1.2

Adjusted Signal

1.2

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

5.1K

Stars

Language

347.6K

Lines of Code

1.5K

Files

360

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 354 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 2 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 7 finding(s).

PR Review Velocity Impact 5.5/100 · LOW

Which changes need focused human review? 360 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 2MEDIUM 10LOW 348

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 360 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block321 hits · 315 pts

Severity	File	Line	Snippet	Context
LOW	netlify.toml	1	# Netlify is handled and authorized by Mahe and we use a free plan.	COMMENT
LOW	cmd/ksyms/ksyms.go	21	// ffffffffa870f925 sock_close+0x15 (/usr/lib/debug/boot/vmlinux-5.4.0-48-generic)	COMMENT
LOW	cmd/tetra/commands.go	41	// imports the bpf package that contains unix-specific definitions not found	COMMENT
LOW	cmd/tetra/common/client.go	21	// https://github.com/grpc/proposal/blob/master/A6-client-retries.md	COMMENT
LOW	…ls/protoc-gen-go-tetragon/eventchecker/multichecker.go	241		COMMENT
LOW	…ls/protoc-gen-go-tetragon/eventchecker/multichecker.go	281	// check was successful. The boolean value allows short-circuiting checks.	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	81	startupProbe: {}	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	101	exportFileMaxBackups: 5	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	121	# {"namespace":["kube-system",""]}	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	141	# -- Filters to redact secrets from the args fields in Tetragon events. To perform	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	161	#	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	181	# to set the cluster_name field in GetEventsResponse messages.	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	221	grpc:	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	241	enabled: false	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	261	# method=cronJob. Empty disables the recurring CronJob, leaving only	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	321	# host, the path is /proc. Exceptions to this are environments like kind, where the runtime itself	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	461	filenames:	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	481	# name: my-config-map	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	521	# -- Method for installing Tetagon rthooks (tetragon-rthooks) daemonset	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	541	#	COMMENT
LOW	install/kubernetes/tetragon/values.yaml	561	failAllowNamespaces: ""	COMMENT
LOW	tests/e2e/install/tetragon/doc.go	1	// SPDX-License-Identifier: Apache-2.0	COMMENT
LOW	tests/e2e/checker/doc.go	1	// SPDX-License-Identifier: Apache-2.0	COMMENT
LOW	tests/e2e/tests/skeleton/skeleton_test.go	41	// line flags can be used.	COMMENT
LOW	tests/e2e/tests/nodeselector/nodeselector_test.go	41	// loading it, so a gated-out policy is distinguishable from a missing one — any	COMMENT
LOW	tests/e2e/tests/policyfilter/policyfilter_test.go	41	TetragonCLI = "tetra"	COMMENT
LOW	tests/e2e/metricschecker/doc.go	1	// SPDX-License-Identifier: Apache-2.0	COMMENT
LOW	tests/e2e/runners/doc.go	1	// SPDX-License-Identifier: Apache-2.0	COMMENT
LOW	tests/e2e/helpers/doc.go	1	// SPDX-License-Identifier: Apache-2.0	COMMENT
LOW	tests/e2e/helpers/cluster.go	201	// The name of locally build images doesn't contain a registry prefix	COMMENT
LOW	docs/config/_default/hugo.toml	181	# banner on every page indicating that this is an archived version of the docs.	COMMENT
LOW	contrib/mapdups.sh	1	#!/bin/bash	COMMENT
LOW	contrib/tetragon-rthooks/cmd/oci-hook/cel.go	41	},	COMMENT
LOW	contrib/scripts/repo-docker-run.sh	21	)	COMMENT
LOW	contrib/tester-progs/usdt.h	301	#if defined __powerpc__	COMMENT
LOW	contrib/tester-progs/usdt.h	321	* Implementation details	COMMENT
LOW	contrib/tester-progs/usdt.h	341	#endif /* __usdt_narg */	COMMENT
LOW	contrib/tester-progs/usdt.h	361	#define __usdt_asm10(x, ...) __usdt_str(x) "," __usdt_asm9(__VA_ARGS__)	COMMENT
LOW	contrib/tester-progs/usdt.h	461	#endif	COMMENT
LOW	contrib/tester-progs/usdt.h	521	#define __usdt_inttype(x) __typeof(__builtin_choose_expr(__usdt_is_inttype(x), (x), 0U))	COMMENT
LOW	contrib/tester-progs/usdt.h	541	#define __usdt_asm_ops11(a,b,c,d,e,f,g,h,i,j,x) __usdt_asm_ops10(a,b,c,d,e,f,g,h,i,j), __usdt_asm_op(11, x)	COMMENT
LOW	contrib/tester-progs/direct-write-tester.c	1	// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)	COMMENT
LOW	contrib/tester-progs/uprobe-selector-targets.c	1	#include <stdio.h>	COMMENT
LOW	contrib/tester-progs/exit-tester.c	1	#define _GNU_SOURCE	COMMENT
LOW	contrib/tester-progs/threads-tester.c	1	#define _GNU_SOURCE	COMMENT
LOW	contrib/tester-progs/uprobe-big-struct.c	1	#include <stdio.h>	COMMENT
LOW	contrib/tester-progs/uprobe-arg-targets.c	1	#include <stdio.h>	COMMENT
LOW	contrib/tester-progs/usdt-args.c	1	//go:build ignore	COMMENT
LOW	…rib/tester-progs/sigkill-unprivileged-user-ns-tester.c	1	// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)	COMMENT
LOW	contrib/tester-progs/cgroup-migrate.bash	1	#!/bin/bash	COMMENT
LOW	contrib/tester-progs/cgroup-migrate.bash	21		COMMENT
LOW	contrib/tester-progs/uprobe-execve.c	1	#include <stdio.h>	COMMENT
LOW	contrib/tester-progs/uprobe-big-struct.h	1	#ifndef UPROBE_BIG_STRUCT_H	COMMENT
LOW	contrib/tester-progs/uprobe-static-chain.c	1	#include <stdio.h>	COMMENT
LOW	contrib/tester-progs/uprobe-static-chain.c	21	//	COMMENT
LOW	contrib/tester-progs/sdt.h	41		COMMENT
LOW	contrib/tester-progs/sdt.h	61	# define _SDT_DEPAREN_7(a,b,c,d,e,f,g) a b c d e f g	COMMENT
LOW	contrib/tester-progs/sdt.h	101	# if defined __powerpc__	COMMENT
LOW	contrib/tester-progs/sdt.h	221	register, then a sys/sdt.h note consumer may need to employ	COMMENT
LOW	contrib/tester-progs/sdt.h	321	_SDT_ASM_1( _SDT_ASM_ADDR p##_##n##_semaphore)	COMMENT
261 more matches not shown…

Structural Annotation Overuse7 hits · 13 pts

Severity	File	Line	Snippet	Context
LOW	…cs/use-cases/process-lifecycle/privileged-execution.md	19	## Step 1: Enabling Process Credential and Namespace Monitoring	COMMENT
LOW	…cs/use-cases/process-lifecycle/privileged-execution.md	41	## Step 2: Deploying a Privileged Nginx Pod	COMMENT
LOW	…cs/use-cases/process-lifecycle/privileged-execution.md	68	## Step 3: Monitoring with Tetragon	COMMENT
LOW	pkg/sensors/exec/cgroups_test.go	1379	// Step 1: Create the cgroup (it will be tracked)	COMMENT
LOW⚡	pkg/sensors/exec/cgroups_test.go	1392	// Step 2: Delete the cgroup from tracking map to simulate missed tracking	COMMENT
LOW⚡	pkg/sensors/exec/cgroups_test.go	1400	// Step 3: Remove the cgroup directory - this should trigger the missed tracking detection	COMMENT
LOW⚡	pkg/sensors/exec/cgroups_test.go	1409	// Step 4: Check errmetrics map for ENOENT error from bpf_cgroup_rmdir.c	COMMENT

Decorative Section Separators4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/actions/install-msi/action.yml	99	# -------------------------------	COMMENT
MEDIUM	.github/actions/install-msi/action.yml	103	# -------------------------------	COMMENT
MEDIUM	.github/actions/extract-msi/action.yml	104	# -------------------------------	COMMENT
MEDIUM	.github/actions/extract-msi/action.yml	108	# -------------------------------	COMMENT

Verbosity Indicators5 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	bpf/process/policy_filter.h	83	// Now we need to check if we have a hostSelector match.	COMMENT
LOW	pkg/sensors/exec/cgroups_test.go	1379	// Step 1: Create the cgroup (it will be tracked)	COMMENT
LOW⚡	pkg/sensors/exec/cgroups_test.go	1392	// Step 2: Delete the cgroup from tracking map to simulate missed tracking	COMMENT
LOW⚡	pkg/sensors/exec/cgroups_test.go	1400	// Step 3: Remove the cgroup directory - this should trigger the missed tracking detection	COMMENT
LOW⚡	pkg/sensors/exec/cgroups_test.go	1409	// Step 4: Check errmetrics map for ENOENT error from bpf_cgroup_rmdir.c	COMMENT

Self-Referential Comments3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	contrib/tester-progs/cgroup-migrate.bash	173	# Create the child cgroup	COMMENT
MEDIUM	contrib/tester-progs/cgroup-migrate.bash	205	# Create the child cgroup	COMMENT
MEDIUM	examples/configuration/tetragon.yaml	1	# This file is part of Tetragon.	COMMENT

AI Slop Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	…gpolicy/process-credentials/process-creds-changed.yaml	20	# kernel on behalf of processes to elevate privileges.	COMMENT
MEDIUM	pkg/manager/manager.go	224	// The resync mechanism periodically refreshes the cache, making this approach more robust	COMMENT
MEDIUM	pkg/cri/container.go	25	// generating the path of slice. Essentially, test-a-b.slice becomes	COMMENT

AI Response Leakage1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	…e-cases/security-profiles/record-linux-capabilities.md	225	* `capability_arg`: is the [capability]({{< ref "/docs/reference/grpc-api#kprobecapability" >}}) required to perform the	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	pkg/sensors/manager.go	30	// sensors as requested from different goroutines (e.g., different GRPC	COMMENT

Example Usage Blocks3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	contrib/mapdups.sh	14	# Example usage:	COMMENT
LOW	contrib/tester-progs/cgroup-migrate.bash	23	# Usage:	COMMENT
LOW	pkg/glob/glob_multi.go	21	// Example usage:	COMMENT

TODO Padding3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	tools/protoc-gen-go-tetragon/eventchecker/field.go	233	return "// TODO: implement fromMap", nil	CODE
LOW	api/v1/tetragon/codegen/eventchecker/eventchecker.pb.go	3436	// TODO: implement fromMap	COMMENT
LOW	api/v1/tetragon/codegen/eventchecker/eventchecker.pb.go	3439	// TODO: implement fromMap	COMMENT

Hyper-Verbose Identifiers3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	install/kubernetes/openapi2jsonschema.py	13	def test_additional_properties():	CODE
LOW	install/kubernetes/openapi2jsonschema.py	33	def test_replace_int_or_string():	CODE
LOW	install/kubernetes/openapi2jsonschema.py	64	def allow_null_optional_fields(data, parent=None, grand_parent=None, key=None):	CODE

Unused Imports2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	testdata/demos/tools/exec-memfd.py	8		CODE
LOW	testdata/demos/tools/exec-memfd.py	9		CODE

Deep Nesting2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	install/kubernetes/openapi2jsonschema.py	43		CODE
LOW	install/kubernetes/openapi2jsonschema.py	64		CODE

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	install/kubernetes/tetragon/values.yaml	193	# Set it to "" to disable ancestors completely.	COMMENT

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	pkg/bugtool/maps.go	164	// don't forget to close those files when used later on	COMMENT

cilium/tetragon

Open-Source Code Quality, Security and Technical Debt Review