AI Slop Code Risk Monitor

centrifugal/centrifugo

SlopCodeMonitor badge for centrifugal/centrifugo Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Scalable real-time messaging server in a language-agnostic way. Self-hosted alternative to Pubnub, Pusher, Ably, socket.io, Phoenix.PubSub, SignalR. Set up once and forever.

1.5 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for centrifugal/centrifugo, a Go project with 10,940 GitHub stars. SynthScan examined 111,288 lines of code across 474 source files, recording 149 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 1.5 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.5
Adjusted Signal
1.5
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
10.9K
Stars
Go
Language
111.3K
Lines of Code
474
Files
149
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 149 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2 finding(s).

PR Review Velocity Impact 6.9/100 · LOW

Which changes need focused human review? 149 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 5LOW 144

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 149 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block132 hits · 132 pts
SeverityFileLineSnippetContext
LOWmain.go1// Copyright (c) Centrifugal Labs LTDCOMMENT
LOWmisc/packaging/initd.sh1#! /usr/bin/env bashCOMMENT
LOWmisc/scripts/test_packages.sh1#!/usr/bin/env bashCOMMENT
LOWmisc/scripts/release_preflight.sh1#!/bin/shCOMMENT
LOWinternal/jwtverify/token_verifier.go21 // Info contains additional information about connection. It will beCOMMENT
LOWinternal/jwtverify/token_verifier_jwt_test.go41 // Generated with: https://github.com/lestrrat-go/jwx/tree/main/cmd/jwxCOMMENT
LOWinternal/jwtverify/token_verifier_jwt_test.go121COMMENT
LOWinternal/jwtverify/token_verifier_jwt.go201 // to manually track its position inside a stream.COMMENT
LOWinternal/middleware/auththrottle.go101}COMMENT
LOWinternal/websocket/server.go21COMMENT
LOWinternal/websocket/server.go41 // is not set, then write buffers are allocated to the connection for theCOMMENT
LOWinternal/websocket/server.go61 Error func(w http.ResponseWriter, r *http.Request, status int, reason error)COMMENT
LOWinternal/websocket/client.go41 // NetDialTLSContext is nil, NetDialContext is used.COMMENT
LOWinternal/websocket/client.go61 // is not set, then write buffers are allocated to the connection for theCOMMENT
LOWinternal/websocket/util.go241 }COMMENT
LOWinternal/websocket/doc.go1// Copyright 2013 The Gorilla WebSocket Authors. All rights reserved.COMMENT
LOWinternal/websocket/conn.go841 if mask != c.isServer {COMMENT
LOWinternal/pgschema/pgschema.go61// a PostgreSQL identifier. Every table, index and function name is this prefixCOMMENT
LOWinternal/pgschema/pgschema.go141//COMMENT
LOWinternal/pgschema/pgschema.go161// nodes running the same idempotent schema DDL at the same time. That is theCOMMENT
LOWinternal/pgschema/pgschema.go201 schemaExecBaseBackoff = 100 * time.MillisecondCOMMENT
LOWinternal/pgschema/pgschema.go261// All variants run in one transaction; a failure on any rolls back everyCOMMENT
LOWinternal/pgschema/pgschema.go321 }COMMENT
LOWinternal/pgstreambroker/pgstreambroker_test.go121 fmt.Sprintf("DROP TABLE IF EXISTS %sshard_lock CASCADE", prefix),COMMENT
LOWinternal/pgstreambroker/pgstreambroker_test.go1041// TestPostgresStreamBroker_PartitionRetention_LookaheadAndDrop verifies thatCOMMENT
LOWinternal/pgstreambroker/pgstreambroker.go1// Package pgstreambroker implements centrifuge.Broker using PostgreSQL asCOMMENT
LOWinternal/pgstreambroker/pgstreambroker.go201 // TLS is an optional TLS configuration applied to all pools (primary,COMMENT
LOWinternal/pgstreambroker/pgstreambroker.go221COMMENT
LOWinternal/pgstreambroker/pgstreambroker.go241 StreamRetention time.DurationCOMMENT
LOWinternal/pgstreambroker/pgstreambroker.go261 // Default: same as PoolSize.COMMENT
LOWinternal/pgstreambroker/outbox.go61}COMMENT
LOWinternal/pgstreambroker/ensure_schema.go121// atomic schema_version bump.COMMENT
LOWinternal/pgmapbroker/pgmapbroker_test.go1761 return existsCOMMENT
LOWinternal/pgmapbroker/pgmapbroker.go41// EnsureSchema renders the template once per variant (jsonb + binary) andCOMMENT
LOWinternal/pgmapbroker/pgmapbroker.go121 return sql[:i], sql[i:]COMMENT
LOWinternal/pgmapbroker/pgmapbroker.go261 // TLS is an optional TLS configuration applied to all pools (primary,COMMENT
LOWinternal/pgmapbroker/pgmapbroker.go281COMMENT
LOWinternal/pgmapbroker/pgmapbroker.go301 // and their cf_binary_map_* counterparts for the binary data variant.COMMENT
LOWinternal/pgmapbroker/pgmapbroker.go321 // NotifyDSN is an optional separate connection string used exclusively forCOMMENT
LOWinternal/pgmapbroker/pgmapbroker.go341 // When set, outbox workers use advisory locks (one worker per shard acrossCOMMENT
LOWinternal/pgmapbroker/pgmapbroker.go681// This method is safe to call concurrently from multiple nodes — all DDLCOMMENT
LOWinternal/pgmapbroker/pgmapbroker.go821 // variants (jsonb + binary) are created by separate Exec calls, so aCOMMENT
LOWinternal/pgmapbroker/pgmapbroker.go861 // (a) Migrations before DDL because the DDL template (`schema.sql`)COMMENT
LOWinternal/pgmapbroker/pgmapbroker.go2261}COMMENT
LOWinternal/config/config.go21)COMMENT
LOWinternal/config/config.go41 // presence information storage and retrieval. By default, memory PresenceManager is used. MemoryCOMMENT
LOWinternal/config/config.go81 // WebTransport is a configuration for WebTransport transport. EXPERIMENTAL.COMMENT
LOWinternal/config/envconfig/doc.go1// Copyright (c) 2013 Kelsey Hightower. All rights reserved.COMMENT
LOWinternal/config/envconfig/envconfig_test.go801}COMMENT
LOWinternal/redisqueue/consumer.go21// and process Messages.COMMENT
LOWinternal/redisqueue/consumer.go41 VisibilityTimeout time.DurationCOMMENT
LOWinternal/proxyproto/proxy_grpc.pb.go41// CentrifugoProxy is the service an application backend implements to receiveCOMMENT
LOWinternal/proxyproto/proxy_grpc.pb.go61 Publish(ctx context.Context, in *PublishRequest, opts ...grpc.CallOption) (*PublishResponse, error)COMMENT
LOWinternal/proxyproto/proxy_grpc.pb.go241 return out, nilCOMMENT
LOWinternal/proxyproto/proxy_grpc.pb.go261 // Refresh is called when a connection is about to expire, to decide whetherCOMMENT
LOWinternal/proxyproto/proxy_grpc.pb.go281 // always contains SubscribeRequest, then StreamSubscribeRequest will contain data publishedCOMMENT
LOWinternal/proxyproto/proxy.pb.go381 // b64info is info in base64, for binary info.COMMENT
LOWinternal/proxyproto/proxy.pb.go501 ExpireAt int64 `protobuf:"varint,2,opt,name=expire_at,json=expireAt,proto3" json:"expire_at,omitempty"`COMMENT
LOWinternal/proxyproto/proxy.pb.go1041 // protocol is the client protocol: "json" or "protobuf".COMMENT
LOWinternal/proxyproto/proxy.pb.go1661 // b64data is data in base64, for binary data.COMMENT
72 more matches not shown…
AI Slop Vocabulary4 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUMinternal/jwtverify/token_verifier_jwt.go36 // this key, enabling seamless key rotation without mass disconnects.COMMENT
MEDIUMinternal/config/config.go36 // data stored in memory (thus lost after node restart). Redis Broker provides seamless horizontalCOMMENT
MEDIUMinternal/config/config.go42 // PresenceManager is superfast, but it's not distributed. Redis PresenceManager provides a seamlessCOMMENT
MEDIUMinternal/uniws/handler.go20// communication. Here we utilize only one direction - giving users an additionalCOMMENT
Redundant / Tautological Comments5 hits · 8 pts
SeverityFileLineSnippetContext
LOWmisc/redis_instances/start_instances.sh62# Check if the number of masters and replicas is providedCOMMENT
LOWmisc/packaging/initd.sh122 # Check if config file existCOMMENT
LOWmisc/packaging/initd.sh174# Check if daemon is a recognized program and get absolute path.COMMENT
LOWmisc/redis_cluster/create_cluster.sh89# Check if the number of masters and replicas is providedCOMMENT
LOWmisc/nats_cluster/create_cluster.sh59# Check if the number of nodes is providedCOMMENT
Verbosity Indicators2 hits · 4 pts
SeverityFileLineSnippetContext
LOW⚡…ternal/jwtverify/token_verifier_jwt_jwks_scope_test.go64 // Step 1: Legitimate tenant-A token primes tenant A's key in the cache.COMMENT
LOW⚡…ternal/jwtverify/token_verifier_jwt_jwks_scope_test.go71 // Step 2: Forged tenant-B token (signed by tenant A) must be rejected.COMMENT
Structural Annotation Overuse2 hits · 4 pts
SeverityFileLineSnippetContext
LOW⚡…ternal/jwtverify/token_verifier_jwt_jwks_scope_test.go64 // Step 1: Legitimate tenant-A token primes tenant A's key in the cache.COMMENT
LOW⚡…ternal/jwtverify/token_verifier_jwt_jwks_scope_test.go71 // Step 2: Forged tenant-B token (signed by tenant A) must be rejected.COMMENT
Self-Referential Comments1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMmisc/redis_cluster/create_cluster.sh73 # Create the cluster with replicasCOMMENT
Hyper-Verbose Identifiers2 hits · 2 pts
SeverityFileLineSnippetContext
LOWinternal/cli/configdoc/template.html1109 function generateFullContextConfig(targetField, format = 'json') {CODE
LOWinternal/cli/configdoc/template.html1445 function setupIntersectionObserver() {CODE
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWmisc/scripts/update-deps.sh4# Usage:COMMENT