cartography-cncf/cartography

Pattern Findings

The scanner identified 8766 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers5343 hits · 5210 pts

Severity	File	Line	Snippet	Context
LOW	AGENTS.md	167	def cleanup_custom_relationships(	CODE
LOW	demo/seeds/keycloak.py	219	def _seed_authentication_flows(	CODE
LOW	demo/seeds/keycloak.py	232	def _seed_authentication_executions(	CODE
LOW	demo/seeds/tailscale.py	90	def _seed_posture_integrations(self, mock_api: Mock) -> None:	CODE
LOW	demo/seeds/duo.py	71	def _seed_web_authn_credentials(self, mock_client: Mock) -> None:	CODE
LOW	tests/unit/driftdetect/test_detector.py	48	def test_state_picks_up_drift():	CODE
LOW	tests/unit/driftdetect/test_detector.py	93	def test_state_order_does_not_matter():	CODE
LOW	tests/unit/driftdetect/test_detector.py	136	def test_state_multiple_expectations():	CODE
LOW	tests/unit/driftdetect/test_detector.py	176	def test_drift_from_multiple_properties():	CODE
LOW	tests/unit/driftdetect/test_detect_drift.py	8	def test_basic_drift_detection():	CODE
LOW	tests/unit/driftdetect/test_detect_drift.py	21	def test_drift_detection_errors():	CODE
LOW	tests/unit/driftdetect/test_shortcuts.py	38	def test_use_shortcuts_for_shortcuts():	CODE
LOW	tests/unit/driftdetect/test_shortcuts.py	82	def test_shortcut_fails_when_shortcut_exists():	CODE
LOW	tests/unit/driftdetect/test_shortcuts.py	108	def test_nonexistent_shortcuts():	CODE
LOW	tests/unit/rules/test_identity_fields.py	28	def test_identity_fields_non_empty(rule_id, fact_id, rule, fact):	CODE
LOW	tests/unit/rules/test_identity_fields.py	37	def test_identity_fields_exist_on_output_model(rule_id, fact_id, rule, fact):	CODE
LOW	tests/unit/rules/test_identity_fields.py	49	def test_identity_fields_returned_by_query(rule_id, fact_id, rule, fact):	CODE
LOW	tests/unit/rules/test_identity_fields.py	59	def test_identity_fields_surfaced_in_serialized_output():	CODE
LOW⚡	tests/unit/rules/test_model.py	215	def test_fact_accepts_a_coherent_declaration():	CODE
LOW⚡	tests/unit/rules/test_model.py	220	def test_fact_rejects_reserved_finding_field_aliases():	CODE
LOW⚡	tests/unit/rules/test_model.py	228	def test_fact_allows_reserved_name_as_intermediate_with_alias():	CODE
LOW⚡	tests/unit/rules/test_model.py	238	def test_fact_rejects_asset_label_not_bound_by_query():	CODE
LOW⚡	tests/unit/rules/test_model.py	244	def test_fact_rejects_asset_id_field_only_bound_in_intermediate_with():	CODE
LOW⚡	tests/unit/rules/test_model.py	251	def test_fact_rejects_identity_field_not_returned_by_query():	CODE
LOW⚡	tests/unit/rules/test_model.py	257	def test_fact_rejects_asset_id_field_from_a_different_node():	CODE
LOW⚡	tests/unit/rules/test_model.py	264	def test_fact_rejects_asset_id_field_that_also_reads_a_different_node():	CODE
LOW⚡	tests/unit/rules/test_model.py	273	def test_validate_anchor_accepts_id_projected_off_the_labeled_variable():	CODE
LOW⚡	tests/unit/rules/test_model.py	278	def test_validate_anchor_rejects_empty_label():	CODE
LOW⚡	tests/unit/rules/test_model.py	284	def test_validate_anchor_rejects_empty_id_field():	CODE
LOW⚡	tests/unit/rules/test_model.py	290	def test_validate_anchor_rejects_id_not_returned():	CODE
LOW⚡	tests/unit/rules/test_model.py	297	def test_validate_anchor_rejects_unbound_label():	CODE
LOW⚡	tests/unit/rules/test_model.py	305	def test_validate_anchor_rejects_id_read_off_a_different_node():	CODE
LOW⚡	tests/unit/rules/test_model.py	314	def test_validate_anchor_rejects_id_that_also_reads_a_different_node():	CODE
LOW⚡	tests/unit/rules/test_model.py	326	def test_validate_anchor_ignores_dotted_string_literals_in_id_expression():	CODE
LOW⚡	tests/unit/rules/test_model.py	331	def test_fact_ignores_return_inside_a_call_subquery():	CODE
LOW⚡	tests/unit/rules/test_model.py	340	def test_returned_aliases_reads_only_the_final_projection():	CODE
LOW⚡	tests/unit/rules/test_model.py	411	def test_fanout_risks_measures_multiplicity_against_the_identity_not_the_anchor():	CODE
LOW⚡	tests/unit/rules/test_model.py	424	def test_fanout_risks_flags_a_variable_that_only_duplicates_rows():	CODE
LOW	tests/unit/rules/test_model.py	16	def test_framework_normalizes_to_lowercase():	CODE
LOW	tests/unit/rules/test_model.py	34	def test_framework_control_title_preserves_display_casing_and_is_not_filter_key():	CODE
LOW	tests/unit/rules/test_model.py	51	def test_framework_optional_fields():	CODE
LOW	tests/unit/rules/test_model.py	85	def test_framework_matches_case_insensitive():	CODE
LOW	tests/unit/rules/test_model.py	102	def test_framework_matches_partial_filter():	CODE
LOW	tests/unit/rules/test_model.py	123	def test_framework_matches_with_optional_fields():	CODE
LOW	tests/unit/rules/test_model.py	148	def test_all_module_keys_in_mapping_except_cross_cloud():	CODE
LOW	tests/unit/rules/test_model.py	174	def test_cross_cloud_not_in_mapping():	CODE
LOW	tests/unit/rules/test_model.py	183	def test_mapping_values_exists():	CODE
LOW	tests/unit/rules/test_model.py	464	def test_fanout_risks_accepts_an_aggregated_fan_out():	CODE
LOW⚡	tests/unit/rules/test_model.py	397	def test_fanout_risks_flags_a_projected_column_the_identity_omits():	STRING
LOW⚡	tests/unit/rules/test_model.py	406	def test_fanout_risks_accepts_the_identity_that_includes_the_fan_out_column():	STRING
LOW⚡	tests/unit/rules/test_model.py	434	def test_fanout_risks_accepts_return_distinct_for_identical_rows():	STRING
LOW⚡	tests/unit/rules/test_model.py	444	def test_fanout_risks_accepts_an_aggregate_in_the_final_projection():	STRING
LOW	tests/unit/rules/test_model.py	458	def test_fanout_risks_does_not_let_return_distinct_excuse_a_projected_column():	STRING
LOW	tests/unit/rules/test_model.py	475	def test_fanout_risks_ignores_a_variable_bound_only_in_a_subquery():	STRING
LOW	tests/unit/rules/test_model.py	485	def test_fanout_risks_accepts_an_optional_match_anti_join():	STRING
LOW	tests/unit/rules/test_model.py	497	def test_fanout_risks_survives_a_comment_marker_inside_a_string_literal():	STRING
LOW	tests/unit/rules/test_model.py	508	def test_fanout_risks_resolves_an_identity_field_through_an_intermediate_with():	STRING
LOW	tests/unit/rules/test_okta_stig.py	45	def test_rules_registered_and_metadata():	CODE
LOW	tests/unit/rules/test_okta_stig.py	58	def test_rule_names_are_security_names():	CODE
LOW	tests/unit/rules/test_okta_stig.py	65	def test_facts_have_expected_structure():	CODE
5283 more matches not shown…

Hallucination Indicators338 hits · 3962 pts

Severity	File	Line	Snippet	Context
CRITICAL⚡	demo/seeds/scaleway.py	38	data = cartography.intel.scaleway.iam.users.transform_users(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	41	cartography.intel.scaleway.iam.users.load_users(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	46	data = cartography.intel.scaleway.iam.applications.transform_applications(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	49	cartography.intel.scaleway.iam.applications.load_applications(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	54	data = cartography.intel.scaleway.iam.groups.transform_groups(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	57	cartography.intel.scaleway.iam.groups.load_groups(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	62	data = cartography.intel.scaleway.iam.apikeys.transform_apikeys(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	65	cartography.intel.scaleway.iam.apikeys.load_apikeys(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	70	data = cartography.intel.scaleway.storage.volumes.transform_volumes(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	73	cartography.intel.scaleway.storage.volumes.load_volumes(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	78	data = cartography.intel.scaleway.storage.snapshots.transform_snapshots(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	81	cartography.intel.scaleway.storage.snapshots.load_snapshots(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	86	data = cartography.intel.scaleway.instances.instances.transform_instances(	CODE
CRITICAL⚡	demo/seeds/scaleway.py	89	cartography.intel.scaleway.instances.instances.load_instances(	CODE
CRITICAL	demo/seeds/snipeit.py	11	for tenant_name, tenant in tests.data.snipeit.tenants.TENANTS.items():	CODE
CRITICAL	demo/seeds/kandji.py	12	for tenant, tenant_data in tests.data.kandji.tenant.TENANT.items():	CODE
CRITICAL	tests/unit/cartography/intel/azure/test_data_factory.py	5	from azure.core.exceptions import HttpResponseError	CODE
CRITICAL	tests/unit/cartography/intel/azure/test_event_grid.py	4	from azure.core.exceptions import HttpResponseError	CODE
CRITICAL	…sts/unit/cartography/intel/common/test_access_token.py	5	from azure.core.exceptions import ClientAuthenticationError	CODE
CRITICAL	tests/unit/cartography/intel/trivy/test_scanner.py	102	mock_boto3_session.return_value.client.return_value.get_paginator.assert_called_once_with(	CODE
CRITICAL	tests/unit/cartography/intel/trivy/test_scanner.py	105	mock_boto3_session.return_value.client.return_value.get_paginator.return_value.paginate.assert_called_once_with(	CODE
CRITICAL	tests/unit/cartography/intel/trivy/test_scanner.py	140	mock_boto3_session.return_value.client.return_value.get_paginator.assert_called_once_with(	CODE
CRITICAL	tests/unit/cartography/intel/trivy/test_scanner.py	143	mock_boto3_session.return_value.client.return_value.get_paginator.return_value.paginate.assert_called_once_with(	CODE
CRITICAL	tests/unit/cartography/intel/trivy/test_scanner.py	197	mock_boto3_session.return_value.client.return_value.get_paginator.assert_called_once_with(	CODE
CRITICAL	tests/unit/cartography/intel/trivy/test_scanner.py	200	mock_boto3_session.return_value.client.return_value.get_paginator.return_value.paginate.assert_called_once_with(	CODE
CRITICAL	tests/unit/cartography/intel/trivy/test_scanner.py	331	mock_boto3_session.return_value.client.return_value.get_object.assert_called_once_with(	CODE
CRITICAL	tests/unit/cartography/intel/trivy/test_scanner.py	377	mock_boto3_session.return_value.client.return_value.get_object.assert_called_once_with(	CODE
CRITICAL⚡	…rtography/intel/azure/test_permission_relationships.py	363	await cartography.intel.microsoft.entra.users.sync_entra_users(	CODE
CRITICAL⚡	…rtography/intel/azure/test_permission_relationships.py	372	await cartography.intel.microsoft.entra.groups.sync_entra_groups(	CODE
CRITICAL⚡	…rtography/intel/azure/test_permission_relationships.py	381	await cartography.intel.microsoft.entra.service_principals.sync_service_principals(	CODE
CRITICAL	tests/integration/cartography/intel/azure/test_rbac.py	17	from azure.core.exceptions import HttpResponseError	CODE
CRITICAL⚡	tests/integration/cartography/intel/azure/test_rbac.py	190	await cartography.intel.microsoft.entra.users.sync_entra_users(	CODE
CRITICAL⚡	tests/integration/cartography/intel/azure/test_rbac.py	200	await cartography.intel.microsoft.entra.groups.sync_entra_groups(	CODE
CRITICAL⚡	tests/integration/cartography/intel/azure/test_rbac.py	210	await cartography.intel.microsoft.entra.service_principals.sync_service_principals(	CODE
CRITICAL	…tion/cartography/intel/azure/test_workload_identity.py	88	await cartography.intel.microsoft.entra.service_principals.sync_service_principals(	CODE
CRITICAL	…tegration/cartography/intel/azure/test_subscription.py	5	from azure.core.exceptions import HttpResponseError	CODE
CRITICAL	…cartography/intel/microsoft/entra/test_applications.py	183	async for assignment in cartography.intel.microsoft.entra.app_role_assignments.get_app_role_assignments_for_	CODE
CRITICAL	…tion/cartography/intel/digitalocean/test_management.py	14	tests.data.digitalocean.platform.ACCOUNT_RESPONSE.get("account", {})	CODE
CRITICAL	…ration/cartography/intel/digitalocean/test_platform.py	24	account_res = tests.data.digitalocean.platform.ACCOUNT_RESPONSE.get("account", {})	CODE
CRITICAL⚡	…gration/cartography/intel/digitalocean/test_compute.py	14	tests.data.digitalocean.management.PROJECTS_RESPONSE.get("projects", [])	CODE
CRITICAL⚡	…gration/cartography/intel/digitalocean/test_compute.py	22	droplet_res = tests.data.digitalocean.compute.DROPLETS_RESPONSE.get("droplets", [])	CODE
CRITICAL	…/integration/cartography/intel/railway/test_volumes.py	28	cartography.intel.railway.storage.volumes.sync(	CODE
CRITICAL	…/integration/cartography/intel/railway/test_volumes.py	138	_, instances = cartography.intel.railway.storage.volumes.transform(	CODE
CRITICAL	…/integration/cartography/intel/railway/test_domains.py	69	cartography.intel.railway.network.domains.sync(	CODE
CRITICAL	…/integration/cartography/intel/railway/test_domains.py	103	cartography.intel.railway.network.domains.sync(	CODE
CRITICAL	…/integration/cartography/intel/railway/test_domains.py	156	cartography.intel.railway.network.tcpproxies.sync(	CODE
CRITICAL	…/integration/cartography/intel/railway/test_domains.py	226	result = cartography.intel.railway.network.tcpproxies.get(	CODE
CRITICAL	…/integration/cartography/intel/railway/test_domains.py	251	result = cartography.intel.railway.network.tcpproxies.get(	CODE
CRITICAL	…ts/integration/cartography/intel/railway/test_users.py	26	cartography.intel.railway.iam.users.sync(	CODE
CRITICAL	…ts/integration/cartography/intel/railway/test_users.py	115	cartography.intel.railway.iam.users.transform_users(	CODE
CRITICAL	…ts/integration/cartography/intel/railway/test_users.py	153	cartography.intel.railway.iam.users.transform_users(	CODE
CRITICAL	…ts/integration/cartography/intel/railway/test_users.py	188	cartography.intel.railway.iam.users.sync(	CODE
CRITICAL	…ts/integration/cartography/intel/railway/test_users.py	276	cartography.intel.railway.iam.users.sync(	CODE
CRITICAL	…ts/integration/cartography/intel/railway/test_users.py	341	cartography.intel.railway.iam.users.sync(	CODE
CRITICAL	…s/integration/cartography/intel/railway/test_tokens.py	33	cartography.intel.railway.iam.users.sync(	CODE
CRITICAL	…s/integration/cartography/intel/railway/test_tokens.py	68	cartography.intel.railway.iam.tokens.sync(	CODE
CRITICAL	…s/integration/cartography/intel/railway/test_tokens.py	145	tokens, readable = cartography.intel.railway.iam.tokens.get_api_tokens(	CODE
CRITICAL	…s/integration/cartography/intel/railway/test_tokens.py	167	tokens, readable = cartography.intel.railway.iam.tokens.get_api_tokens(	CODE
CRITICAL	…s/integration/cartography/intel/railway/test_tokens.py	195	cartography.intel.railway.iam.tokens.sync(	CODE
CRITICAL	…s/integration/cartography/intel/railway/test_tokens.py	213	cartography.intel.railway.iam.tokens.sync(	CODE
278 more matches not shown…

Decorative Section Separators1186 hits · 1828 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	tests/unit/cartography/intel/test_dockerfile_parser.py	15	# =============================================================================	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/test_dockerfile_parser.py	17	# =============================================================================	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/test_dockerfile_parser.py	71	# =============================================================================	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/test_dockerfile_parser.py	73	# =============================================================================	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/test_dockerfile_parser.py	236	# =============================================================================	STRING
MEDIUM⚡	tests/unit/cartography/intel/test_dockerfile_parser.py	238	# =============================================================================	STRING
MEDIUM⚡	tests/unit/cartography/intel/test_dockerfile_parser.py	275	# =============================================================================	STRING
MEDIUM⚡	tests/unit/cartography/intel/test_dockerfile_parser.py	277	# =============================================================================	STRING
MEDIUM	tests/unit/cartography/intel/test_dockerfile_parser.py	205	# =============================================================================	STRING
MEDIUM	tests/unit/cartography/intel/test_dockerfile_parser.py	207	# =============================================================================	STRING
MEDIUM	tests/unit/cartography/intel/test_dockerfile_parser.py	307	# =============================================================================	STRING
MEDIUM	tests/unit/cartography/intel/test_dockerfile_parser.py	309	# =============================================================================	STRING
MEDIUM⚡	…t/cartography/intel/tenable/test_findings_transform.py	40	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…t/cartography/intel/tenable/test_findings_transform.py	42	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…t/cartography/intel/tenable/test_findings_transform.py	153	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…t/cartography/intel/tenable/test_findings_transform.py	155	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…t/cartography/intel/tenable/test_findings_transform.py	244	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…t/cartography/intel/tenable/test_findings_transform.py	246	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	18	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	20	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	135	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	137	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	187	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	189	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	261	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	263	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	394	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	396	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	449	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…nit/cartography/intel/tenable/test_assets_transform.py	451	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	…nit/cartography/intel/tenable/test_assets_transform.py	323	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	…nit/cartography/intel/tenable/test_assets_transform.py	325	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	623	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	625	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	674	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	676	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	698	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	700	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	709	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	711	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	743	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	745	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	791	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	793	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	802	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/unit/cartography/intel/gcp/test_util.py	804	# ------------------------------------------------------------------	COMMENT
MEDIUM	tests/unit/cartography/intel/gcp/test_util.py	655	# ------------------------------------------------------------------	COMMENT
MEDIUM	tests/unit/cartography/intel/gcp/test_util.py	657	# ------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	58	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	60	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	83	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	85	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	416	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	418	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	874	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	876	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	1522	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	1524	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	502	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	…raphy/intel/gcp/test_artifact_registry_supply_chain.py	504	# ---------------------------------------------------------------------------	COMMENT
1126 more matches not shown…

Cross-File Repetition305 hits · 1525 pts

Severity	File	Line	Snippet	Context
HIGH	demo/seeds/azure.py	0	merge (as:azuresubscription{id: $subscription_id}) on create set as.firstseen = timestamp() set as.lastupdated = $update	STRING
HIGH	…s/integration/cartography/intel/azure/test_cosmosdb.py	0	merge (as:azuresubscription{id: $subscription_id}) on create set as.firstseen = timestamp() set as.lastupdated = $update	STRING
HIGH	tests/integration/cartography/intel/azure/test_sql.py	0	merge (as:azuresubscription{id: $subscription_id}) on create set as.firstseen = timestamp() set as.lastupdated = $update	STRING
HIGH	…ts/integration/cartography/intel/azure/test_storage.py	0	merge (as:azuresubscription{id: $subscription_id}) on create set as.firstseen = timestamp() set as.lastupdated = $update	STRING
HIGH	…ts/integration/cartography/intel/azure/test_compute.py	0	merge (as:azuresubscription{id: $subscription_id}) on create set as.firstseen = timestamp() set as.lastupdated = $update	STRING
HIGH	…egration/cartography/intel/gitlab/test_dependencies.py	0	merge (p:gitlabproject{id: $project_id}) on create set p.firstseen = timestamp() set p.lastupdated = $update_tag, p.name	STRING
HIGH	…/integration/cartography/intel/gitlab/test_branches.py	0	merge (p:gitlabproject{id: $project_id}) on create set p.firstseen = timestamp() set p.lastupdated = $update_tag, p.name	STRING
HIGH	…sts/integration/cartography/intel/gitlab/test_users.py	0	merge (p:gitlabproject{id: $project_id}) on create set p.firstseen = timestamp() set p.lastupdated = $update_tag, p.name	STRING
HIGH	…tion/cartography/intel/gitlab/test_dependency_files.py	0	merge (p:gitlabproject{id: $project_id}) on create set p.firstseen = timestamp() set p.lastupdated = $update_tag, p.name	STRING
HIGH	…egration/cartography/intel/gitlab/test_dependencies.py	0	test that resource relationships to project are created.	STRING
HIGH	…/integration/cartography/intel/gitlab/test_branches.py	0	test that resource relationships to project are created.	STRING
HIGH	…tion/cartography/intel/gitlab/test_dependency_files.py	0	test that resource relationships to project are created.	STRING
HIGH	…/integration/cartography/intel/gitlab/test_projects.py	0	merge (org:gitlaborganization{id: $org_id}) on create set org.firstseen = timestamp() set org.lastupdated = $update_tag,	STRING
HIGH	…sts/integration/cartography/intel/gitlab/test_users.py	0	merge (org:gitlaborganization{id: $org_id}) on create set org.firstseen = timestamp() set org.lastupdated = $update_tag,	STRING
HIGH	…ts/integration/cartography/intel/gitlab/test_groups.py	0	merge (org:gitlaborganization{id: $org_id}) on create set org.firstseen = timestamp() set org.lastupdated = $update_tag,	STRING
HIGH	…ration/cartography/intel/azure/test_security_center.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…ts/integration/cartography/intel/azure/test_monitor.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…integration/cartography/intel/azure/test_key_vaults.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…ntegration/cartography/intel/azure/test_app_service.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…/integration/cartography/intel/azure/test_data_lake.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…egration/cartography/intel/azure/test_load_balancer.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…integration/cartography/intel/azure/test_logic_apps.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…ation/cartography/intel/azure/test_group_containers.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…/integration/cartography/intel/azure/test_functions.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…/integration/cartography/intel/azure/test_event_hub.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	tests/integration/cartography/intel/azure/test_aks.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…on/cartography/intel/azure/test_application_gateway.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…ration/cartography/intel/azure/test_resource_groups.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…integration/cartography/intel/azure/test_event_grid.py	0	merge (s:azuresubscription{id: $sub_id}) set s.lastupdated = $update_tag	STRING
HIGH	…/integration/cartography/intel/azure/test_functions.py	0	merge (i:image:awsecrimage {id: $digest}) set i.digest = $digest, i.lastupdated = $tag	STRING
HIGH	…ion/cartography/intel/ontology/test_resolved_images.py	0	merge (i:image:awsecrimage {id: $digest}) set i.digest = $digest, i.lastupdated = $tag	STRING
HIGH	tests/integration/cartography/intel/aws/test_lambda.py	0	merge (i:image:awsecrimage {id: $digest}) set i.digest = $digest, i.lastupdated = $tag	STRING
HIGH	…tegration/cartography/intel/gcp/test_selective_sync.py	0	merge (project:gcpproject{id: $project_id}) on create set project.firstseen = timestamp() set project.lastupdated = $upd	STRING
HIGH	…cartography/intel/gcp/test_permission_relationships.py	0	merge (project:gcpproject{id: $project_id}) on create set project.firstseen = timestamp() set project.lastupdated = $upd	STRING
HIGH	tests/integration/cartography/intel/gcp/test_apikeys.py	0	merge (project:gcpproject{id: $project_id}) on create set project.firstseen = timestamp() set project.lastupdated = $upd	STRING
HIGH	tests/integration/cartography/intel/gcp/test_storage.py	0	merge (project:gcpproject{id: $project_id}) on create set project.firstseen = timestamp() set project.lastupdated = $upd	STRING
HIGH	…tegration/cartography/intel/gcp/test_secretsmanager.py	0	merge (project:gcpproject{id: $project_id}) on create set project.firstseen = timestamp() set project.lastupdated = $upd	STRING
HIGH	tests/integration/cartography/intel/gcp/test_vertex.py	0	merge (project:gcpproject{id: $project_id}) on create set project.firstseen = timestamp() set project.lastupdated = $upd	STRING
HIGH	…egration/cartography/intel/gcp/test_policy_bindings.py	0	merge (project:gcpproject{id: $project_id}) on create set project.firstseen = timestamp() set project.lastupdated = $upd	STRING
HIGH	…gration/cartography/intel/gcp/test_compute_exposure.py	0	merge (p:gcpproject{id:$projectid}) on create set p.firstseen = timestamp() set p.lastupdated = $gcp_update_tag	STRING
HIGH	tests/integration/cartography/intel/gcp/test_dns.py	0	merge (p:gcpproject{id:$projectid}) on create set p.firstseen = timestamp() set p.lastupdated = $gcp_update_tag	STRING
HIGH	tests/integration/cartography/intel/gcp/test_iam.py	0	merge (p:gcpproject{id:$projectid}) on create set p.firstseen = timestamp() set p.lastupdated = $gcp_update_tag	STRING
HIGH	…tion/cartography/intel/gcp/test_ssl_policy_exposure.py	0	merge (p:gcpproject{id:$projectid}) on create set p.firstseen = timestamp() set p.lastupdated = $gcp_update_tag	STRING
HIGH	…ration/cartography/intel/gcp/test_workload_identity.py	0	merge (p:gcpproject{id:$projectid}) on create set p.firstseen = timestamp() set p.lastupdated = $gcp_update_tag	STRING
HIGH	tests/integration/cartography/intel/gcp/test_compute.py	0	merge (p:gcpproject{id:$projectid}) on create set p.firstseen = timestamp() set p.lastupdated = $gcp_update_tag	STRING
HIGH	…sts/integration/cartography/intel/okta/test_origins.py	0	merge (o:oktaorganization{id: $org_id}) on create set o.firstseen = timestamp() set o.lastupdated = $update_tag	STRING
HIGH	…ntegration/cartography/intel/okta/test_applications.py	0	merge (o:oktaorganization{id: $org_id}) on create set o.firstseen = timestamp() set o.lastupdated = $update_tag	STRING
HIGH	tests/integration/cartography/intel/okta/test_users.py	0	merge (o:oktaorganization{id: $org_id}) on create set o.firstseen = timestamp() set o.lastupdated = $update_tag	STRING
HIGH	…sts/integration/cartography/intel/okta/test_origins.py	0	merge (o:oktaorganization{id: $org_id}) set o.lastupdated = $update_tag	STRING
HIGH	…sts/integration/cartography/intel/okta/test_factors.py	0	merge (o:oktaorganization{id: $org_id}) set o.lastupdated = $update_tag	STRING
HIGH	tests/integration/cartography/intel/okta/test_group.py	0	merge (o:oktaorganization{id: $org_id}) set o.lastupdated = $update_tag	STRING
HIGH	tests/integration/cartography/intel/okta/test_users.py	0	merge (o:oktaorganization{id: $org_id}) set o.lastupdated = $update_tag	STRING
HIGH	tests/integration/cartography/intel/aws/test_rds.py	0	merge (k:awskmskey{id: $key_id}) set k.arn = $key_arn, k.lastupdated = $update_tag	STRING
HIGH	tests/integration/cartography/intel/aws/test_efs.py	0	merge (k:awskmskey{id: $key_id}) set k.arn = $key_arn, k.lastupdated = $update_tag	STRING
HIGH	tests/integration/cartography/intel/aws/test_s3.py	0	merge (k:awskmskey{id: $key_id}) set k.arn = $key_arn, k.lastupdated = $update_tag	STRING
HIGH	tests/integration/cartography/intel/aws/test_emr.py	0	merge (aws:awsaccount{id: $aws_account_id}) on create set aws.firstseen = timestamp() set aws.lastupdated = $aws_update_	STRING
HIGH	tests/integration/cartography/intel/aws/test_kms.py	0	merge (aws:awsaccount{id: $aws_account_id}) on create set aws.firstseen = timestamp() set aws.lastupdated = $aws_update_	STRING
HIGH	tests/integration/cartography/intel/aws/common.py	0	merge (aws:awsaccount{id: $aws_account_id}) on create set aws.firstseen = timestamp() set aws.lastupdated = $aws_update_	STRING
HIGH	…s/integration/cartography/intel/aws/test_apigateway.py	0	merge (aws:awsaccount{id: $aws_account_id}) on create set aws.firstseen = timestamp() set aws.lastupdated = $aws_update_	STRING
HIGH	tests/integration/cartography/intel/aws/test_lambda.py	0	merge (aws:awsaccount{id: $aws_account_id}) on create set aws.firstseen = timestamp() set aws.lastupdated = $aws_update_	STRING
245 more matches not shown…

Modern Structural Boilerplate774 hits · 776 pts

Severity	File	Line	Snippet	Context
LOW	demo/__main__.py	23	logger = logging.getLogger(__name__)	CODE
LOW	tests/utils.py	17	logger = logging.getLogger(__name__)	CODE
LOW	tests/unit/cartography/graph/test_model.py	21	logger = logging.getLogger(__name__)	CODE
LOW	tests/integration/conftest.py	13	logger = logging.getLogger(__name__)	CODE
LOW	…tion/cartography/intel/spacelift/test_ec2_ownership.py	24	def _setup_test_infrastructure(neo4j_session: neo4j.Session) -> None:	CODE
LOW	…ation/cartography/intel/snipeit/test_snipeit_assets.py	10	logger = logging.getLogger(__name__)	CODE
LOW	…ration/cartography/intel/snipeit/test_snipeit_users.py	9	logger = logging.getLogger(__name__)	CODE
LOW	…ts/integration/cartography/intel/kandji/test_kandji.py	9	logger = logging.getLogger(__name__)	CODE
LOW	tests/integration/cartography/graph/test_matchlink.py	31	def _setup_test_data(neo4j_session: neo4j.Session, update_tag: int) -> None:	CODE
LOW	cartography/sync.py	34	logger = logging.getLogger(__name__)	CODE
LOW	cartography/config.py	3	logger = logging.getLogger(__name__)	CODE
LOW	cartography/version.py	7	logger = logging.getLogger(__name__)	CODE
LOW	cartography/util.py	44	logger = logging.getLogger(__name__)	CODE
LOW	cartography/cli.py	18	logger = logging.getLogger(__name__)	CODE
LOW	cartography/stats.py	216	def set_stats_client(self, stats_client: StatsClient) -> None:	CODE
LOW	cartography/stats.py	233	def set_stats_client(stats_client: StatsClient) -> None:	CODE
LOW	cartography/helpers.py	8	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/analysis.py	9	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/dns.py	14	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/deprecated_indexes.py	22	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/supply_chain.py	15	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/create_indexes.py	11	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/bigfix/__init__.py	9	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/bigfix/computers.py	20	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/googleworkspace/tenant.py	12	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/googleworkspace/users.py	12	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/googleworkspace/__init__.py	33	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/googleworkspace/groups.py	30	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/googleworkspace/oauth_apps.py	17	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/googleworkspace/devices.py	15	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/socketdev/alerts.py	12	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/socketdev/fixes.py	15	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/socketdev/__init__.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/socketdev/organizations.py	11	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/socketdev/repositories.py	14	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/socketdev/dependencies.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/aibom/__init__.py	24	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/aibom/transform.py	7	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/sentinelone/finding.py	14	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/sentinelone/__init__.py	19	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/sentinelone/application.py	18	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/sentinelone/agent.py	14	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/sentinelone/account.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/crowdstrike/spotlight.py	15	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/crowdstrike/__init__.py	26	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/crowdstrike/endpoints.py	15	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/edgeconfigtokens.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/logdrains.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/securecomputenetworks.py	17	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/accessgroups.py	15	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/firewallconfigs.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/users.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/util.py	8	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/domains.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/teams.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/__init__.py	31	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/aliases.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/dnsrecords.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/edgeconfigs.py	13	logger = logging.getLogger(__name__)	CODE
LOW	cartography/intel/vercel/firewallbypassrules.py	13	logger = logging.getLogger(__name__)	CODE
714 more matches not shown…

Docstring Block Structure68 hits · 340 pts

Severity	File	Line	Snippet	Context
HIGH	cartography/sync.py	282	Execute all configured stages in the sync task sequentially. This method is the main execution entry p	STRING
HIGH	cartography/sync.py	442	Execute a sync task with comprehensive configuration and error handling. This function serves as a high-level	STRING
HIGH	cartography/sync.py	597	Parse and validate user-selected modules from comma-separated string. This function takes a comma-separated st	STRING
HIGH	cartography/sync.py	643	Build a custom sync with user-specified modules. This function creates a Sync instance configured only with th	STRING
HIGH	cartography/util.py	85	Execute an analysis job to enrich existing graph data. This function is designed for use with the cartography.	STRING
HIGH	cartography/util.py	153	Conditionally run an analysis job based on resource dependency requirements. This function checks if all requi	STRING
HIGH	cartography/util.py	246	Execute a scoped analysis job on a specific sub-resource. This function runs analysis queries that are scoped	STRING
HIGH	cartography/util.py	304	Execute a cleanup job to remove stale data from the graph. .. deprecated:: This function is deprecated	STRING
HIGH	cartography/util.py	433	Load a binary resource from a Python package. This function provides a convenient way to load binary files (li	STRING
HIGH	cartography/util.py	468	Decorator to measure and report function execution time via StatsD. This decorator automatically measures the	STRING
HIGH	cartography/util.py	527	Helper function for handling AWS boto3 API pagination with progress logging. This function provides a convenie	STRING
HIGH	cartography/util.py	654	Decorator to handle AWS regional access errors and opt-in region limitations. This decorator wraps AWS API fun	STRING
HIGH	cartography/util.py	780	Add exponential backoff retry logic to any function. This decorator function wraps any callable with retry log	STRING
HIGH	cartography/util.py	867	Convert a dictionary date value to Unix epoch timestamp. .. deprecated:: This method is deprecated. Ne	STRING
HIGH	cartography/util.py	951	Determine if an exception is caused by API rate limiting or throttling. This function checks whether a given e	STRING
HIGH	cartography/util.py	1013	Execute a synchronous function asynchronously in a threadpool with throttling protection. This function wraps	STRING
HIGH	cartography/util.py	1072	Synchronously execute multiple awaitables and return their results. This function blocks the current thread un	STRING
HIGH	cartography/stats.py	138	Create a StatsD timer context manager for measuring execution time. This method returns a timer object	STRING
HIGH	cartography/stats.py	176	Report a StatsD gauge metric value. This method reports a gauge value using the underlying StatsD clie	STRING
HIGH	cartography/helpers.py	73	Split an iterable into batches of specified size. This utility function takes any iterable and yields lists of	STRING
HIGH	cartography/intel/gcp/bigquery_connection.py	67	Gets BigQuery connections for a project across all locations. The BigQuery Connection API does not support a w	STRING
HIGH	cartography/graph/job.py	26	Extract variable names from a Template object. This function extracts all variable identifiers (parameters) fr	STRING
HIGH	cartography/graph/job.py	109	Handle serialization of custom objects. This method is called by the JSON encoder for objects that are	STRING
HIGH	cartography/graph/job.py	134	A job that executes a sequence of Neo4j statements against the cartography graph. A GraphJob represents a comp	STRING
HIGH	cartography/graph/job.py	218	Execute the job by running all statements sequentially. This method executes each statement in the job	STRING
HIGH	cartography/graph/job.py	285	Create a GraphJob instance from a JSON string. This class method deserializes a JSON string into a Gra	STRING
HIGH	cartography/graph/job.py	336	Create a cleanup job from a CartographyNodeSchema. This class method generates a cleanup job that remo	STRING
HIGH	cartography/graph/job.py	463	Create a GraphJob instance from a JSON file. This class method reads a JSON file and deserializes it i	STRING
HIGH	cartography/graph/job.py	555	Deserialize GraphStatement objects from a JSON dictionary. This function creates a list of GraphStatement obje	STRING
HIGH	cartography/graph/statement.py	43	Extract the short name from a file path by removing the extension. This utility function takes a file path and	STRING
HIGH	cartography/graph/statement.py	218	Convert statement to a dictionary representation. This method serializes the GraphStatement instance i	STRING
HIGH	cartography/graph/statement.py	337	Create a GraphStatement instance from a JSON object. This class method constructs a GraphStatement fro	STRING
HIGH	cartography/graph/statement.py	373	Create a GraphStatement instance from a JSON file. This class method reads a JSON file and creates a G	STRING
HIGH	cartography/graph/cleanupbuilder.py	19	Generate Neo4j queries to clean up stale nodes and relationships. This function creates appropriate cleanup qu	STRING
HIGH	cartography/graph/cleanupbuilder.py	127	Generate a cleanup query for relationships when no sub resource is defined. This helper function creates a que	STRING
HIGH	cartography/graph/cleanupbuilder.py	182	Build a MATCH statement for cleanup queries. This helper function generates the appropriate MATCH clause based	STRING
HIGH	cartography/graph/cleanupbuilder.py	249	Generate cleanup queries for both nodes and relationships. This function performs the main string template log	STRING
HIGH	cartography/graph/cleanupbuilder.py	389	Generate an unscoped cleanup query for nodes. This function creates a cleanup query for node schemas that allo	STRING
HIGH	cartography/graph/cleanupbuilder.py	458	Generate an unscoped relationship cleanup query. This function creates a cleanup query for relationships when	STRING
HIGH	cartography/graph/cleanupbuilder.py	517	Build a relationship clause with correct directional syntax. This function generates the appropriate Neo4j rel	STRING
HIGH	cartography/graph/cleanupbuilder.py	604	Generate a cleanup query for matchlink relationships. This function creates a Neo4j query to clean up stale ma	STRING
HIGH	cartography/graph/querybuilder.py	422	Generate a Neo4j clause that sets node properties using the given mapping of attribute names to PropertyRefs.	STRING
HIGH	cartography/graph/querybuilder.py	489	Generate Neo4j clauses that apply conditional extra labels to the node of the current row. Conditional labels	STRING
HIGH	cartography/graph/querybuilder.py	582	Generate a Neo4j clause that sets relationship properties using the given mapping of attribute names to PropertyRef	STRING
HIGH	cartography/graph/querybuilder.py	633	Generate a Neo4j match statement on one or more keys and values for a given node. This function creates a prop	STRING
HIGH	cartography/graph/querybuilder.py	673	Generate a Neo4j WHERE clause for relationship matching with advanced matching options. This function creates	STRING
HIGH	cartography/graph/querybuilder.py	751	Convert CartographyRelSchema properties to dict with validation and helpful error messages. This function conv	STRING
HIGH	cartography/graph/querybuilder.py	819	Generate a Neo4j statement to attach a sub resource to a node. A 'sub resource' is a cartography term for bill	STRING
HIGH	cartography/graph/querybuilder.py	908	Generate a Neo4j statement to attach multiple additional relationships to nodes. This function creates Neo4j c	STRING
HIGH	cartography/graph/querybuilder.py	1019	Generate Neo4j subqueries to attach sub resource and/or other relationships. This function uses Neo4j subqueri	STRING
HIGH	cartography/graph/querybuilder.py	1100	Check if a relationship schema is present on a node schema. This function determines whether a given relations	STRING
HIGH	cartography/graph/querybuilder.py	1141	Filter and validate selected relationships against a node schema. This function ensures that selected relation	STRING
HIGH	cartography/graph/querybuilder.py	1223	Generate a Neo4j query from a CartographyNodeSchema to ingest nodes and relationships. This function creates a	STRING
HIGH	cartography/graph/querybuilder.py	1320	Generate queries to create indexes for the given CartographyNodeSchema and all node types attached to it via its	STRING
HIGH	cartography/graph/querybuilder.py	1448	Generate queries to create indexes for the given CartographyRelSchema and all node types attached to it. This	STRING
HIGH	cartography/graph/querybuilder.py	1649	Generate a query that links every matched source node to every matched target. This is the querybuilder compan	STRING
HIGH	cartography/graph/querybuilder.py	1756	Generate a Neo4j query to link two existing nodes when given a CartographyRelSchema object. This function crea	STRING
HIGH	cartography/models/core/common.py	48	Initialize a PropertyRef instance. Args: name (str): The name of the property.	STRING
HIGH	cartography/models/core/relationships.py	133	Create a TargetNodeMatcher with dynamically generated attributes. This function creates a specialized TargetNo	STRING
HIGH	cartography/rules/formatters.py	19	Generate a clickable Neo4j Browser URL with pre-populated query. This function converts a Neo4j connection URI	STRING
8 more matches not shown…

Cross-Language Confusion48 hits · 251 pts

Severity	File	Line	Snippet	Context
HIGH	…ts/unit/cartography/intel/aws/test_ecr_image_layers.py	1101	"sha256:2222222222222222222222222222222222222222222222222222222222222222": "/bin/sh -c apt-get update && apt-get	CODE
HIGH	…ts/integration/rules/test_database_instance_exposed.py	73	endpoint: null, is_public: false, engine_major_version: '16',	STRING
HIGH	tests/integration/rules/test_cis_aws_iam.py	171	// Inline policies are loaded with arn = null; policy.id is the only stable id.	STRING
HIGH	tests/integration/rules/test_cis_aws_iam.py	174	arn: null,	STRING
HIGH	tests/integration/rules/test_cis_aws_iam.py	278	arn: null,	STRING
HIGH	…integration/cartography/intel/snowflake/test_tables.py	105	# An empty clustering key is stored as null, never as an empty string.	COMMENT
HIGH	…gration/cartography/intel/snowflake/test_warehouses.py	54	# warehouse with no auto-suspend reports null, which is what makes "bills until	COMMENT
HIGH	…egration/cartography/intel/spacelift/test_spacelift.py	321	# Only stack-1 has an assumed role ARN; stack-2's is null, so it gets no edge.	COMMENT
HIGH	…ntegration/cartography/intel/supabase/test_projects.py	247	field still writes null, because that is real data.	STRING
HIGH	tests/data/railway/tokens.py	20	# A personal-scope token: workspaceId is null, so it reaches every workspace.	COMMENT
HIGH	tests/data/spacelift/spacelift_data.py	63	# No AWS integration: assumedRoleArn is null, so no ASSUMES edge.	COMMENT
HIGH⚡	tests/data/okta/application.py	11	"passwordChanged": null,	CODE
HIGH⚡	tests/data/okta/application.py	18	"secondEmail": null,	CODE
HIGH⚡	tests/data/okta/application.py	44	"passwordChanged": null,	CODE
HIGH⚡	tests/data/okta/application.py	51	"secondEmail": null,	CODE
HIGH⚡	tests/data/okta/application.py	53	"mobilePhone": null,	CODE
HIGH	tests/data/okta/application.py	99	"errorRedirectUrl": null,	CODE
HIGH	tests/data/okta/application.py	130	"client_uri": null,	CODE
HIGH	tests/data/okta/application.py	131	"logo_uri": null,	CODE
HIGH	tests/data/aws/cloudtrail_management_events.py	495	"CloudTrailEvent": '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDACKCEVSQ6C2E	CODE
HIGH	tests/data/aws/cloudtrail_management_events.py	504	"CloudTrailEvent": '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDACKCEVSQ6C2A	CODE
HIGH	tests/data/aws/cloudtrail_management_events.py	520	"CloudTrailEvent": '{"eventVersion": "1.08", "userIdentity": {"type": "SAMLUser", "principalId": "SAML:unauthori	CODE
HIGH	tests/data/aws/cloudtrail_management_events.py	536	"CloudTrailEvent": '{"eventVersion": "1.08", "userIdentity": {"type": "WebIdentityUser", "principalId": "repo:un	CODE
HIGH	tests/data/aws/ecs.py	564	"curl -f http://localhost:8080/healthz \|\| exit 1",	CODE
HIGH	tests/data/trivy/trivy_sample.py	67	"created_by": 'RUN /bin/sh -c set -eux; \t\tsavedAptMark="$(apt-mark showmanual)"; \tapt-get update;	CODE
HIGH	tests/data/trivy/trivy_sample.py	138	"created_by": 'HEALTHCHECK \u0026{["CMD-SHELL" "curl -f http://localhost:8000/health \|\| exit 1"] "30	CODE
HIGH	tests/data/trivy/trivy_sample.py	184	"curl -f http://localhost:8000/health \|\| exit 1",	CODE
HIGH	cartography/intel/socketdev/alerts.py	60	The Socket.dev API sometimes returns objects like {"name": "main", "type": null}	STRING
HIGH	cartography/intel/socketdev/alerts.py	85	# Resolve GHSA IDs — cveId is often null, ghsaIds has the identifier	COMMENT
HIGH	cartography/intel/semgrep/findings.py	165	if dep_url: # Lock file can be null, need to set	CODE
HIGH	cartography/intel/cloudflare/rulesets.py	259	# with the key absent or explicitly null, as executed_ruleset_ids() sees.	COMMENT
HIGH	cartography/intel/supabase/projects.py	149	that genuinely omits a field still writes null, because that is real data.	STRING
HIGH⚡	cartography/intel/aws/organizations.py	576	SET account.arn = null,	STRING
HIGH⚡	cartography/intel/aws/organizations.py	577	account.email = null,	STRING
HIGH⚡	cartography/intel/aws/organizations.py	578	account.state = null,	STRING
HIGH⚡	cartography/intel/aws/organizations.py	579	account.status = null,	STRING
HIGH⚡	cartography/intel/aws/organizations.py	580	account.joined_method = null,	STRING
HIGH⚡	cartography/intel/aws/organizations.py	581	account.joined_timestamp = null,	STRING
HIGH⚡	cartography/intel/aws/organizations.py	582	account.org_id = null,	STRING
HIGH⚡	cartography/graph/querybuilder.py	29	# coalesce will return the first non-null value, so if toBooleanOrNull returns null,	COMMENT
HIGH	cartography/graph/querybuilder.py	46	# coalesce will return the first non-null value, so if toBooleanOrNull returns null,	COMMENT
HIGH	cartography/models/gitlab/organizations.py	4	In GitLab, organizations are top-level groups (where parent_id is null).	STRING
HIGH	cartography/models/scaleway/storage/objectstorage.py	57	description="`True` when `public` is true. Left unset when `public` is null, meaning neither the ACL nor the pol	CODE
HIGH	…ography/models/aws/apigateway/apigatewayintegration.py	47	description="The ID of the VpcLink used for the integration when connectionType=VPC_LINK and undefined, otherwis	CODE
HIGH	…phy/rules/data/rules/delegation_boundary_modifiable.py	44	UNWIND coalesce(stmt.resource, [null]) AS resource	CODE
HIGH⚡	…y/rules/data/rules/policy_administration_privileges.py	51	UNWIND coalesce(allow_resources, [null]) AS resource	CODE
HIGH⚡	cartography/rules/data/rules/databricks_security.py	81	# (system-default cap) and an unset value both to null, and the account default	STRING
HIGH	…rules/data/rules/identity_administration_privileges.py	49	UNWIND coalesce(stmt.resource, [null]) AS resource	CODE

Deep Nesting210 hits · 199 pts

Severity	File	Line	Context
LOW	tests/unit/cartography/intel/snowflake/test_util.py	765	CODE
LOW	tests/unit/cartography/intel/snowflake/test_util.py	779	CODE
LOW	…it/cartography/intel/ontology/test_ontology_mapping.py	185	CODE
LOW	…it/cartography/intel/ontology/test_ontology_mapping.py	231	CODE
LOW	…it/cartography/intel/ontology/test_ontology_mapping.py	269	CODE
LOW	…it/cartography/intel/ontology/test_ontology_mapping.py	296	CODE
LOW	…it/cartography/intel/ontology/test_ontology_mapping.py	308	CODE
LOW	…it/cartography/intel/ontology/test_ontology_mapping.py	331	CODE
LOW	…it/cartography/intel/ontology/test_ontology_mapping.py	367	CODE
LOW	…it/cartography/intel/ontology/test_ontology_mapping.py	403	CODE
LOW	…ts/unit/cartography/intel/aws/test_label_migrations.py	43	CODE
LOW	…/unit/cartography/analysis/test_ontology_dnsrecords.py	52	CODE
LOW	tests/unit/cartography/graph/test_model.py	71	CODE
LOW	tests/unit/cartography/graph/test_analysis.py	51	CODE
LOW	…tegration/cartography/intel/github/test_dockerfiles.py	131	CODE
LOW	…tegration/cartography/intel/github/test_dockerfiles.py	137	CODE
LOW	…n/cartography/intel/github/test_external_identities.py	302	CODE
LOW	tests/integration/cartography/intel/aws/test_init.py	1425	CODE
LOW	cartography/intel/supply_chain.py	334	CODE
LOW	cartography/intel/supply_chain.py	472	CODE
LOW	cartography/intel/googleworkspace/users.py	42	CODE
LOW	cartography/intel/googleworkspace/__init__.py	64	CODE
LOW	cartography/intel/googleworkspace/groups.py	235	CODE
LOW	cartography/intel/googleworkspace/oauth_apps.py	23	CODE
LOW	cartography/intel/gitlab/dependency_files.py	20	CODE
LOW	cartography/intel/gitlab/users.py	90	CODE
LOW	cartography/intel/gitlab/util.py	185	CODE
LOW	…rtography/intel/gitlab/container_image_attestations.py	67	CODE
LOW	cartography/intel/gitlab/supply_chain.py	274	CODE
LOW	cartography/intel/gitlab/supply_chain.py	373	CODE
LOW	cartography/intel/gitlab/container_images.py	165	CODE
LOW	cartography/intel/gitlab/container_images.py	411	CODE
LOW	cartography/intel/gitlab/container_images.py	484	CODE
LOW	cartography/intel/azure/functions.py	115	CODE
LOW	cartography/intel/azure/firewall.py	499	CODE
LOW	cartography/intel/azure/data_factory_pipeline.py	38	CODE
LOW	cartography/intel/azure/network.py	237	CODE
LOW	cartography/intel/azure/key_vaults.py	370	CODE
LOW	cartography/intel/azure/compute.py	39	CODE
LOW	cartography/intel/azure/util/common.py	8	CODE
LOW	cartography/intel/semgrep/findings.py	128	CODE
LOW	cartography/intel/pagerduty/escalation_policies.py	43	CODE
LOW	cartography/intel/pagerduty/schedules.py	40	CODE
LOW	cartography/intel/wiz/findings.py	267	CODE
LOW	cartography/intel/microsoft/o365/license_details.py	18	CODE
LOW	cartography/intel/microsoft/o365/licenses.py	31	CODE
LOW	…tography/intel/microsoft/intune/compliance_policies.py	56	CODE
LOW	cartography/intel/microsoft/intune/reports.py	186	CODE
LOW	cartography/intel/microsoft/entra/groups.py	55	CODE
LOW	cartography/intel/microsoft/entra/groups.py	158	CODE
LOW	cartography/intel/microsoft/entra/utils.py	72	CODE
LOW	cartography/intel/microsoft/entra/ou.py	23	CODE
LOW	…tography/intel/microsoft/entra/app_role_assignments.py	29	CODE
LOW	cartography/intel/cloudflare/r2buckets.py	226	CODE
LOW	cartography/intel/tenable/api.py	89	CODE
LOW	…raphy/intel/databricks/network_connectivity_configs.py	40	CODE
LOW	cartography/intel/gsuite/__init__.py	69	CODE
LOW	cartography/intel/gsuite/groups.py	109	CODE
LOW	cartography/intel/oci/iam.py	385	CODE
LOW	cartography/intel/snowflake/services.py	93	CODE
150 more matches not shown…

Self-Referential Comments63 hits · 184 pts

Severity	File	Line	Snippet	Context
MEDIUM	demo/seeds/slack.py	46	# Create a mock Slack client	COMMENT
MEDIUM⚡	tests/unit/cartography/client/core/test_tx.py	649	# Create a ClientError without setting the code (simulates locally-created error)	COMMENT
MEDIUM	…ntegration/cartography/intel/sentinelone/test_agent.py	188	# Create an old agent that should be cleaned up	COMMENT
MEDIUM	…egration/cartography/intel/sentinelone/test_finding.py	230	# Create an old AppFinding that should be cleaned up	COMMENT
MEDIUM	…ration/cartography/intel/gitlab/test_cascade_delete.py	148	# Create a stale branch (should be deleted)	COMMENT
MEDIUM	…ration/cartography/intel/gitlab/test_cascade_delete.py	161	# Create a fresh branch (should be preserved - maybe re-parented)	COMMENT
MEDIUM	…ration/cartography/intel/azure/test_security_center.py	21	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…ts/integration/cartography/intel/azure/test_monitor.py	21	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…integration/cartography/intel/azure/test_key_vaults.py	33	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…ntegration/cartography/intel/azure/test_app_service.py	21	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…/integration/cartography/intel/azure/test_data_lake.py	27	# Create the prerequisite AzureSubscription and AzureStorageAccount nodes	COMMENT
MEDIUM	…egration/cartography/intel/azure/test_load_balancer.py	21	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…integration/cartography/intel/azure/test_logic_apps.py	21	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…s/integration/cartography/intel/azure/test_firewall.py	39	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…s/integration/cartography/intel/azure/test_firewall.py	394	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…tegration/cartography/intel/azure/test_data_factory.py	39	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…tegration/cartography/intel/azure/test_data_factory.py	220	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…tegration/cartography/intel/azure/test_data_factory.py	253	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…tegration/cartography/intel/azure/test_data_factory.py	287	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…ts/integration/cartography/intel/azure/test_synapse.py	50	# Create the prerequisite AzureSubscription node with the short GUID	COMMENT
MEDIUM	…ts/integration/cartography/intel/azure/test_network.py	41	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…ation/cartography/intel/azure/test_group_containers.py	21	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…/integration/cartography/intel/azure/test_functions.py	35	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…/integration/cartography/intel/azure/test_event_hub.py	43	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	tests/integration/cartography/intel/azure/test_aks.py	24	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…on/cartography/intel/azure/test_application_gateway.py	23	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…ration/cartography/intel/azure/test_resource_groups.py	21	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	…integration/cartography/intel/azure/test_event_grid.py	21	# Create the prerequisite AzureSubscription node	COMMENT
MEDIUM	tests/integration/cartography/intel/gcp/test_cai.py	39	# Create a mock CAI client	COMMENT
MEDIUM	tests/integration/cartography/intel/gcp/test_kms.py	71	# Create the prerequisite GCPProject node	COMMENT
MEDIUM	…tegration/cartography/intel/gcp/test_cascade_delete.py	154	# Create a stale child (should be deleted)	COMMENT
MEDIUM	…tegration/cartography/intel/gcp/test_cascade_delete.py	167	# Create a fresh child (should be preserved - maybe re-parented)	COMMENT
MEDIUM	…tegration/cartography/intel/gcp/test_cascade_delete.py	358	# Create a child resource under the project	COMMENT
MEDIUM	…ion/cartography/intel/gcp/test_empty_parent_cleanup.py	252	# Create a cluster for testing	STRING
MEDIUM	…ion/cartography/intel/gcp/test_crm_deferred_cleanup.py	103	# Create a minimal config	COMMENT
MEDIUM	tests/integration/cartography/intel/okta/test_group.py	243	# Create a fresh group via sync	COMMENT
MEDIUM	…ntegration/cartography/intel/okta/test_applications.py	137	# Create the OktaOrganization node first	COMMENT
MEDIUM	tests/integration/cartography/intel/okta/test_users.py	58	# Create the OktaOrganization node first	COMMENT
MEDIUM	…tegration/cartography/intel/aws/test_cloudformation.py	32	# Create a mock AWSRole for the relationship test	COMMENT
MEDIUM	…tegration/cartography/intel/aws/test_identitycenter.py	375	# Create a sample AWSRole node that we'll link to the group	COMMENT
MEDIUM	…ration/cartography/intel/aws/iam/test_role_policies.py	50	# Define the relationships we expect in terms of role ARN and principal ARN.	COMMENT
MEDIUM	…ration/cartography/intel/aws/iam/test_user_policies.py	48	# Define the relationships we expect in terms of role ARN and principal ARN.	COMMENT
MEDIUM	tests/integration/cartography/intel/aws/iam/test_iam.py	96	# Create a mock boto3 session for the test	COMMENT
MEDIUM	tests/integration/cartography/intel/aws/iam/test_iam.py	130	# Create a test principal that the sync function will find	COMMENT
MEDIUM	…on/cartography/intel/aws/ec2/test_load_balancer_v2s.py	335	# Create a NACL attached to subnet-11111111	COMMENT
MEDIUM	…/integration/cartography/intel/kubernetes/test_rbac.py	66	# Create a mock K8s client	COMMENT
MEDIUM	…tegration/cartography/intel/kubernetes/test_ingress.py	321	# Create a mock K8s client	COMMENT
MEDIUM	tests/data/gcp/kms.py	42	# Define a helper mapping for the test to easily return the correct keys per ring	COMMENT
MEDIUM	docs/conf.py	4	# This file is execfile()d with the current directory set to its	COMMENT
MEDIUM	cartography/intel/gitlab/dependencies.py	402	# Create a mapping of file paths to dependency file IDs	COMMENT
MEDIUM⚡	cartography/intel/azure/subscription.py	32	# Create the client	COMMENT
MEDIUM	cartography/intel/azure/subscription.py	63	# Create the client	COMMENT
MEDIUM	cartography/intel/azure/data_factory_pipeline.py	65	# Create a new dict for each relationship	COMMENT
MEDIUM	cartography/intel/gcp/vertex/deployed_models.py	29	# Create a composite ID from endpoint and deployed model ID	COMMENT
MEDIUM	cartography/intel/snipeit/user.py	45	# Create the SnipeIT Tenant	COMMENT
MEDIUM	cartography/intel/snipeit/asset.py	43	# Create the SnipeIT Tenant	COMMENT
MEDIUM	cartography/intel/github/repos.py	1340	# Create a unique ID for a GitHubBranch node representing the default branch of this repo object.	STRING
MEDIUM	cartography/intel/github/repos.py	1347	# Create a git:// URL from the given SSH URL, if it exists.	STRING
MEDIUM	cartography/intel/okta/groups.py	336	# Create an entry for each group rule and for each group_id.	COMMENT
MEDIUM	cartography/intel/aws/apigateway.py	236	# Create a mapping of api_id to policy data for easier lookup	COMMENT
3 more matches not shown…

Fake / Example Data89 hits · 95 pts

Severity	File	Line	Snippet	Context
LOW	…s/unit/cartography/intel/cloudflare/test_cloudflare.py	58	cloudflare_token="fake-token",	CODE
LOW⚡	…nit/cartography/intel/tenable/test_assets_transform.py	277	assert tag["added_by"] == "admin@example.com"	CODE
LOW	tests/unit/cartography/intel/github/test_repos.py	897	dependencies, "fake-token", "https://api.github.com/graphql"	CODE
LOW	tests/unit/cartography/intel/github/test_repos.py	961	dependencies, "fake-token", "https://api.github.com/graphql"	CODE
LOW	tests/unit/cartography/intel/github/test_repos.py	1012	dependencies, "fake-token", "https://api.github.com/graphql"	CODE
LOW	tests/unit/cartography/intel/github/test_repos.py	1065	dependencies, "fake-token", "https://api.github.com/graphql"	CODE
LOW	tests/unit/cartography/intel/github/test_app_auth.py	60	private_key="fake-key",	CODE
LOW	tests/unit/cartography/intel/github/test_app_auth.py	91	private_key="fake-key",	CODE
LOW	tests/unit/cartography/intel/github/test_app_auth.py	117	private_key="fake-key",	CODE
LOW	tests/unit/cartography/intel/github/test_app_auth.py	136	private_key="fake-key",	CODE
LOW⚡	tests/unit/cartography/intel/github/test_app_auth.py	170	"private_key": "fake-key",	CODE
LOW⚡	tests/unit/cartography/intel/github/test_app_auth.py	182	"private_key": "fake-key",	CODE
LOW⚡	tests/unit/cartography/intel/zoom/test_users.py	107	{"email": "user@example.com", "status": "active", "type": 1},	CODE
LOW⚡	tests/unit/cartography/intel/zoom/test_users.py	110	{"id": "u1", "email": "user@example.com", "status": "active"},	CODE
LOW	tests/unit/cartography/intel/zoom/test_users.py	145	"email": "user@example.com",	CODE
LOW	tests/unit/cartography/intel/zoom/test_users.py	180	("account-a:user:user-1", "user@example.com")	CODE
LOW	tests/unit/cartography/intel/salesforce/test_util.py	57	username="user@example.com",	CODE
LOW	tests/unit/cartography/intel/aws/test_ses.py	33	"IdentityName": "user@example.com",	CODE
LOW	tests/unit/cartography/intel/aws/test_ses.py	69	"IdentityName": "user@example.com",	CODE
LOW	…ography/intel/aws/test_cloudtrail_management_events.py	52	"userName": "admin@example.com",	CODE
LOW	…ography/intel/aws/test_cloudtrail_management_events.py	54	"CloudTrailEvent": '{"userIdentity": {"type": "SAMLUser", "principalId": "SAML:admin@example.com", "userName": "admi	CODE
LOW	…ography/intel/aws/test_cloudtrail_management_events.py	134	assert assumption["source_principal_arn"] == "admin@example.com"	CODE
LOW	…ation/cartography/intel/socketdev/test_dependencies.py	44	"fake-token",	CODE
LOW	…ation/cartography/intel/socketdev/test_repositories.py	66	"fake-token",	CODE
LOW	…ation/cartography/intel/socketdev/test_repositories.py	161	"fake-token",	CODE
LOW	…ation/cartography/intel/socketdev/test_repositories.py	194	"fake-token",	CODE
LOW	…integration/cartography/intel/socketdev/test_alerts.py	44	"fake-token",	CODE
LOW	…/integration/cartography/intel/socketdev/test_fixes.py	56	"fake-token",	CODE
LOW⚡	…ration/cartography/intel/crowdstrike/test_spotlight.py	24	return_value=[["dummy-id"]],	CODE
LOW⚡	…ration/cartography/intel/crowdstrike/test_spotlight.py	31	cartography.intel.crowdstrike.endpoints, "get_host_ids", return_value=[["dummy-id"]]	CODE
LOW⚡	…ration/cartography/intel/crowdstrike/test_spotlight.py	148	return_value=[["dummy-id"]],	CODE
LOW⚡	…ration/cartography/intel/crowdstrike/test_spotlight.py	155	cartography.intel.crowdstrike.endpoints, "get_host_ids", return_value=[["dummy-id"]]	CODE
LOW	…egration/cartography/intel/gitlab/test_ci_variables.py	71	"fake-token",	CODE
LOW	…egration/cartography/intel/gitlab/test_ci_variables.py	136	"fake-token",	CODE
LOW	…egration/cartography/intel/gitlab/test_ci_variables.py	166	"fake-token",	CODE
LOW	…integration/cartography/intel/gitlab/test_ci_config.py	136	"fake-token",	CODE
LOW	…integration/cartography/intel/gitlab/test_ci_config.py	176	"fake-token",	CODE
LOW	…integration/cartography/intel/gitlab/test_ci_config.py	251	"fake-token",	CODE
LOW	…integration/cartography/intel/gitlab/test_ci_config.py	276	"fake-token",	CODE
LOW⚡	…on/cartography/intel/gitlab/test_container_registry.py	156	"fake-token",	CODE
LOW⚡	…on/cartography/intel/gitlab/test_container_registry.py	166	"fake-token",	CODE
LOW⚡	…on/cartography/intel/gitlab/test_container_registry.py	176	"fake-token",	CODE
LOW⚡	…on/cartography/intel/gitlab/test_container_registry.py	186	"fake-token",	CODE
LOW	…on/cartography/intel/gitlab/test_container_registry.py	730	"fake-token",	CODE
LOW	…on/cartography/intel/gitlab/test_container_registry.py	756	"fake-token",	CODE
LOW	…egration/cartography/intel/gitlab/test_environments.py	68	"fake-token",	CODE
LOW	…s/integration/cartography/intel/gitlab/test_runners.py	89	"fake-token",	CODE
LOW	…s/integration/cartography/intel/gitlab/test_runners.py	162	"fake-token",	CODE
LOW	…sts/integration/cartography/intel/gitlab/test_users.py	121	"fake-token",	CODE
LOW	…ation/cartography/intel/supabase/test_orchestration.py	27	supabase_access_token="fake-token",	CODE
LOW	tests/integration/cartography/intel/jira/test_access.py	96	assert check_nodes(neo4j_session, "User", ["email"]) == {("user@example.com",)}	CODE
LOW⚡	tests/integration/cartography/intel/jira/test_access.py	153	) == {("user@example.com", "user-1")}	CODE
LOW⚡	tests/integration/cartography/intel/jira/test_access.py	157	assert dict(row) == {"source": "jira", "email": "user@example.com", "active": True}	CODE
LOW	tests/integration/cartography/intel/jira/test_access.py	417	("user-1", USERS[0]["displayName"], "user@example.com"),	CODE
LOW	tests/integration/cartography/intel/jira/test_access.py	428	) == {("user@example.com", "user-1")}	CODE
LOW	…s/integration/cartography/intel/github/test_commits.py	66	"fake-token",	CODE
LOW	…artography/intel/scaleway/test_code_to_cloud_gitlab.py	46	"fake-token",	CODE
LOW	…graphy/intel/scaleway/test_code_to_cloud_full_chain.py	154	"fake-token",	CODE
LOW	…artography/intel/scaleway/test_code_to_cloud_github.py	45	"fake-token",	CODE
LOW	…ts/integration/cartography/intel/zoom/test_settings.py	74	[{"id": f"{account}:user:user-one", "email": "user@example.com"}],	CODE
29 more matches not shown…

Over-Commented Block129 hits · 91 pts

Severity	File	Line	Snippet	Context
LOW	tests/unit/rules/test_identity_uniqueness.py	21	# (rule_id, fact_id, rule, fact) for every fact in the registry.	COMMENT
LOW	tests/unit/rules/test_identity_uniqueness.py	81	("aws_remote_admin_ipv6", "a"): "group and members share one account",	COMMENT
LOW	tests/unit/cartography/intel/gitlab/test_util.py	121	# runners.sync_gitlab_runners and supply_chain.get_dockerfiles_for_projects,	COMMENT
LOW	tests/unit/cartography/graph/test_model.py	361	"CrowdstrikeFinding",	COMMENT
LOW	tests/unit/cartography/graph/test_model.py	381	# merely left it, destroying the other workspaces' memberships, so the workspace link is a	COMMENT
LOW	tests/unit/cartography/graph/test_model.py	401	# An Airbyte user can belong to several organizations. Anchoring the identity to	COMMENT
LOW	…egration/cartography/intel/kubernetes/test_clusters.py	81	"AWSEKSCluster",	COMMENT
LOW	…egration/cartography/intel/kubernetes/test_clusters.py	101	# "UPDATE_TAG": TEST_UPDATE_TAG + 1,	COMMENT
LOW	tests/data/tailscale/acls.py	21	// Comment this section out if you want to define specific restrictions.	COMMENT
LOW	tests/data/tailscale/acls.py	61	// Test access rules every time they're saved.	COMMENT
LOW	tests/data/aws/ec2/load_balancers.py	61	# 'ListenerArn': 'string',	COMMENT
LOW	tests/data/aws/ec2/load_balancers.py	81	# 'ClientId': 'string',	COMMENT
LOW	tests/data/aws/ec2/load_balancers.py	101	# },	COMMENT
LOW	tests/data/aws/ec2/load_balancers.py	161	],	COMMENT
LOW	tests/data/aws/ec2/load_balancers.py	181	# 'Reason': 'string'	COMMENT
LOW	tests/data/aws/ec2/load_balancers.py	201	# {	COMMENT
LOW	docs/conf.py	1	#	COMMENT
LOW	docs/conf.py	121	# The full version, including alpha/beta/rc tags.	COMMENT
LOW	docs/conf.py	141		COMMENT
LOW	docs/conf.py	221		COMMENT
LOW	docs/conf.py	241		COMMENT
LOW	docs/conf.py	261	# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.	COMMENT
LOW	.devcontainer/docker-compose.yml	1	version: '3.8'	COMMENT
LOW	.devcontainer/devcontainer.json	21	// Features to add to the dev container. More info: https://containers.dev/features.	COMMENT
LOW	.github/workflows/publish-to-ghcr-and-pypi.yml	121	# the workflow_dispatch.	COMMENT
LOW	cartography/intel/microsoft/entra/users.py	21		COMMENT
LOW	cartography/intel/oci/__init__.py	221	# neo4j_session,	COMMENT
LOW	cartography/intel/gcp/__init__.py	221	# Track whether IAM sync succeeded for this project.	COMMENT
LOW	cartography/intel/gcp/__init__.py	861	"Some relationships may not be created if the dependency data doesn't exist in Neo4j.",	COMMENT
LOW	cartography/intel/aws/s3.py	801	# "Statement": [	COMMENT
LOW	cartography/intel/aws/s3.py	881		COMMENT
LOW	cartography/intel/aws/s3.py	961	"""Parses the S3 default encryption object and returns a dict of the relevant data"""	COMMENT
LOW	cartography/intel/aws/s3.py	1061	"object_ownership": bucket_ownership_controls.get("OwnershipControls", {})	COMMENT
LOW	cartography/intel/aws/s3.py	1081	# },	COMMENT
LOW	cartography/intel/aws/ec2/vpc.py	101	# {	COMMENT
LOW	cartography/models/ontology/constraints_whitelist.py	241	KeycloakGroupToRoleRel,	COMMENT
LOW	cartography/models/ontology/constraints_whitelist.py	261	# -> PermissionRole) now coexists on AWSLambda. This rel declares its	COMMENT
LOW	cartography/models/ontology/constraints_whitelist.py	301	# for generic membership.	COMMENT
LOW	cartography/models/ontology/constraints_whitelist.py	381	# USES_WAREHOUSE is a Snowflake service's data-plane dependency on the	COMMENT
LOW	cartography/models/ontology/constraints.py	81	# semantic.	COMMENT
LOW	cartography/models/ontology/constraints.py	101	# is always frontend -> backend, never the reverse: the load balancer, domain or	COMMENT
LOW	cartography/models/ontology/mapping/data/cves.py	1	from cartography.models.ontology.mapping.specs import OntologyFieldMapping	COMMENT
LOW	…graphy/models/ontology/mapping/data/security_issues.py	1	from cartography.models.ontology.mapping.specs import OntologyFieldMapping	COMMENT
LOW	cartography/models/aws/iam/account_summary.py	81	# Implementation note:	COMMENT
LOW	cartography/models/modal/environment.py	81	@dataclass(frozen=True)	COMMENT
LOW	cartography/rules/spec/model.py	241	#	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	421	# Missing datamodel: tenant-level Directory settings for external directory sharing mode	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	441	# Missing datamodel: Calendar policy settings at tenant or OU scope for external sharing on secondary calendars	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	461	# Missing datamodel: Drive sharing settings controlling public or unlisted publication	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	481	# Missing datamodel: Drive content-distribution settings for cross-org shared-drive distribution	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	501	# Missing datamodel: Drive shared-drive viewer and commenter restriction settings	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	521	# Missing datamodel: Gmail mail-delegation policy settings	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	541	# Missing datamodel: mail-enabled domain inventory plus DNS TXT records or normalized DMARC status per domain	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	561	# Missing datamodel: Gmail safety attachment-policy settings	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	581	# Missing datamodel: Gmail spoofing-protection settings and configured action state	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	601	# Missing datamodel: Gmail group-spoofing settings and configured action state	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	621	# Missing datamodel: Gmail external-recipient warning settings	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	641	# Missing datamodel: Gmail TLS compliance settings for inbound and outbound mail	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	661	# Missing datamodel: Google Chat external-spaces settings and allowlisted domains	COMMENT
LOW	cartography/rules/data/rules/cis_google_workspace.py	681	# Missing datamodel: Groups for Business creation-policy settings and external-member controls	COMMENT
69 more matches not shown…

Structural Annotation Overuse41 hits · 74 pts

Severity	File	Line	Snippet	Context
LOW⚡	…cartography/intel/aws/test_permission_relationships.py	79	# Step 1: Create AWS account	COMMENT
LOW⚡	…cartography/intel/aws/test_permission_relationships.py	82	# Step 2: Create S3 bucket resource (out of band to be quick and dirty)	COMMENT
LOW	…cartography/intel/aws/test_permission_relationships.py	93	# Step 3: Create IAM roles and policies using sync_roles	COMMENT
LOW	.agents/skills/audit-frameworks/SKILL.md	37	### Step 1: inventory	COMMENT
LOW	.agents/skills/audit-frameworks/SKILL.md	56	### Step 2: TODO triage	COMMENT
LOW	.agents/skills/audit-frameworks/SKILL.md	71	### Step 3: cross-provider to ontology candidates	COMMENT
LOW	.agents/skills/audit-frameworks/SKILL.md	91	### Step 4: duplicate detection	COMMENT
LOW	.agents/skills/audit-frameworks/SKILL.md	111	### Step 5: consolidation plan	COMMENT
LOW	.agents/skills/analysis-jobs/SKILL.md	37	### Step 1 - Pick global vs scoped	COMMENT
LOW	.agents/skills/analysis-jobs/SKILL.md	49	### Step 2 - Author the typed job	COMMENT
LOW	.agents/skills/analysis-jobs/SKILL.md	76	### Step 3 - Write the queries	COMMENT
LOW⚡	.agents/skills/analysis-jobs/SKILL.md	97	### Step 4 - Available parameters	COMMENT
LOW⚡	.agents/skills/analysis-jobs/SKILL.md	105	### Step 5 - Wire the call into your module	COMMENT
LOW	.agents/skills/analysis-jobs/SKILL.md	161	### Step 6 - Test it	COMMENT
LOW	.agents/skills/promote-ontology-relationship/SKILL.md	47	### Step 1: Identify the canonical pair and label	COMMENT
LOW	.agents/skills/promote-ontology-relationship/SKILL.md	51	### Step 2: Find which provider nodes carry each ontology label	COMMENT
LOW	.agents/skills/promote-ontology-relationship/SKILL.md	67	### Step 3: Find the direct edges to migrate	COMMENT
LOW	.agents/skills/promote-ontology-relationship/SKILL.md	80	### Step 4: Add the parallel canonical edge	COMMENT
LOW	.agents/skills/promote-ontology-relationship/SKILL.md	120	### Step 5: Add the constraint	COMMENT
LOW	.agents/skills/promote-ontology-relationship/SKILL.md	131	### Step 6: Run the guard, then whitelist remaining collisions	COMMENT
LOW⚡	.agents/skills/promote-ontology-relationship/SKILL.md	143	### Step 7: Update documentation	COMMENT
LOW⚡	.agents/skills/promote-ontology-relationship/SKILL.md	152	### Step 8: Decouple internal queries	COMMENT
LOW⚡	.agents/skills/promote-ontology-relationship/SKILL.md	160	### Step 9: Tests and verification	COMMENT
LOW	cartography/intel/microsoft/entra/applications.py	178	# Step 1: Sync applications	COMMENT
LOW	cartography/intel/cve_metadata/__init__.py	146	# Step 1: Get all CVE IDs from the graph — this is the authoritative list	COMMENT
LOW	cartography/intel/cve_metadata/__init__.py	176	# Step 2: Enrich and load one CVE year at a time to keep memory bounded.	COMMENT
LOW	cartography/intel/cve_metadata/__init__.py	222	# Step 4: Cleanup stale CVEMetadata nodes from previous syncs	COMMENT
LOW	cartography/intel/okta/users.py	318	# Step 1: Get all users who have role assignments (bulk API). This endpoint	COMMENT
LOW	cartography/intel/okta/users.py	341	# Step 2: For each user with roles, fetch their actual roles	COMMENT
LOW⚡	…y/rules/data/rules/policy_administration_privileges.py	30	// Step 1 - Collect (action, resource) pairs for allowed statements	COMMENT
LOW⚡	…y/rules/data/rules/policy_administration_privileges.py	37	// Step 2 - Gather all Deny statements for the same principal	COMMENT
LOW⚡	…y/rules/data/rules/policy_administration_privileges.py	41	// Step 3 - Filter out denied actions (handles , iam:, exact, and prefix wildcards)	COMMENT
LOW⚡	…y/rules/data/rules/policy_administration_privileges.py	48	// Step 4 - Aggregate one row per (account, principal, policy). Substitute a	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	24	// Step 1: Collect allowed actions that match IAM modification patterns	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	32	// Step 2: Collect deny statements for the same role	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	37	// Step 3: Compute effective = allows minus denies	COMMENT
LOW	…les/data/rules/workload_identity_admin_capabilities.py	52	// Step 4: Optional internet exposure context	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	117	// Step 1: Gather allowed actions that match IAM modification patterns	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	125	// Step 2: Gather all deny actions from the same role	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	129	// Step 3: Subtract Deny actions from Allow actions	COMMENT
LOW	…les/data/rules/workload_identity_admin_capabilities.py	144	// Step 4: Return only Lambdas with effective IAM modification capabilities	COMMENT

Excessive Try-Catch Wrapping59 hits · 57 pts

Severity	File	Line	Snippet	Context
LOW	demo/__main__.py	107	except Exception:	CODE
LOW	tests/unit/cartography/intel/workday/test_people.py	323	except Exception as e:	CODE
LOW	tests/unit/cartography/intel/workday/test_people.py	341	except Exception as e:	CODE
LOW	tests/unit/cartography/intel/workday/test_people.py	359	except Exception as e:	CODE
LOW	tests/unit/cartography/intel/trivy/test_scanner.py	221	except Exception as e:	CODE
LOW⚡	tests/unit/cartography/data/jobs/test_syntax.py	21	except Exception as e:	CODE
LOW⚡	tests/unit/cartography/data/jobs/test_syntax.py	34	except Exception as e:	CODE
LOW⚡	tests/unit/cartography/data/jobs/test_syntax.py	47	except Exception as e:	CODE
LOW	tests/integration/conftest.py	27	except Exception as exc: # pragma: no cover	CODE
LOW	tests/integration/cartography/data/jobs/test_syntax.py	34	except Exception as e:	CODE
LOW	tests/integration/cartography/data/jobs/test_syntax.py	48	except Exception as e:	CODE
LOW	tests/integration/cartography/data/jobs/test_syntax.py	70	except Exception as e:	CODE
LOW	…/skills/create-module/references/coding-conventions.md	27	except Exception:	CODE
LOW	cartography/sync.py	326	except Exception:	CODE
LOW	cartography/util.py	1054	except Exception as exc:	CODE
LOW	cartography/cli.py	424	except Exception as e:	CODE
LOW	cartography/intel/analysis.py	41	except Exception:	CODE
LOW	cartography/intel/supply_chain.py	583	except Exception as e:	CODE
LOW	cartography/intel/supply_chain.py	746	except Exception as e:	CODE
LOW	cartography/intel/gitlab/users.py	411	except Exception:	CODE
LOW	cartography/intel/gitlab/users.py	429	except Exception:	CODE
LOW	cartography/intel/gitlab/users.py	494	except Exception:	CODE
LOW	cartography/intel/gitlab/container_images.py	370	except Exception as e:	CODE
LOW	cartography/intel/gitlab/projects.py	54	except Exception as e:	CODE
LOW	cartography/intel/cve/feed.py	307	except Exception:	STRING
LOW	cartography/intel/azure/util/credentials.py	72	except Exception as e:	CODE
LOW	cartography/intel/azure/util/credentials.py	99	except Exception as e:	CODE
LOW	cartography/intel/microsoft/o365/license_details.py	46	except Exception:	CODE
LOW	cartography/intel/microsoft/o365/license_details.py	62	except Exception as e:	CODE
LOW	cartography/intel/microsoft/entra/service_principals.py	50	except Exception:	CODE
LOW	cartography/intel/microsoft/entra/service_principals.py	66	except Exception:	CODE
LOW	cartography/intel/microsoft/entra/users.py	128	except Exception:	CODE
LOW	cartography/intel/microsoft/entra/applications.py	56	except Exception:	CODE
LOW	cartography/intel/microsoft/entra/applications.py	72	except Exception:	CODE
LOW	cartography/intel/microsoft/entra/groups.py	223	except Exception:	CODE
LOW	cartography/intel/microsoft/entra/groups.py	294	except Exception:	CODE
LOW	cartography/intel/microsoft/entra/ou.py	48	except Exception:	CODE
LOW	…tography/intel/microsoft/entra/app_role_assignments.py	164	except Exception:	STRING
LOW	cartography/intel/gcp/cloud_sql_user.py	138	except Exception:	CODE
LOW	cartography/intel/gcp/iam.py	554	except Exception as e:	CODE
LOW	cartography/intel/gcp/cloud_sql_database.py	142	except Exception:	CODE
LOW	cartography/intel/gcp/vertex/models.py	139	except Exception as e:	CODE
LOW	cartography/intel/spacelift/__init__.py	52	except Exception as e:	CODE
LOW	cartography/intel/spacelift/ec2_ownership.py	96	except Exception as e:	CODE
LOW	cartography/intel/cve_metadata/nvd.py	197	except Exception:	CODE
LOW	cartography/intel/github/commits.py	198	except Exception:	STRING
LOW	cartography/intel/aws/iam.py	651	except Exception:	CODE
LOW	cartography/intel/aws/iam.py	1925	except Exception:	STRING
LOW	cartography/intel/aws/__init__.py	702	except Exception as e:	CODE
LOW	cartography/intel/aws/lambda_function.py	158	except Exception as error:	CODE
LOW	cartography/intel/aws/lambda_function.py	381	except Exception as error:	CODE
LOW	cartography/intel/aws/ecr_image_layers.py	354	except Exception:	CODE
LOW	cartography/intel/aws/sns.py	49	except Exception as e:	CODE
LOW	cartography/intel/kubernetes/util.py	258	except Exception as err:	CODE
LOW	cartography/intel/kubernetes/__init__.py	131	except Exception:	CODE
LOW	cartography/intel/trivy/scanner.py	342	except Exception as e:	CODE
LOW	cartography/intel/trivy/scanner.py	378	except Exception as exc:	CODE
LOW	cartography/intel/trivy/scanner.py	450	except Exception as e:	CODE
LOW	cartography/graph/job.py	242	except Exception as e:	CODE

Empty Error Handlers9 hits · 45 pts

Severity	File	Line	Snippet	Context
HIGH	…sts/unit/cartography/intel/gitlab/test_ci_variables.py	118	except requests.exceptions.HTTPError:	CODE
HIGH	…sts/unit/cartography/intel/gitlab/test_environments.py	133	except requests.exceptions.HTTPError:	CODE
HIGH	tests/unit/cartography/intel/gitlab/test_runners.py	94	except requests.exceptions.HTTPError:	CODE
HIGH	tests/unit/cartography/intel/gitlab/test_runners.py	116	except requests.exceptions.HTTPError:	CODE
HIGH	cartography/intel/gitlab/util.py	310	except ValueError:	CODE
HIGH	cartography/intel/gitlab/util.py	321	except ValueError:	CODE
HIGH	cartography/intel/gitlab/util.py	350	except ValueError:	CODE
HIGH	cartography/intel/github/util.py	119	except ValueError:	CODE
HIGH	cartography/intel/kubernetes/__init__.py	98	except ValueError:	CODE

Unused Imports45 hits · 44 pts

Severity	File	Line	Context
LOW	tests/unit/cartography/intel/okta/test_common.py	12	CODE
LOW	cartography/cli.py	16	CODE
LOW	cartography/intel/container_arch.py	1	CODE
LOW	cartography/intel/container_image_layers.py	1	CODE
LOW	cartography/intel/supply_chain.py	1	CODE
LOW	cartography/intel/container_image.py	1	CODE
LOW	cartography/intel/semgrep/ossfindings.py	1	CODE
LOW	cartography/intel/gcp/backendservice.py	4	CODE
LOW	cartography/intel/gcp/ssl_policy.py	3	CODE
LOW	cartography/intel/gcp/instancegroup.py	4	CODE
LOW	cartography/intel/gcp/target_https_proxy.py	3	CODE
LOW	cartography/intel/gcp/target_ssl_proxy.py	3	CODE
LOW	cartography/intel/gcp/cloud_armor.py	3	CODE
LOW	cartography/intel/gcp/compute.py	3	CODE
LOW	cartography/intel/common/report_reader_builder.py	14	CODE
LOW	cartography/intel/github/packages.py	19	CODE
LOW	cartography/intel/okta/authenticators.py	1	CODE
LOW	cartography/intel/okta/origins.py	1	CODE
LOW	cartography/intel/okta/users.py	2	CODE
LOW	cartography/intel/okta/factors.py	1	CODE
LOW	cartography/intel/okta/organization.py	1	CODE
LOW	cartography/intel/okta/applications.py	1	CODE
LOW	cartography/intel/okta/__init__.py	1	CODE
LOW	cartography/intel/okta/groups.py	1	CODE
LOW	cartography/intel/okta/common.py	1	CODE
LOW	cartography/intel/okta/log_streams.py	1	CODE
LOW	cartography/intel/okta/devices.py	1	CODE
LOW	cartography/intel/okta/policies.py	1	CODE
LOW	cartography/intel/okta/awssaml.py	1	CODE
LOW	cartography/intel/okta/network_zones.py	1	CODE
LOW	cartography/intel/okta/api_tokens.py	1	CODE
LOW	cartography/intel/entra/__init__.py	2	CODE
LOW	cartography/intel/zizmor/__init__.py	1	CODE
LOW	cartography/intel/ubuntu/util.py	1	CODE
LOW	cartography/graph/analysis.py	1	CODE
LOW	cartography/graph/analysisbuilder.py	3	CODE
LOW	cartography/models/schema_docs.py	1	CODE
LOW	cartography/models/introspection.py	1	CODE
LOW	cartography/models/aws_tagging.py	1	CODE
LOW	cartography/models/aibom/__init__.py	1	CODE
LOW	cartography/models/aibom/__init__.py	2	CODE
LOW	cartography/models/syft/__init__.py	1	CODE
LOW	cartography/models/orca/__init__.py	1	CODE
LOW	cartography/models/orca/__init__.py	2	CODE
LOW	cartography/models/orca/__init__.py	3	CODE

Verbosity Indicators17 hits · 32 pts

Severity	File	Line	Snippet	Context
LOW⚡	…cartography/intel/aws/test_permission_relationships.py	79	# Step 1: Create AWS account	COMMENT
LOW⚡	…cartography/intel/aws/test_permission_relationships.py	82	# Step 2: Create S3 bucket resource (out of band to be quick and dirty)	COMMENT
LOW	…cartography/intel/aws/test_permission_relationships.py	93	# Step 3: Create IAM roles and policies using sync_roles	COMMENT
LOW	cartography/intel/microsoft/entra/applications.py	178	# Step 1: Sync applications	COMMENT
LOW	cartography/intel/cve_metadata/__init__.py	146	# Step 1: Get all CVE IDs from the graph — this is the authoritative list	COMMENT
LOW	cartography/intel/cve_metadata/__init__.py	176	# Step 2: Enrich and load one CVE year at a time to keep memory bounded.	COMMENT
LOW	cartography/intel/cve_metadata/__init__.py	222	# Step 4: Cleanup stale CVEMetadata nodes from previous syncs	COMMENT
LOW	cartography/intel/okta/users.py	318	# Step 1: Get all users who have role assignments (bulk API). This endpoint	COMMENT
LOW	cartography/intel/okta/users.py	341	# Step 2: For each user with roles, fetch their actual roles	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	24	// Step 1: Collect allowed actions that match IAM modification patterns	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	32	// Step 2: Collect deny statements for the same role	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	37	// Step 3: Compute effective = allows minus denies	COMMENT
LOW	…les/data/rules/workload_identity_admin_capabilities.py	52	// Step 4: Optional internet exposure context	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	117	// Step 1: Gather allowed actions that match IAM modification patterns	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	125	// Step 2: Gather all deny actions from the same role	COMMENT
LOW⚡	…les/data/rules/workload_identity_admin_capabilities.py	129	// Step 3: Subtract Deny actions from Allow actions	COMMENT
LOW	…les/data/rules/workload_identity_admin_capabilities.py	144	// Step 4: Return only Lambdas with effective IAM modification capabilities	COMMENT

Redundant / Tautological Comments18 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	demo/__main__.py	47	# Check if the database is empty	COMMENT
LOW	…tography/intel/microsoft/entra/app_role_assignments.py	141	# Check if we have more pages to fetch	STRING
LOW	cartography/intel/gcp/vertex/instances.py	103	# Check if this location matches any of our supported prefixes	COMMENT
LOW	cartography/intel/ontology/utils.py	111	# Check if ontology nodes are used in mapping	COMMENT
LOW	cartography/intel/github/workflow_parser.py	114	# Check if pinned to a SHA	COMMENT
LOW	cartography/intel/github/util.py	751	# Check if this is a search endpoint (stricter limits)	COMMENT
LOW	cartography/intel/github/supply_chain.py	222	# Check if there are more pages	STRING
LOW	cartography/intel/github/repos.py	2021	# Set spec to `None` instead of empty string so that the Neo4j driver will leave the library.specifier field	COMMENT
LOW	cartography/intel/aws/iam.py	768	# Add this to list of federated nodes to create	STRING
LOW	cartography/intel/aws/ecr.py	166	# Check if this is a manifest list	COMMENT
LOW	cartography/intel/aws/ecr.py	258	# Check if this is a manifest list with images	COMMENT
LOW	cartography/intel/aws/ecr_image_layers.py	688	# Check if this is a manifest list	COMMENT
LOW	cartography/intel/aws/ecr_image_layers.py	1086	# Check if this is an attestation manifest	COMMENT
LOW	cartography/intel/workos/util.py	38	# Check if there's another page	COMMENT
LOW	cartography/intel/kubernetes/util.py	417	# Check if items exists on the response	COMMENT
LOW	cartography/intel/kubernetes/util.py	427	# Check if metadata exists on the response	COMMENT
LOW	cartography/intel/keycloak/clients.py	68	# Check if the client has a service account user	COMMENT
LOW	cartography/rules/runners.py	376	# Output results	COMMENT

Modern AI Meta-Vocabulary8 hits · 20 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	…egration/cartography/intel/aws/bedrock/test_bedrock.py	323	# Sync foundation models first (KB needs embedding model)	COMMENT
MEDIUM⚡	…egration/cartography/intel/aws/bedrock/test_bedrock.py	406	# Sync guardrails (target nodes must exist)	COMMENT
MEDIUM	cartography/intel/aws/bedrock/__init__.py	115	# Sync guardrails	COMMENT
MEDIUM	cartography/intel/aws/bedrock/__init__.py	138	# Sync agents (after KBs, foundation models, custom models, and guardrails)	COMMENT
MEDIUM	cartography/intel/aws/bedrock/guardrails.py	127	# Fetch guardrails from AWS	COMMENT
MEDIUM	cartography/intel/aws/bedrock/knowledge_bases.py	152	# Extract embedding model ARN - it's already in the right format	COMMENT
MEDIUM	cartography/models/netlify/site.py	135	# Deploy guardrails.	COMMENT
MEDIUM	cartography/models/aws/bedrock/guardrail.py	92	Representation of an AWS [Bedrock Guardrail](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html).	STRING

AI Slop Vocabulary7 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	tests/unit/cartography/intel/kubernetes/test_eks.py	96	# The usernames are still ingested; the null groups simply add nothing.	STRING
MEDIUM	tests/data/aws/lambda_function.py	454	# Mock functions for comprehensive sync test	COMMENT
MEDIUM	cartography/intel/socketdev/dependencies.py	79	# Build a PURL to leverage full normalization including namespace	COMMENT
LOW	cartography/intel/databricks/grants.py	251	# decide; non-matching rows simply create no edge.	STRING
LOW	cartography/intel/databricks/permissions.py	301	# decide; non-matching rows simply create no edge.	STRING
MEDIUM	cartography/models/modal/domain.py	136	"""Represents a DNS record Modal asks you to create in order to validate a custom domain. Deliberately not label	STRING
MEDIUM⚡	cartography/rules/data/rules/cis_google_workspace.py	636	# Missing datamodel: Gmail compliance settings for comprehensive mail storage	STRING

AI Structural Patterns6 hits · 5 pts

Severity	File	Line	Context
LOW	…unit/cartography/intel/gitlab/test_container_images.py	14	CODE
LOW	tests/unit/cartography/intel/github/test_repos.py	35	CODE
LOW	cartography/config.py	562	CODE
LOW	cartography/cli.py	457	CODE
LOW	cartography/intel/github/util.py	228	CODE
LOW	cartography/rules/cli.py	328	CODE

Magic Placeholder Names1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	docs/root/modules/jumpcloud/config.md	18	export JUMPCLOUD_API_KEY="your-api-key"	CODE

Dead Code2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	…graphy/intel/microsoft/entra/test_error_propagation.py	163		CODE
MEDIUM	…cartography/intel/aws/inspector/test_inspector_sync.py	299		CODE

Maintenance and Governance Review

Risk Review · v3

What These Metrics Mean

Pattern-Signal History

Severity Breakdown

Directory Score Breakdown

Pattern Findings