Cloudflare Tunnel client
This report presents the forensic synthetic code analysis of cloudflare/cloudflared, a Go project with 14,846 GitHub stars. SynthScan v2.0 examined 67,634 lines of code across 426 source files, recording 90 pattern matches distributed across 13 syntactic categories. The overall adjusted score of 2.3 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 90 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | component-tests/test_prechecks.py | 301 | # ── table structure ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | component-tests/test_prechecks.py | 311 | # ── row content ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | component-tests/test_prechecks.py | 346 | # ── no action lines ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | component-tests/test_prechecks.py | 350 | # ── summary line ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | component-tests/test_prechecks.py | 354 | # ── structured log ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | component-tests/test_prechecks.py | 410 | # ── table structure ────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | component-tests/test_prechecks.py | 420 | # ── row content ────────────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | release_pkgs.py | 172 | def _setup_rpm_pkg_directories(self, artifacts_path, gpg_key_name, archs=["aarch64", "x86_64", "386"]): | CODE |
| LOW | component-tests/conftest.py | 54 | def wait_previous_cloudflared(): | CODE |
| LOW | component-tests/test_termination.py | 57 | def test_shutdown_once_no_connection(self, tmp_path, component_tests_config, signal, protocol): | CODE |
| LOW | component-tests/test_termination.py | 77 | def test_no_connection_shutdown(self, tmp_path, component_tests_config, signal, protocol): | CODE |
| LOW | component-tests/test_tail.py | 16 | async def test_start_stop_streaming(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_tail.py | 62 | async def test_streaming_logs_filters(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_tail.py | 90 | async def test_streaming_logs_sampling(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_tail.py | 118 | async def test_streaming_logs_actor_override(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_tail.py | 136 | async def start_streaming_to_be_remotely_closed(url): | CODE |
| LOW | component-tests/test_tail.py | 156 | async def generate_and_validate_http_events(websocket: WebSocketClientProtocol, url: str, count_send: int): | CODE |
| LOW | component-tests/test_tail.py | 174 | async def generate_and_validate_no_log_event(websocket: WebSocketClientProtocol, url: str): | CODE |
| LOW | component-tests/test_service.py | 26 | def test_launchd_service_log_to_file(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_service.py | 43 | def test_launchd_service_with_token(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_service.py | 58 | def test_launchd_service_rotating_log(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_service.py | 89 | def test_sysv_service_log_to_file(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_service.py | 106 | def test_sysv_service_rotating_log(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_service.py | 125 | def test_sysv_service_with_token(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/util.py | 138 | def run_cloudflared_background(cmd, allow_input, capture_output): | CODE |
| LOW | component-tests/util.py | 198 | def check_tunnel_not_connected(): | CODE |
| LOW | component-tests/test_prechecks.py | 123 | def _poll_log_file_for_precheck_complete(log_file: str, timeout: float) -> list[dict]: | CODE |
| LOW | component-tests/test_prechecks.py | 144 | def _read_precheck_log_lines_from_file(log_file: str) -> list[dict]: | CODE |
| LOW | component-tests/test_prechecks.py | 238 | def _assert_precheck_summary_log( | CODE |
| LOW | component-tests/test_prechecks.py | 271 | def test_prechecks_pass_on_healthy_connection(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_prechecks.py | 381 | def test_prechecks_hard_fail_when_edge_unreachable(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_prechecks.py | 476 | def test_diag_contains_prechecks_json(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_management.py | 93 | def test_get_metrics_when_disabled(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_edge_discovery.py | 64 | def expect_address_connections(self, tmp_path, component_tests_config, protocol, edge_ip_version, assert_address_typ | CODE |
| LOW | component-tests/test_token.py | 18 | def test_get_credentials_file(self, tmp_path, component_tests_config): | CODE |
| LOW | component-tests/test_config.py | 7 | def test_validate_ingress_rules(self, tmp_path, component_tests_config): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .golangci.yaml | 61 | max-issues-per-linter: 50 | COMMENT |
| LOW | .golangci.yaml | 81 | # Can use regexp here: `generated.*`, regexp is applied on full path, | COMMENT |
| LOW | .gitlab-ci.yml | 41 | ##################################################### | COMMENT |
| LOW | .gitlab-ci.yml | 61 | ##################################################### | COMMENT |
| LOW | token/encrypt.go | 1 | // Package encrypter is suitable for encrypting messages you would like to securely share between two points. | COMMENT |
| LOW | cmd/cloudflared/linux_service.go | 121 | # chkconfig: 2345 99 01 | COMMENT |
| LOW | crypto/curves.go | 21 | // Canonical curve lists returned by GetCurvePreferences. They are kept | COMMENT |
| LOW | crypto/doc.go | 1 | // Package crypto centralizes the cryptographic primitives and TLS | COMMENT |
| LOW | crypto/doc.go | 21 | // CLI flag. No classical fallback is offered, so a peer that does not | COMMENT |
| LOW | ingress/config.go | 301 | // HTTP proxy timeout for closing an idle connection | COMMENT |
| LOW | config/configuration.go | 181 | OriginRequest OriginRequestConfig `yaml:"originRequest" json:"originRequest"` | COMMENT |
| LOW | config/configuration.go | 201 | KeepAliveConnections *int `yaml:"keepAliveConnections" json:"keepAliveConnections,omitempty"` | COMMENT |
| LOW | edgediscovery/allregions/discovery.go | 81 | TCP *net.TCPAddr | COMMENT |
| LOW | prechecks/types.go | 81 | // Addrs holds the resolved edge addresses for this target. May be empty | COMMENT |
| LOW | prechecks/types.go | 121 | // exercises the same code paths the tunnel itself will use. | COMMENT |
| LOW | prechecks/checker.go | 41 | COMMENT | |
| LOW | prechecks/checker.go | 321 | } | COMMENT |
| LOW | quic/v3/datagram.go | 61 | COMMENT | |
| LOW | quic/v3/datagram.go | 201 | // The datagram structure for UDPSessionPayloadDatagram is: | COMMENT |
| LOW | quic/v3/datagram.go | 281 | // Session was received and is ready to proxy. | COMMENT |
| LOW | quic/v3/datagram.go | 301 | // 8| (16 Bytes) | | COMMENT |
| LOW | quic/v3/datagram.go | 381 | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | connection/control.go | 112 | c.observer.metrics.localConfigMetrics.pushesErrors.Inc() | CODE |
| CRITICAL | connection/control.go | 115 | c.observer.metrics.localConfigMetrics.pushes.Inc() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .ci/release.gitlab-ci.yml | 21 | # we simply set both to the same value. | COMMENT |
| MEDIUM | ingress/origin_icmp_proxy.go | 40 | // response to utilize. | COMMENT |
| MEDIUM | ingress/origins/dns.go | 206 | // NewDNSDialer creates a custom dialer for the DNS resolver service to utilize. | COMMENT |
| MEDIUM⚡ | component-tests/test_prechecks.py | 302 | # zerolog writes to stderr which is merged into stdout by the harness. | COMMENT |
| MEDIUM⚡ | component-tests/test_prechecks.py | 411 | # zerolog writes to stderr which is merged into stdout by the harness. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | github_release.py | 15 | CODE | |
| LOW | component-tests/test_management.py | 5 | CODE | |
| LOW | component-tests/test_management.py | 8 | CODE | |
| LOW | component-tests/test_reconnect.py | 2 | CODE | |
| LOW | component-tests/test_reconnect.py | 9 | CODE | |
| LOW | component-tests/test_tunnel.py | 6 | CODE | |
| LOW | component-tests/test_tunnel.py | 7 | CODE | |
| LOW | component-tests/test_tunnel.py | 8 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | github_release.py | 311 | except Exception as e: | CODE |
| LOW | release_pkgs.py | 410 | except Exception as e: | CODE |
| LOW | github_message.py | 166 | except Exception as e: | CODE |
| LOW | component-tests/util.py | 162 | except Exception as e: | CODE |
| MEDIUM | component-tests/util.py | 159 | def wait_tunnel_ready(tunnel_url=None, require_min_connections=1, cfd_logs=None) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .ci/scripts/vuln-check.sh | 4 | # Define the file to store the list of vulnerabilities to ignore. | COMMENT |
| MEDIUM | .ci/scripts/component-tests.sh | 16 | # Define the cleanup function | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | component-tests/util.py | 245 | Decode the payload section of a JWT token without signature verification. JWT Structure: ============= | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .ci/scripts/vuln-check.sh | 8 | # Check if the ignored vulnerabilities file exists. If not, create an empty one. | COMMENT |
| LOW | .ci/scripts/release-target.sh | 4 | # Check if a make target is provided as an argument | COMMENT |
| LOW | .ci/scripts/linux/build-packages.sh | 4 | # Check if architecture argument is provided | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | github_release.py | 276 | CODE | |
| LOW | release_pkgs.py | 172 | CODE | |
| LOW | component-tests/test_prechecks.py | 144 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | component-tests/util.py | 109 | CODE | |
| LOW | component-tests/cli.py | 25 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cfsetup.yaml | 2 | dummy_key: true | CODE |