Scalable real-time messaging server in a language-agnostic way. Self-hosted alternative to Pubnub, Pusher, Ably, socket.io, Phoenix.PubSub, SignalR. Set up once and forever.
This report summarizes scanner evidence for centrifugal/centrifugo, a Go project with 10,940 GitHub stars. SynthScan examined 111,288 lines of code across 474 source files, recording 149 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 1.5 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 149 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 2 finding(s).
Which changes need focused human review? 149 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 149 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | main.go | 1 | // Copyright (c) Centrifugal Labs LTD | COMMENT |
| LOW | misc/packaging/initd.sh | 1 | #! /usr/bin/env bash | COMMENT |
| LOW | misc/scripts/test_packages.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | misc/scripts/release_preflight.sh | 1 | #!/bin/sh | COMMENT |
| LOW | internal/jwtverify/token_verifier.go | 21 | // Info contains additional information about connection. It will be | COMMENT |
| LOW | internal/jwtverify/token_verifier_jwt_test.go | 41 | // Generated with: https://github.com/lestrrat-go/jwx/tree/main/cmd/jwx | COMMENT |
| LOW | internal/jwtverify/token_verifier_jwt_test.go | 121 | COMMENT | |
| LOW | internal/jwtverify/token_verifier_jwt.go | 201 | // to manually track its position inside a stream. | COMMENT |
| LOW | internal/middleware/auththrottle.go | 101 | } | COMMENT |
| LOW | internal/websocket/server.go | 21 | COMMENT | |
| LOW | internal/websocket/server.go | 41 | // is not set, then write buffers are allocated to the connection for the | COMMENT |
| LOW | internal/websocket/server.go | 61 | Error func(w http.ResponseWriter, r *http.Request, status int, reason error) | COMMENT |
| LOW | internal/websocket/client.go | 41 | // NetDialTLSContext is nil, NetDialContext is used. | COMMENT |
| LOW | internal/websocket/client.go | 61 | // is not set, then write buffers are allocated to the connection for the | COMMENT |
| LOW | internal/websocket/util.go | 241 | } | COMMENT |
| LOW | internal/websocket/doc.go | 1 | // Copyright 2013 The Gorilla WebSocket Authors. All rights reserved. | COMMENT |
| LOW | internal/websocket/conn.go | 841 | if mask != c.isServer { | COMMENT |
| LOW | internal/pgschema/pgschema.go | 61 | // a PostgreSQL identifier. Every table, index and function name is this prefix | COMMENT |
| LOW | internal/pgschema/pgschema.go | 141 | // | COMMENT |
| LOW | internal/pgschema/pgschema.go | 161 | // nodes running the same idempotent schema DDL at the same time. That is the | COMMENT |
| LOW | internal/pgschema/pgschema.go | 201 | schemaExecBaseBackoff = 100 * time.Millisecond | COMMENT |
| LOW | internal/pgschema/pgschema.go | 261 | // All variants run in one transaction; a failure on any rolls back every | COMMENT |
| LOW | internal/pgschema/pgschema.go | 321 | } | COMMENT |
| LOW | internal/pgstreambroker/pgstreambroker_test.go | 121 | fmt.Sprintf("DROP TABLE IF EXISTS %sshard_lock CASCADE", prefix), | COMMENT |
| LOW | internal/pgstreambroker/pgstreambroker_test.go | 1041 | // TestPostgresStreamBroker_PartitionRetention_LookaheadAndDrop verifies that | COMMENT |
| LOW | internal/pgstreambroker/pgstreambroker.go | 1 | // Package pgstreambroker implements centrifuge.Broker using PostgreSQL as | COMMENT |
| LOW | internal/pgstreambroker/pgstreambroker.go | 201 | // TLS is an optional TLS configuration applied to all pools (primary, | COMMENT |
| LOW | internal/pgstreambroker/pgstreambroker.go | 221 | COMMENT | |
| LOW | internal/pgstreambroker/pgstreambroker.go | 241 | StreamRetention time.Duration | COMMENT |
| LOW | internal/pgstreambroker/pgstreambroker.go | 261 | // Default: same as PoolSize. | COMMENT |
| LOW | internal/pgstreambroker/outbox.go | 61 | } | COMMENT |
| LOW | internal/pgstreambroker/ensure_schema.go | 121 | // atomic schema_version bump. | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker_test.go | 1761 | return exists | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 41 | // EnsureSchema renders the template once per variant (jsonb + binary) and | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 121 | return sql[:i], sql[i:] | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 261 | // TLS is an optional TLS configuration applied to all pools (primary, | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 281 | COMMENT | |
| LOW | internal/pgmapbroker/pgmapbroker.go | 301 | // and their cf_binary_map_* counterparts for the binary data variant. | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 321 | // NotifyDSN is an optional separate connection string used exclusively for | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 341 | // When set, outbox workers use advisory locks (one worker per shard across | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 681 | // This method is safe to call concurrently from multiple nodes — all DDL | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 821 | // variants (jsonb + binary) are created by separate Exec calls, so a | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 861 | // (a) Migrations before DDL because the DDL template (`schema.sql`) | COMMENT |
| LOW | internal/pgmapbroker/pgmapbroker.go | 2261 | } | COMMENT |
| LOW | internal/config/config.go | 21 | ) | COMMENT |
| LOW | internal/config/config.go | 41 | // presence information storage and retrieval. By default, memory PresenceManager is used. Memory | COMMENT |
| LOW | internal/config/config.go | 81 | // WebTransport is a configuration for WebTransport transport. EXPERIMENTAL. | COMMENT |
| LOW | internal/config/envconfig/doc.go | 1 | // Copyright (c) 2013 Kelsey Hightower. All rights reserved. | COMMENT |
| LOW | internal/config/envconfig/envconfig_test.go | 801 | } | COMMENT |
| LOW | internal/redisqueue/consumer.go | 21 | // and process Messages. | COMMENT |
| LOW | internal/redisqueue/consumer.go | 41 | VisibilityTimeout time.Duration | COMMENT |
| LOW | internal/proxyproto/proxy_grpc.pb.go | 41 | // CentrifugoProxy is the service an application backend implements to receive | COMMENT |
| LOW | internal/proxyproto/proxy_grpc.pb.go | 61 | Publish(ctx context.Context, in *PublishRequest, opts ...grpc.CallOption) (*PublishResponse, error) | COMMENT |
| LOW | internal/proxyproto/proxy_grpc.pb.go | 241 | return out, nil | COMMENT |
| LOW | internal/proxyproto/proxy_grpc.pb.go | 261 | // Refresh is called when a connection is about to expire, to decide whether | COMMENT |
| LOW | internal/proxyproto/proxy_grpc.pb.go | 281 | // always contains SubscribeRequest, then StreamSubscribeRequest will contain data published | COMMENT |
| LOW | internal/proxyproto/proxy.pb.go | 381 | // b64info is info in base64, for binary info. | COMMENT |
| LOW | internal/proxyproto/proxy.pb.go | 501 | ExpireAt int64 `protobuf:"varint,2,opt,name=expire_at,json=expireAt,proto3" json:"expire_at,omitempty"` | COMMENT |
| LOW | internal/proxyproto/proxy.pb.go | 1041 | // protocol is the client protocol: "json" or "protobuf". | COMMENT |
| LOW | internal/proxyproto/proxy.pb.go | 1661 | // b64data is data in base64, for binary data. | COMMENT |
| 72 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | internal/jwtverify/token_verifier_jwt.go | 36 | // this key, enabling seamless key rotation without mass disconnects. | COMMENT |
| MEDIUM | internal/config/config.go | 36 | // data stored in memory (thus lost after node restart). Redis Broker provides seamless horizontal | COMMENT |
| MEDIUM | internal/config/config.go | 42 | // PresenceManager is superfast, but it's not distributed. Redis PresenceManager provides a seamless | COMMENT |
| MEDIUM | internal/uniws/handler.go | 20 | // communication. Here we utilize only one direction - giving users an additional | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | misc/redis_instances/start_instances.sh | 62 | # Check if the number of masters and replicas is provided | COMMENT |
| LOW | misc/packaging/initd.sh | 122 | # Check if config file exist | COMMENT |
| LOW | misc/packaging/initd.sh | 174 | # Check if daemon is a recognized program and get absolute path. | COMMENT |
| LOW | misc/redis_cluster/create_cluster.sh | 89 | # Check if the number of masters and replicas is provided | COMMENT |
| LOW | misc/nats_cluster/create_cluster.sh | 59 | # Check if the number of nodes is provided | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …ternal/jwtverify/token_verifier_jwt_jwks_scope_test.go | 64 | // Step 1: Legitimate tenant-A token primes tenant A's key in the cache. | COMMENT |
| LOW⚡ | …ternal/jwtverify/token_verifier_jwt_jwks_scope_test.go | 71 | // Step 2: Forged tenant-B token (signed by tenant A) must be rejected. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …ternal/jwtverify/token_verifier_jwt_jwks_scope_test.go | 64 | // Step 1: Legitimate tenant-A token primes tenant A's key in the cache. | COMMENT |
| LOW⚡ | …ternal/jwtverify/token_verifier_jwt_jwks_scope_test.go | 71 | // Step 2: Forged tenant-B token (signed by tenant A) must be rejected. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | misc/redis_cluster/create_cluster.sh | 73 | # Create the cluster with replicas | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/cli/configdoc/template.html | 1109 | function generateFullContextConfig(targetField, format = 'json') { | CODE |
| LOW | internal/cli/configdoc/template.html | 1445 | function setupIntersectionObserver() { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | misc/scripts/update-deps.sh | 4 | # Usage: | COMMENT |