Turn your Telegram account into an unlimited, secure cloud storage drive. an Open-source desktop app built with Tauri, Rust, and React.
This report summarizes scanner evidence for caamer20/Telegram-Drive, a Rust project with 5,633 GitHub stars. SynthScan examined 163,718 lines of code across 466 source files, recording 155 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 2.1 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 54 finding(s).
Are imports declared and package/API names verified? 26 finding(s).
Are wrappers, guards, and repeated structures necessary? 108 finding(s).
Which changes need focused human review? 155 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 155 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | app/src-tauri/src/api_routes.rs | 397 | // ──────────────────────────────── Endpoints ──────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1 | // ── Transcode Module ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 31 | // ── Constants ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 62 | // ── Quality presets ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 104 | // ── Types ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 224 | // ── TranscodeManager ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 639 | // ── FFmpeg Detection ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 706 | // ── Source Cache (Phase 2) ────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 818 | // ── HLS Transcode (Phase 3) ───────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1035 | // ── Execute Full Transcode Pipeline ───────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1089 | // ── Step 1: Cache original if needed ──────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1142 | // ── Step 2: Detect source resolution ──────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1172 | // ── Step 3: Transcode ─────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1219 | // ── Tauri Commands ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1545 | // ── Cache management commands ─────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1563 | // ── Cached variants command ───────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1596 | // ── Detailed cache info (per-file per-quality with sizes) ────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 1810 | // ── Clear transcode cache (all, per-file, or per-variant) ────────── | COMMENT |
| MEDIUM | app/src-tauri/src/transcode.rs | 2064 | // ── HLS Serving Routes (Phase 4) ──────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/fmp4_remux.rs | 1 | // ── fMP4 Remux Module ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/fmp4_remux.rs | 23 | // ── Constants ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/fmp4_remux.rs | 28 | // ── Types ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/fmp4_remux.rs | 67 | // ── FFmpeg Remux ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/fmp4_remux.rs | 219 | // ── Tauri Commands ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/fmp4_remux.rs | 429 | // ── Actix Serving Route ────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/vpn_optimizer.rs | 337 | // ── Helpers that return effective values ──────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/crypto_commands.rs | 125 | // ── Tauri Commands ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/mp4_utils.rs | 1 | // ── Shared MP4 Box Parsing ───────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/commands/video_metadata.rs | 40 | // ── Internal helpers ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/commands/archive.rs | 107 | // ── Shared preparation ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | app/src-tauri/src/commands/archive.rs | 673 | // ── Shared utilities ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 59 | // ── Effective stream URL: use fMP4 URL when available ──────────── | COMMENT |
| MEDIUM⚡ | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 62 | // ── Original MSE streaming (for "original" quality) ────────────── | COMMENT |
| MEDIUM⚡ | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 72 | // ── Refs for late-bound values needed by progressive handler ───── | COMMENT |
| MEDIUM⚡ | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 77 | // ── Handle progressive MP4 detection — trigger fMP4 remux ────── | COMMENT |
| MEDIUM⚡ | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 266 | // ── Volume state ───────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 272 | // ── Source / playing resolution tracking ────────────────────────── | COMMENT |
| MEDIUM⚡ | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 276 | // ── Source height for upscale prevention ────────────────────────── | COMMENT |
| MEDIUM⚡ | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 286 | // ── Debug overlay ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 44 | // ── Restart counter for MSE pipeline reinit ────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 48 | // ── fMP4 remux state ──────────────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 190 | // ── progressive callback for useAdaptiveStreaming ──────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 212 | // ── HLS transcode state ────────────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 456 | // ── Fetch transcode capabilities ────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 471 | // ── Poll transcode status ──────────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 529 | // ── Start HLS transcode for a quality ─────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 598 | // ── Handle quality change ──────────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 723 | // ── Initialize hls.js when playlist is ready ───────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 853 | // ── Cancel ongoing transcode ───────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 885 | // ── Retry failed transcode ─────────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 890 | // ── Cleanup ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 904 | // ── Keyboard shortcuts ─────────────────────────────────────────── | COMMENT |
| MEDIUM | …c/components/desktop/dashboard/AdaptiveMediaPlayer.tsx | 935 | // ── Determine current display state ────────────────────────────── | COMMENT |
| MEDIUM | …rc/components/desktop/dashboard/ArchiveViewerModal.tsx | 603 | // ── Extract & Upload button per archive entry ──────────────────────────── | COMMENT |
| MEDIUM | app/src/components/mobile/MobileDashboard.tsx | 93 | // ── Android deep-link listener (https://t.me/ links) ────────────────── | COMMENT |
| MEDIUM | app/src/components/mobile/MobileDashboard.tsx | 112 | // ── Android share-received listener (warm start) ────────────────────── | COMMENT |
| MEDIUM | app/src/components/mobile/MobileDashboard.tsx | 133 | // ── Android cold-start share check ──────────────────────────────────── | COMMENT |
| MEDIUM | app/src/components/mobile/MobileDashboard.tsx | 251 | // ── Connection diagnostics state ────────────────────────────────────── | COMMENT |
| MEDIUM | app/src/components/mobile/MobileDashboard.tsx | 454 | // ── Android cached shared files ─────────────────────────────────────── | COMMENT |
| MEDIUM | app/src/components/mobile/MobileDashboard.tsx | 816 | // ── Copy Telegram native t.me link ──────────────────────────────────── | COMMENT |
| 15 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/components/desktop/dashboard/fileActionDescriptors.ts | 36 | export function resolvePublicFolderUsername( | CODE |
| LOW | …src/components/shared/EncryptionTransparencyDialog.tsx | 13 | export function EncryptionTransparencyDialog({ onClose, state }: EncryptionTransparencyDialogProps) { | CODE |
| LOW | app/src/components/shared/EncryptionSettingsSection.tsx | 294 | export function EncryptionSettingsSection({ vaultOnly = false }: { vaultOnly?: boolean } = {}) { | CODE |
| LOW | app/src/components/shared/FfmpegInstallNotice.tsx | 8 | export async function openFfmpegWindowsDownloads(): Promise<void> { | CODE |
| LOW | app/src/components/dev/StorageCleanupBrowserFixture.tsx | 14 | function StorageCleanupBrowserFixture() { | CODE |
| LOW | app/src/components/dev/RuntimeCopyBrowserFixture.tsx | 12 | export function RuntimeCopyBrowserFixture(){ | CODE |
| LOW | …rc/components/dev/LocalizationArraysBrowserFixture.tsx | 15 | export function LocalizationArraysBrowserFixture() { | CODE |
| LOW | app/src/i18n/resolveLanguage.ts | 21 | export function resolveLanguagePreference( | CODE |
| LOW | app/src/services/fileListRefresh.ts | 177 | export async function invalidateFolderFileQueries( | CODE |
| LOW | app/src/services/fileListRefresh.ts | 190 | export async function invalidateOwnedFileQueries(queryClient: QueryClient, ownerId: string): Promise<void> { | CODE |
| LOW | app/src/services/desktopLifecycle.ts | 41 | export function normalizeDesktopPreferences( | CODE |
| LOW⚡ | app/src/services/desktopLifecycle.ts | 64 | export function getNotificationPermission(): Promise<NotificationPermission> { | CODE |
| LOW⚡ | app/src/services/desktopLifecycle.ts | 68 | export function requestNotificationPermission(): Promise<NotificationPermission> { | CODE |
| LOW⚡ | app/src/services/desktopLifecycle.ts | 76 | export function markDesktopFrontendUnready(): Promise<void> { | CODE |
| LOW | app/src/services/transcodeCacheClient.ts | 14 | export function getDetailedTranscodeCache(refresh = false): Promise<DetailedCacheInfo> { | CODE |
| LOW | app/src/services/transcodeCacheClient.ts | 21 | export function transcodeCacheErrorMessage(error: unknown): string { | CODE |
| LOW | app/src/services/androidReauthentication.ts | 3 | export async function requireAndroidReauthentication(reason: string): Promise<void> { | CODE |
| LOW | app/src/services/mediaKeyboard.ts | 2 | export function shouldHandleMediaShortcut(event: KeyboardEvent): boolean { | CODE |
| LOW | app/src/services/videoUploadMode.ts | 6 | export function supportsTelegramMediaUpload(path: string): boolean { | CODE |
| LOW⚡ | app/src/services/supporterVisibility.ts | 19 | export function sponsorAdCooldownRemaining( | CODE |
| LOW⚡ | app/src/services/supporterVisibility.ts | 29 | export function shouldOfferNewSupporterPurchase(status: SupporterVisibilityStatus): boolean { | CODE |
| LOW⚡ | app/src/services/supporterVisibility.ts | 33 | export function announceSupporterValueMoment(moment: SupporterValueMoment): void { | CODE |
| LOW | app/src/services/supporterVisibility.ts | 48 | export function shouldShowSupporterPrompt( | CODE |
| LOW | app/src/services/desktopTransferEngine.ts | 186 | export async function configureDesktopTransferLimits(maxUploads: number, maxDownloads: number) { | CODE |
| LOW | app/src/services/desktopTransferEngine.ts | 217 | export async function supplyTransferPromptToken(id: string, promptToken: number): Promise<void> { | CODE |
| LOW | app/src/services/androidTransferPolicy.ts | 24 | export function evaluateAndroidTransferPolicy( | CODE |
| LOW | supporter-service/src/crypto.ts | 121 | function validateEntitlementClaims(claims: EntitlementClaims): void { | CODE |
| LOW | supporter-service/src/index.ts | 299 | function matchesOriginalUnpaidOrder(env: Env, claim: CheckoutClaimRow, order: PayPalOrder): boolean { | CODE |
| LOW | supporter-service/src/db.ts | 58 | export async function releaseCheckoutCompletion(env: Env, claimId: string): Promise<void> { | CODE |
| LOW | supporter-service/src/db.ts | 66 | export async function acknowledgeCheckoutReceipt(env: Env, claimId: string, acknowledgedAt: number): Promise<void> { | CODE |
| LOW | supporter-service/src/db.ts | 147 | export async function findEntitlementByRecoveryHash(env: Env, recoveryHash: string): Promise<EntitlementRow | null> { | CODE |
| LOW | supporter-service/src/db.ts | 250 | export async function revokeEntitlementByCapture(env: Env, captureId: string, reason: string, now: number): Promise<bool | CODE |
| LOW | supporter-service/src/paypal.ts | 170 | export function validatedWebhookVerificationFields(env: Env, headers: Headers): WebhookVerificationFields | null { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/src/i18n/locales/tr.json | 1585 | "placeholder": "En az 12 karakter", | CODE |
| LOW | app/src/i18n/locales/th-TH.json | 1585 | "placeholder": "อย่างน้อย 12 อักขระ", | CODE |
| LOW | app/src/i18n/locales/ja.json | 1585 | "placeholder": "12文字以上", | CODE |
| LOW | app/src/i18n/locales/de.json | 1585 | "placeholder": "Mindestens 12 Zeichen", | CODE |
| LOW | app/src/i18n/locales/ur-PK.json | 1585 | "placeholder": "کم از کم 12 حروف", | CODE |
| LOW | app/src/i18n/locales/ru.json | 1599 | "placeholder": "Не менее 12 символов", | CODE |
| LOW | app/src/i18n/locales/zh-CN.json | 1585 | "placeholder": "至少 12 个字符", | CODE |
| LOW | app/src/i18n/locales/en.json | 1585 | "placeholder": "At least 12 characters", | CODE |
| LOW | app/src/i18n/locales/ms-MY.json | 1585 | "placeholder": "Sekurang-kurangnya 12 aksara", | CODE |
| LOW | app/src/i18n/locales/it.json | 1592 | "placeholder": "Almeno 12 caratteri", | CODE |
| LOW | app/src/i18n/locales/uk-UA.json | 1599 | "placeholder": "Щонайменше 12 символів", | CODE |
| LOW | app/src/i18n/locales/pl-PL.json | 1599 | "placeholder": "Co najmniej 12 znaków", | CODE |
| LOW | app/src/i18n/locales/fr.json | 1592 | "placeholder": "Au moins 12 caractères", | CODE |
| LOW | app/src/i18n/locales/fa-IR.json | 1585 | "placeholder": "حداقل 12 نویسه", | CODE |
| LOW | app/src/i18n/locales/hi.json | 1585 | "placeholder": "कम से कम 12 अक्षर", | CODE |
| LOW | app/src/i18n/locales/pt-BR.json | 1592 | "placeholder": "Pelo menos 12 caracteres", | CODE |
| LOW | app/src/i18n/locales/ko.json | 1585 | "placeholder": "최소 12자", | CODE |
| LOW | app/src/i18n/locales/bn-BD.json | 1585 | "placeholder": "অন্তত 12 অক্ষর", | CODE |
| LOW | app/src/i18n/locales/zh-TW.json | 1585 | "placeholder": "至少 12 個字元", | CODE |
| LOW | app/src/i18n/locales/vi.json | 1585 | "placeholder": "Ít nhất 12 ký tự", | CODE |
| LOW | app/src/i18n/locales/id.json | 1585 | "placeholder": "Minimal 12 karakter", | CODE |
| LOW | app/src/i18n/locales/fil-PH.json | 1585 | "placeholder": "Hindi bababa sa 12 karakter", | CODE |
| LOW | app/src/i18n/locales/es.json | 1592 | "placeholder": "Al menos 12 caracteres", | CODE |
| LOW | app/src/i18n/locales/ar.json | 1613 | "placeholder": "12 حرفًا على الأقل", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | REST_API_Documentation.md | 35 | curl -H "X-API-Key: YOUR_API_KEY" \ | CODE |
| HIGH | REST_API_Documentation.md | 223 | -H "X-API-Key: YOUR_API_KEY" \ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/src-tauri/src/transfer_engine.rs | 21 | use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering}; | COMMENT |
| LOW | app/src-tauri/src/transcode.rs | 1 | // ── Transcode Module ──────────────────────────────────────────────────── | COMMENT |
| LOW | app/src-tauri/src/fmp4_remux.rs | 61 | impl Default for Fmp4RemuxState { | COMMENT |
| LOW | app/src-tauri/src/lib.rs | 1041 | // SAFETY NET: Wrap all Android JNI initialization in catch_unwind to prevent | COMMENT |
| LOW | app/src-tauri/src/folder_layout.rs | 1 | //! The folder list and its groups live in two shared tables, but they | COMMENT |
| LOW | app/src-tauri/src/jni_cache.rs | 21 | #[cfg(target_os = "android")] | COMMENT |
| LOW | app/src-tauri/src/resumable_upload.rs | 1 | //! Uploads that continue where they stopped. | COMMENT |
| LOW | app/src-tauri/src/resumable_upload.rs | 21 | time::{Duration, Instant}, | COMMENT |
| LOW | app/src-tauri/src/crypto/vault/mod.rs | 61 | bundle: &[u8], | COMMENT |
| LOW | app/src-tauri/src/commands/mod.rs | 21 | /// Tracks the lifecycle of the Telegram connection | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | app/src-tauri/src/commands/fs.rs | 3160 | #[allow(clippy::too_many_arguments)] // Tauri command dependency injection is intentionally explicit. | COMMENT |
| MEDIUM | app/src-tauri/src/commands/fs.rs | 3868 | #[allow(clippy::too_many_arguments)] // Internal transfer orchestration keeps injected state explicit. | COMMENT |
| MEDIUM | app/src-tauri/src/commands/fs.rs | 5788 | #[allow(clippy::too_many_arguments)] // Tauri command dependency injection is intentionally explicit. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …rc/components/desktop/dashboard/ArchiveViewerModal.tsx | 179 | // Step 1: Extract | COMMENT |
| LOW⚡ | …rc/components/desktop/dashboard/ArchiveViewerModal.tsx | 188 | // Step 2: Upload | COMMENT |
| LOW⚡ | …rc/components/desktop/dashboard/ArchiveViewerModal.tsx | 681 | // Step 1: Extract | COMMENT |
| LOW⚡ | …rc/components/desktop/dashboard/ArchiveViewerModal.tsx | 691 | // Step 2: Upload to the selected target folder | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …rc/components/desktop/dashboard/ArchiveViewerModal.tsx | 179 | // Step 1: Extract | COMMENT |
| LOW⚡ | …rc/components/desktop/dashboard/ArchiveViewerModal.tsx | 188 | // Step 2: Upload | COMMENT |
| LOW⚡ | …rc/components/desktop/dashboard/ArchiveViewerModal.tsx | 681 | // Step 1: Extract | COMMENT |
| LOW⚡ | …rc/components/desktop/dashboard/ArchiveViewerModal.tsx | 691 | // Step 2: Upload to the selected target folder | COMMENT |