1.1

Adjusted Signal

1.1

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

2.5K

Stars

Ruby

Language

157.0K

Lines of Code

2.8K

Files

114

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 107 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 1.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 16 finding(s).

PR Review Velocity Impact 5.2/100 · LOW

Which changes need focused human review? 114 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 24LOW 89

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 114 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block61 hits · 61 pts

Severity	File	Line	Snippet	Context
LOW	tools/build_updated_packages.rb	1	#!/usr/local/bin/ruby	COMMENT
LOW	tools/getrealdeps.rb	1	#!/usr/local/bin/ruby	COMMENT
LOW	tools/gl.sh	1	#!/bin/bash	COMMENT
LOW	tools/licenses.txt	1	# A list of valid licenses for the license field. Note the American English of license.	COMMENT
LOW	tests/unit_test.sh	41	rubocop --require rubocop-chromebrew &>/dev/null \|\| gem install rubocop-chromebrew	COMMENT
LOW	packages/qemu.rb	121	#include <libdrm/i915_drm.h>	COMMENT
LOW	packages/qemu.rb	141	# from ../hw/i3c/core.c:12:	COMMENT
LOW	packages/qemu.rb	161	# -1.0 -I/usr/local/lib64/dbus-1.0/include -I/usr/local/include/fribidi -I/usr/local/include/harfbuzz -I/usr/local/i	COMMENT
LOW	packages/llvm20_build.rb	41	# LLVM_TARGETS_TO_BUILD = 'ARM;AArch64;AMDGPU'	COMMENT
LOW	packages/llvm21_build.rb	41	# LLVM_TARGETS_TO_BUILD = 'ARM;AArch64;AMDGPU'	COMMENT
LOW	packages/gnutls.rb	61	--with-system-priority-file=#{CREW_PREFIX}/etc/gnutls/default-priorities \	COMMENT
LOW	packages/gnutls.rb	81	# FAIL: aead-cipher-vec	COMMENT
LOW	packages/gnutls.rb	101	# FAIL: system-override-sig-tls.sh	COMMENT
LOW	packages/buildessential.rb	61	depends_on 'gtk_doc'	COMMENT
LOW	packages/buildessential.rb	81		COMMENT
LOW	packages/buildessential.rb	101	# depends_on 'clisp'	COMMENT
LOW	packages/buildessential.rb	121	# depends_on 'fpc'	COMMENT
LOW	packages/motif.rb	61	end	COMMENT
LOW	packages/busybox.rb	81	CONFIG_STATIC_LIBGCC=y	COMMENT
LOW	packages/busybox.rb	101	CONFIG_UNIT_TEST=y	COMMENT
LOW	packages/busybox.rb	221	CONFIG_FEATURE_UNZIP_XZ=y	COMMENT
LOW	packages/busybox.rb	381	CONFIG_BASE64=y	COMMENT
LOW	packages/busybox.rb	401	# CONFIG_SETFONT is not set	COMMENT
LOW	packages/busybox.rb	421	CONFIG_RUN_PARTS=y	COMMENT
LOW	packages/busybox.rb	521	#	COMMENT
LOW	packages/busybox.rb	541	# CONFIG_FEATURE_INIT_MODIFY_CMDLINE is not set	COMMENT
LOW	packages/busybox.rb	561	CONFIG_FEATURE_DEFAULT_PASSWD_ALGO=""	COMMENT
LOW	packages/busybox.rb	661	# CONFIG_HD is not set	COMMENT
LOW	packages/busybox.rb	881	# Networking Utilities	COMMENT
LOW	packages/busybox.rb	1041	# CONFIG_FEATURE_UDHCPC6_RFC3646 is not set	COMMENT
LOW	packages/busybox.rb	1121	# CONFIG_ENVDIR is not set	COMMENT
LOW	packages/busybox.rb	1141	# CONFIG_FEATURE_SETFILES_CHECK_OPTION is not set	COMMENT
LOW	packages/geoip.rb	41	# system 'curl -#LO http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country.tar.gz'	COMMENT
LOW	packages/docopts.rb	41	# Tests currently fail:	COMMENT
LOW	packages/pulseaudio.rb	61	-Dtests=false \	COMMENT
LOW	packages/glibc_build223.rb	321	# Remove libmount.so since it conflicts with the one from util_linux.	COMMENT
LOW	packages/llvm23_build.rb	81	# See See https://github.com/llvm/llvm-project/issues/45130 . Currently handled with the debian patch	COMMENT
LOW	packages/glibc_build237.rb	61	# We need to avoid this patch to preserve float128. Otherwise strtof128,	COMMENT
LOW	packages/glibc_build237.rb	241	end	COMMENT
LOW	packages/kbd.rb	41	# Tests fail spectacularly.	COMMENT
LOW	packages/aide.rb	41	#define ADFS_SUPER_MAGIC 0xadf5	COMMENT
LOW	packages/aide.rb	61	#define EXT3_SUPER_MAGIC 0xEF53	COMMENT
LOW	packages/aide.rb	81	#define MINIX2_SUPER_MAGIC2 0x2478 /* minix v2 fs, 30 char names */	COMMENT
LOW	packages/aide.rb	101	#define CIFS_SUPER_MAGIC 0xFF534D42 /* the first four bytes of SMB PDUs */	COMMENT
LOW	packages/aide.rb	121	#define PIPEFS_MAGIC 0x50495045	COMMENT
LOW	packages/containerd.rb	61	# bin_dir is the directory in which the binaries for the plugin is kept.	COMMENT
LOW	packages/containerd.rb	81	# who don't have a cni daemonset in production yet.	COMMENT
LOW	packages/containerd.rb	101	# Omission of this field defaults to the empty string "", which indicates no key model,	COMMENT
LOW	packages/containerd.rb	121	# specific layout https://docs.docker.com/engine/security/certificates/	COMMENT
LOW	packages/double_conversion.rb	21	depends_on 'glibc' # R	COMMENT
LOW	packages/nftables.rb	41	# SKIP: tests/monitor/run-tests.sh	COMMENT
LOW	packages/zstd_static.rb	801	# Set build options	COMMENT
LOW	packages/zstd_static.rb	821		COMMENT
LOW	packages/inetutils.rb	61	# Handle conflict with the uutils_coreutils hostname.	COMMENT
LOW	packages/inetutils.rb	81	# File.write("#{CREW_DEST_PREFIX}/bin/ping6", @PING6_SH, perm: 0o755)	COMMENT
LOW	packages/a2png.rb	41	# We use the lib64 directory on 64-bit systems, even though we don't have multilib support.	COMMENT
LOW	packages/python3.rb	121	FileUtils.ln_sf 'pip3', "#{CREW_DEST_PREFIX}/bin/pip"	COMMENT
LOW	lib/deb_utils.rb	1	module DebUtils	COMMENT
LOW	lib/crew_lockfile.rb	1	# Based upon the fork of https://github.com/ahoward/lockfile at	COMMENT
LOW	lib/package.rb	181	# base class. Instead of defining it, we initialize it in a function	COMMENT
1 more matches not shown…

Self-Referential Comments13 hits · 38 pts

Severity	File	Line	Snippet	Context
MEDIUM	install.sh	337	# Create the device.json file.	COMMENT
MEDIUM	tools/update_python_pip_packages.rb	38	# Create a thread pool for parallelization.	COMMENT
MEDIUM	tools/update_ruby_gem_packages.rb	25	# Create a thread pool for parallelization.	COMMENT
MEDIUM	tests/tools/getrealdeps.rb	14	# Create the Package (or superclass) object, assigning it the relevant values.	COMMENT
MEDIUM	tests/tools/getrealdeps.rb	18	# Create the temporary package file, write the content to it, and rewind the stream.	COMMENT
MEDIUM	tests/tools/version.rb	5	# Create a temporary file in the packages directory with the filename of the class name of the input package.	COMMENT
MEDIUM	tests/lib/package_utils.rb	13	# Create a nonsense package name which will not be installed.	COMMENT
MEDIUM	packages/clamav.rb	53	system 'freshclam' # Create the clamav database.	CODE
MEDIUM	.github/workflows/Generate-PR.yml	98	# Create a draft PR and immediately try to update the branch	COMMENT
MEDIUM	.github/workflows/Generate-PR.yml	437	# Create a draft PR and immediately try to update the branch	COMMENT
MEDIUM	lib/fixup.rb	252	# Create a minimal Package object and pass it to Command.remove	COMMENT
MEDIUM	lib/buildsystems/ruby.rb	155	# Create a filelist from the gem if the latest gem version is	COMMENT
MEDIUM	commands/search.rb	9	# Create a case-insensitive regex from the passed string.	COMMENT

Decorative Section Separators7 hits · 27 pts

Severity	File	Line	Snippet	Context
MEDIUM	packages/libbsd.rb	31	# ===========	COMMENT
MEDIUM	packages/nftables.rb	44	# ============================================================================	COMMENT
MEDIUM	packages/nftables.rb	46	# ============================================================================	COMMENT
MEDIUM⚡	lib/package.rb	313	# └─────buildessential	COMMENT
MEDIUM⚡	lib/package.rb	322	# └─────chrome	COMMENT
MEDIUM⚡	lib/package.rb	323	# └─────buildessential	COMMENT
MEDIUM⚡	lib/package.rb	327	# └─────buildessential	COMMENT

Redundant / Tautological Comments10 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	install.sh	57	# Check if the script is being run as root.	COMMENT
LOW	tests/package_test.rb	27	# Check if the tests passed.	COMMENT
LOW	tests/unit_test.sh	40	# Check if rubocop-chromebrew is installed and working, and if not install it.	COMMENT
LOW	tests/unit_test.sh	51	## Check if rake is installed and working, and if not install it.	COMMENT
LOW	packages/vim.rb	89	# Set vim to be the default vi if there is no vi or if a default	COMMENT
LOW	packages/sommelier.rb	318	# Check if milestone is greater than 105.	COMMENT
LOW	packages/gvim.rb	107	# Set vim to be the default vi if there is no vi or if a default	COMMENT
LOW	packages/helix_editor.rb	58	# Check if helix can find its runtime path	COMMENT
LOW	packages/neovim.rb	38	# Set nvim to be the default vi if there is no vi or if a default	COMMENT
LOW	lib/selector.rb	15	# Set timeout to zero if a non-interactive console.	COMMENT

AI Slop Vocabulary7 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	tools/packages.yaml	1484	url: https://github.com/go-delve/delve/releases	CODE
LOW	tools/create_gem_packages.rb	78	# This files doesn't contain deps, so just add new deps.	COMMENT
MEDIUM	tools/repology.json	2429	"homepage": "https://github.com/go-delve/delve",	CODE
LOW	tests/tools/version.rb	47	# We shoudn't be attempting to check versions of Pip or Ruby packages, so we just return nil.	COMMENT
LOW	packages/fpc.rb	28	# In the meantime, though, just pass the correct library path manually.	COMMENT
MEDIUM	packages/delve.rb	5	homepage 'https://github.com/go-delve/delve'	CODE
MEDIUM	packages/delve.rb	24	system "GOBIN=#{CREW_DEST_PREFIX}/bin go install github.com/go-delve/delve/cmd/dlv@v#{version}"	CODE

Hyper-Verbose Identifiers9 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	tools/build_updated_packages.rb	139	def update_hashes_and_manifests(pkg)	CODE
LOW	tools/create_gem_packages.rb	20	def check_gem_binary_build_needed(ruby_gem_name = nil, ruby_gem_version = nil)	CODE
LOW	tests/dep_test.rb	10	def check_for_removed_dependencies(pkg, verbose: false)	CODE
LOW	tests/tools/version.rb	4	def update_package_test_wrapper(input_file, version, expected_pkg_file, version_updated: true, bc_updated: nil)	CODE
LOW	packages/helix_editor.rb	74	def ask_to_remove_user_defined_config_files_in(dir)	CODE
LOW	lib/buildsystems/ruby.rb	7	def check_gem_binary_build_needed(ruby_gem_name = nil, ruby_gem_version = nil)	CODE
LOW	lib/buildsystems/ruby.rb	75	def add_gem_binary_compression(pkg_name = nil)	CODE
LOW	commands/download.rb	259	def cache_downloaded_git_repository(extract_dir, cachefile)	CODE
LOW	commands/update.rb	69	def determine_updatable_packages(json: false)	CODE

Example Usage Blocks5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	tools/gl.sh	7	# Usage:	COMMENT
LOW	lib/crew_lockfile.rb	4	# Usage:	COMMENT
LOW	lib/package_utils.rb	197	# Usage:	COMMENT
LOW	lib/gnome.rb	9	# Usage:	COMMENT
LOW	lib/package_helpers.rb	39	# Usage:	COMMENT

Synthetic Comment Markers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	lib/downloader.rb	173	puts "Sleeping for #{retry_after} seconds as requested.".lightred	CODE

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	packages/protobuf_c.rb	3	# Before upgrading protobuf_c, make sure to upgrade protobuf first.	COMMENT

chromebrew/chromebrew

Open-Source Code Quality, Security and Technical Debt Review