py | 103 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/test_pcsp.py | 91 | run_cmd("grep -q \"runtime: \" test.log && exit 1 || exit 0") | CODE |
| HIGH | scripts/test_pcsp.py | 91 | run_cmd("grep -q \"runtime: \" test.log && exit 1 || exit 0") | CODE |
| HIGH | scripts/bench.py | 104 | run("go get golang.org/x/perf/cmd/benchstat && go install golang.org/x/perf/cmd/benchstat") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/asm2arm/arm.py | 11 | CODE | |
| LOW | tools/asm2arm/arm.py | 14 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/bench.py | 153 | # Check if the decline is significant | COMMENT |