3.5

Adjusted Signal

3.5

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

14.7K

Stars

Language

294.5K

Lines of Code

1.3K

Files

1.0K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 15.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 977 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.7/100 · LOW

Are imports declared and package/API names verified? 35 finding(s).

Agent Over-Engineering Ratio 1.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 80 finding(s).

PR Review Velocity Impact 15.9/100 · LOW

Which changes need focused human review? 1014 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 2LOW 1012

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1014 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block898 hits · 898 pts

Severity	File	Line	Snippet	Context
LOW	main.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/theme_filter.go	1	// Copyright 2025 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/branding.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/auto_signin_filter.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/mcp_util.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/cors_filter.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/uploaded_file_filter.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/uploaded_file_filter.go	61		COMMENT
LOW	routers/uploaded_file_filter.go	81	// - "sandbox" puts the document in an opaque origin and, without	COMMENT
LOW	routers/authz_filter.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/static_filter.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/lightweight_auth_filter.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/static_filter_util.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/record.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/request_body_filter.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/base_path.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/session_provider.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/timeout_filter.go	1	// Copyright 2024 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/base.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/forward_auth_filter.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/content_type_filter.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/frontend_cdn.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/router.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	routers/field_validation_filter.go	1	// Copyright 2025 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	faceId/provider.go	1	// Copyright 2025 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	faceId/provider_test.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	faceId/aliyun.go	1	// Copyright 2025 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	faceId/local_uniface.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	faceId/local_uniface_test.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/okta.go	1	// Copyright 2022 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/provider.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/kwai.go	1	// Copyright 2024 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/custom.go	1	// Copyright 2022 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/dingtalk.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/wecom_internal.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/infoflow_internal.go	1	// Copyright 2022 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/oidc.go	1	// Copyright 2026 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/qq.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/qq.go	101	// "city": "安道尔城",	COMMENT
LOW	idp/google.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/alipay.go	1	// Copyright 2022 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/douyin.go	1	// Copyright 2022 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/lark.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/telegram.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/gitlab.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/adfs.go	1	// Copyright 2022 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/linkedin.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/bilibili.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/wecom_third_party.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/twitter.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/twitter.go	121	//{	COMMENT
LOW	idp/azuread_b2c.go	1	// Copyright 2023 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/weibo.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/wechat.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/wechat.go	161	}	COMMENT
LOW	idp/facebook.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/facebook.go	101	token := oauth2.Token{	COMMENT
LOW	idp/wechat_mobile.go	1	// Copyright 2025 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/wechat_miniprogram.go	1	// Copyright 2022 The Casdoor Authors. All Rights Reserved.	COMMENT
LOW	idp/gitee.go	1	// Copyright 2021 The Casdoor Authors. All Rights Reserved.	COMMENT
838 more matches not shown…

Hyper-Verbose Identifiers78 hits · 78 pts

Severity	File	Line	Snippet	Context
LOW	web-old/craco.config.js	74	function ignoreSourcemapsloaderWarnings(warning) {	CODE
LOW	web-old/public/ProviderHintRedirect.js	48	function isProviderVisibleForSignIn(providerItem) {	CODE
LOW	web-old/public/AuthCallbackHandler.js	47	function storeReactFallbackPayload(payload) {	CODE
LOW	web-old/src/Setting.js	796	export function isProviderVisibleForSignUp(providerItem) {	CODE
LOW	web-old/src/Setting.js	804	export function isProviderVisibleForSignIn(providerItem) {	CODE
LOW	web-old/src/Setting.js	820	export function getAllPromptedProviderItems(application) {	CODE
LOW	web-old/src/Setting.js	824	export function getAllPromptedSignupItems(application) {	CODE
LOW	web-old/src/Setting.js	1566	export function getCryptoAlgorithmOptions(cryptoAlgorithm) {	CODE
LOW	web-old/src/Setting.js	1904	export function getApplicationDisplayName(application) {	CODE
LOW	web-old/src/Setting.js	1961	export function isDefaultOrganizationSelected(account) {	CODE
LOW	web-old/src/Setting.js	2185	export function getDefaultHtmlEmailContent() {	CODE
LOW	web-old/src/Setting.js	2228	export function getDefaultInvitationHtmlEmailContent() {	CODE
LOW	web-old/src/ProviderEditPage.js	47	function isDefaultProviderDisplayName(displayName) {	CODE
LOW	web-old/src/ProviderEditPage.js	61	function getAutoProviderDisplayName(category, type, subType) {	CODE
LOW	web-old/src/OpenClawSessionGraphViewer.js	234	function OpenClawSessionGraphCanvas(props) {	CODE
LOW	web-old/src/OpenClawSessionGraphUtils.js	20	function parseOpenClawBehaviorPayload(message) {	CODE
LOW	web-old/src/OpenClawSessionGraphUtils.js	209	export function formatOpenClawSessionGraphTimestamp(timestamp) {	CODE
LOW	web-old/src/OpenClawSessionGraphUtils.js	409	export function buildOpenClawFlowElements(graph) {	CODE
LOW	web-old/src/auth/Util.js	222	export async function WechatOfficialAccountModal(application, provider, method) {	CODE
LOW	web-old/src/auth/Web3Auth.js	133	export function checkEthereumSignedTypedData(token) {	CODE
LOW	web-old/src/auth/GoogleLoginButton.js	35	export function GoogleOneTapLoginVirtualButton(prop) {	CODE
LOW	web-old/src/auth/Obfuscator.js	18	export function getRandomKeyForObfuscator(obfuscatorType) {	CODE
LOW	web-old/src/auth/Obfuscator.js	62	export function encryptByPasswordObfuscator(passwordObfuscatorType, passwordObfuscatorKey, password) {	CODE
LOW	web-old/src/provider/LogProviderFields.js	22	function getStorageProviderOptions(providers, owner) {	CODE
LOW	web-old/src/provider/IDVerificationProviderFields.js	21	export function renderIDVerificationProviderFields(provider, updateProviderField) {	CODE
LOW	web-old/src/provider/StorageProviderFields.js	21	export function renderStorageProviderFields(provider, updateProviderField) {	CODE
LOW	web-old/src/provider/EmailProviderFields.js	26	export function renderEmailProviderFields(provider, updateProviderField, renderEmailMappingInput, account) {	CODE
LOW	web-old/src/provider/OAuthProviderFields.js	24	export function renderOAuthProviderFields(provider, updateProviderField, renderUserMappingInput, certs = []) {	CODE
LOW	web-old/src/provider/CaptchaProviderFields.js	21	export function renderCaptchaProviderFields(provider, providerName) {	CODE
LOW	web-old/src/provider/NotificationProviderFields.js	24	export function renderNotificationProviderFields(provider, updateProviderField, getReceiverRow) {	CODE
LOW	web-old/src/provider/PaymentProviderFields.js	23	export function renderPaymentProviderFields(provider, updateProviderField, certs) {	CODE
LOW	web-old/src/provider/FaceIDProviderFields.js	21	export function renderFaceIdProviderFields(provider, updateProviderField) {	CODE
LOW	web-old/src/backend/ApplicationBackend.js	27	export function getApplicationsByOrganization(owner, organization, page = "", pageSize = "", field = "", value = "", sor	CODE
LOW	web-old/src/backend/UserWebauthnBackend.js	17	export function registerWebauthnCredential() {	CODE
LOW	web-old/src/backend/UserWebauthnBackend.js	64	export function deleteUserWebAuthnCredential(credentialID) {	CODE
LOW	web-old/src/backend/EntryBackend.js	38	export function getOpenClawSessionTranscriptUrl(owner, name) {	CODE
LOW	web-old/src/backend/EntryBackend.js	42	export function getOpenClawSessionTranscript(owner, name) {	CODE
LOW	web-old/src/backend/PermissionBackend.js	27	export function getPermissionsBySubmitter() {	CODE
LOW	web-old/src/table/TransactionTableColumns.js	22	export function getTransactionTableColumns(options = {}) {	CODE
LOW	web/public/ProviderHintRedirect.js	63	function isProviderVisibleForSignIn(providerItem) {	CODE
LOW	web/public/AuthCallbackHandler.js	65	function storeReactFallbackPayload(payload) {	CODE
LOW	web/src/auth/Obfuscator.ts	18	export function getRandomKeyForObfuscator(obfuscatorType) {	CODE
LOW	web/src/auth/Obfuscator.ts	62	export function encryptByPasswordObfuscator(passwordObfuscatorType, passwordObfuscatorKey, password) {	CODE
LOW	web/src/backend/UserWebauthnBackend.ts	17	export function registerWebauthnCredential() {	CODE
LOW	web/src/backend/UserWebauthnBackend.ts	64	export function deleteUserWebAuthnCredential(credentialID) {	CODE
LOW	web/src/backend/PermissionBackend.ts	27	export function getPermissionsBySubmitter() {	CODE
LOW	web/src/backend/EntryBackend.ts	38	export function getOpenClawSessionTranscriptUrl(owner, name) {	CODE
LOW	web/src/backend/EntryBackend.ts	42	export function getOpenClawSessionTranscript(owner, name) {	CODE
LOW	web/src/backend/ApplicationBackend.ts	27	export function getApplicationsByOrganization(owner, organization, page: any = "", pageSize: any = "", field: any = "",	CODE
LOW	web/src/components/entry/OpenClawSessionGraphViewer.tsx	341	export function OpenClawSessionGraphViewer({entry, provider}: ViewerProps) {	CODE
LOW	…b/src/components/common/FaceRecognitionCommonModal.tsx	64	export function FaceRecognitionCommonModal({visible, onOk, onCancel}: FaceRecognitionCommonModalProps) {	CODE
LOW	web/src/components/common/Loading.tsx	5	function alignSpinToDocumentTimeline(element: Element \| null) {	CODE
LOW	…omponents/application/ApplicationAuthenticationTab.tsx	10	export function ApplicationAuthenticationTab({application, updateField}: ApplicationTabProps) {	CODE
LOW	web/src/components/application/ApplicationPreview.tsx	26	export function ApplicationSignupSigninPreview({application}: {application: any}) {	CODE
LOW	…mponents/application/ApplicationUiCustomizationTab.tsx	50	function getDefaultSigninMethodRule(name: string): string {	CODE
LOW	…mponents/application/ApplicationUiCustomizationTab.tsx	203	export function ApplicationUiCustomizationTab({application, updateField}: ApplicationTabProps) {	CODE
LOW	…/components/application/ApplicationReverseProxyTab.tsx	18	export function ApplicationReverseProxyTab({application, updateField, certs}: ApplicationReverseProxyTabProps) {	CODE
LOW	web/src/hooks/use-application-chrome.ts	174	export function getOrganizationCookieChrome() {	CODE
LOW	web/src/lib/openclaw-graph.ts	29	function parseOpenClawBehaviorPayload(message: any) {	CODE
LOW	web/src/lib/openclaw-graph.ts	218	export function formatOpenClawSessionGraphTimestamp(timestamp: any): string {	CODE
18 more matches not shown…

Fake / Example Data35 hits · 40 pts

Severity	File	Line	Snippet	Context
LOW	idp/okta.go	141	"name" :"John Doe",	CODE
LOW	idp/casdoor.go	103	"email": "admin@example.com",	CODE
LOW⚡	util/string_test.go	101	{"Should be return lorem_ipsum", "Lorem Ipsum", "lorem_ipsum"},	CODE
LOW⚡	util/string_test.go	102	{"Should be return Lorem Ipsum", "lorem Ipsum", "lorem_ipsum"},	CODE
LOW⚡	util/string_test.go	103	{"Should be return lorem_ipsum", "lorem ipsum", "loremipsum"},	CODE
LOW	util/string_test.go	145	{"Scenery three", []string{"test", "lorem ipsum"}, "test/lorem ipsum"},	CODE
LOW	util/string_test.go	163	{"Scenery three", "lorem ipsum", "80a751fde577028640c419000e33eba6"},	CODE
LOW	swagger/swagger-ui.js	2	!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t():"function"==typeof define&&define.am	CODE
LOW	swagger/swagger-ui-es-bundle-core.js	2	module.exports=function(e){var t={};function n(r){if(t[r])return t[r].exports;var a=t[r]={i:r,l:!1,exports:{}};return e[	CODE
LOW	swagger/swagger.json	9173	"placeholder": {	CODE
LOW	swagger/swagger.json	9218	"placeholder": {	CODE
LOW	swagger/swagger-ui-standalone-preset.js	2	!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.am	CODE
LOW	web-old/src/WebhookEditPage.js	72	"email": "admin@example.com",	CODE
LOW⚡	web-old/src/table/SigninTable.js	232	dataIndex: "placeholder",	CODE
LOW⚡	web-old/src/table/SigninTable.js	233	key: "placeholder",	CODE
LOW⚡	web-old/src/table/SigninTable.js	242	this.updateField(table, index, "placeholder", e.target.value);	CODE
LOW⚡	web-old/src/table/SignupTable.js	284	dataIndex: "placeholder",	CODE
LOW⚡	web-old/src/table/SignupTable.js	285	key: "placeholder",	CODE
LOW⚡	web-old/src/table/SignupTable.js	294	this.updateField(table, index, "placeholder", e.target.value);	CODE
LOW	…mponents/application/ApplicationUiCustomizationTab.tsx	345	key: "placeholder",	CODE
LOW	…mponents/application/ApplicationUiCustomizationTab.tsx	482	key: "placeholder",	CODE
LOW	web/src/lib/webhook-preview.ts	50	"email": "admin@example.com",	CODE
LOW	object/syncer_googleworkspace_test.go	33	FullName: "John Doe",	CODE
LOW	object/syncer_googleworkspace_test.go	55	if originalUser.DisplayName != "John Doe" {	CODE
LOW	object/syncer_googleworkspace_test.go	56	t.Errorf("Expected DisplayName to be 'John Doe', got '%s'", originalUser.DisplayName)	CODE
LOW	object/syncer_googleworkspace_test.go	79	FullName: "Jane Doe",	CODE
LOW	object/syncer_googleworkspace_test.go	166	Host: "admin@example.com",	CODE
LOW	object/application.go	60	Placeholder string `json:"placeholder"`	CODE
LOW	object/application.go	71	Placeholder string `json:"placeholder"`	CODE
LOW	object/init.go	185	Email: "admin@example.com",	CODE
LOW	object/syncer_scim_test.go	35	DisplayName: "John Doe",	CODE
LOW	object/syncer_scim_test.go	39	Formatted: "John Doe",	CODE
LOW	object/syncer_scim_test.go	54	StreetAddress: "123 Main St",	CODE
LOW	object/syncer_scim_test.go	78	if originalUser.DisplayName != "John Doe" {	CODE
LOW	object/syncer_scim_test.go	79	t.Errorf("Expected DisplayName to be 'John Doe', got '%s'", originalUser.DisplayName)	CODE

Decorative Section Separators2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	object/device_auth_store.go	92	// ── in-memory implementation (default) ──────────────────────────────────────	COMMENT
MEDIUM	object/device_auth_store.go	104	// ── Redis implementation ─────────────────────────────────────────────────────	COMMENT

Verbosity Indicators1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	object/saml_sp.go	256	// block.Bytes are DER encoded so the following code block should happily accept it	COMMENT

casdoor/casdoor

Open-Source Code Quality, Security and Technical Debt Review