2.6

Adjusted Signal

2.6

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

16.4K

Stars

Language

76.8K

Lines of Code

446

Files

103

Pattern Hits

2026-10-31

Scan Date

0.02

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 69 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.3/100 · LOW

Are imports declared and package/API names verified? 15 finding(s).

Agent Over-Engineering Ratio 6.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 49 finding(s).

PR Review Velocity Impact 11.6/100 · LOW

Which changes need focused human review? 103 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 2HIGH 8MEDIUM 14LOW 79

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 103 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Empty Error Handlers7 hits · 35 pts

Severity	File	Line	Snippet	Context
HIGH	github_release.py	218	except shutil.SameFileError:	CODE
HIGH	github_release.py	257	except OSError:	CODE
HIGH	github_release.py	195	except OSError:	CODE
HIGH	component-tests/test_tail.py	180	except asyncio.TimeoutError:	CODE
HIGH	component-tests/test_tail.py	142	except websockets.ConnectionClosed:	CODE
HIGH	component-tests/test_prechecks.py	131	except requests.exceptions.RequestException:	CODE
HIGH	component-tests/setup.py	50	except OSError:	CODE

Decorative Section Separators7 hits · 32 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	component-tests/test_prechecks.py	265	# ── table structure ──────────────────────────────────────────────────	COMMENT
MEDIUM⚡	component-tests/test_prechecks.py	275	# ── row content ──────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	component-tests/test_prechecks.py	310	# ── no action lines ──────────────────────────────────────────────────	COMMENT
MEDIUM⚡	component-tests/test_prechecks.py	314	# ── summary line ─────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	component-tests/test_prechecks.py	318	# ── diagnostic report ────────────────────────────────────────────────	COMMENT
MEDIUM⚡	component-tests/test_prechecks.py	369	# ── table structure ──────────────────────────────────────────────────	COMMENT
MEDIUM⚡	component-tests/test_prechecks.py	379	# ── row content ──────────────────────────────────────────────────────	COMMENT

Hyper-Verbose Identifiers28 hits · 28 pts

Severity	File	Line	Snippet	Context
LOW	release_pkgs.py	172	def _setup_rpm_pkg_directories(self, artifacts_path, gpg_key_name, archs=["aarch64", "x86_64", "386"]):	CODE
LOW	component-tests/conftest.py	54	def wait_previous_cloudflared():	CODE
LOW	component-tests/test_termination.py	57	def test_shutdown_once_no_connection(self, tmp_path, component_tests_config, signal, protocol):	CODE
LOW	component-tests/test_termination.py	77	def test_no_connection_shutdown(self, tmp_path, component_tests_config, signal, protocol):	CODE
LOW	component-tests/test_tail.py	16	async def test_start_stop_streaming(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_tail.py	62	async def test_streaming_logs_filters(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_tail.py	90	async def test_streaming_logs_sampling(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_tail.py	118	async def test_streaming_logs_actor_override(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_tail.py	136	async def start_streaming_to_be_remotely_closed(url):	CODE
LOW	component-tests/test_tail.py	156	async def generate_and_validate_http_events(websocket: WebSocketClientProtocol, url: str, count_send: int):	CODE
LOW	component-tests/test_tail.py	174	async def generate_and_validate_no_log_event(websocket: WebSocketClientProtocol, url: str):	CODE
LOW	component-tests/test_service.py	26	def test_launchd_service_log_to_file(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_service.py	43	def test_launchd_service_with_token(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_service.py	58	def test_launchd_service_rotating_log(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_service.py	89	def test_sysv_service_log_to_file(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_service.py	106	def test_sysv_service_rotating_log(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_service.py	125	def test_sysv_service_with_token(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/util.py	138	def run_cloudflared_background(cmd, allow_input, capture_output):	CODE
LOW	component-tests/util.py	211	def check_tunnel_not_connected():	CODE
LOW	component-tests/test_prechecks.py	239	def test_prechecks_pass_on_healthy_connection(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_prechecks.py	343	def test_prechecks_hard_fail_when_edge_unreachable(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_prechecks.py	435	def test_diag_contains_prechecks_json(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_management.py	93	def test_get_metrics_when_disabled(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_edge_discovery.py	64	def expect_address_connections(self, tmp_path, component_tests_config, protocol, edge_ip_version, assert_address_typ	CODE
LOW	component-tests/test_token.py	18	def test_get_credentials_file(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_config.py	7	def test_validate_ingress_rules(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_quicktunnels.py	25	def test_allowed_mail_flag_is_public(self, tmp_path, component_tests_config):	CODE
LOW	component-tests/test_quicktunnels.py	39	def test_quick_tunnel_validates_allowed_mail(self, tmp_path, component_tests_config):	CODE

Over-Commented Block26 hits · 26 pts

Severity	File	Line	Snippet	Context
LOW	.golangci.yaml	61	max-issues-per-linter: 50	COMMENT
LOW	.golangci.yaml	81	# Check exhaustiveness of enum switch statements.	COMMENT
LOW	.gitlab-ci.yml	41	#####################################################	COMMENT
LOW	.gitlab-ci.yml	61	#####################################################	COMMENT
LOW	token/encrypt.go	1	// Package token contains the Encrypter, a small helper for end-to-end encrypting (E2EE)	COMMENT
LOW	metrics/metrics.go	101	}	COMMENT
LOW	cmd/cloudflared/linux_service.go	121	}	COMMENT
LOW	cmd/cloudflared/windows_service.go	121	func createTokenFile(path string) error {	COMMENT
LOW	crypto/curves.go	21	// Canonical curve lists returned by GetCurvePreferences. They are kept	COMMENT
LOW	crypto/doc.go	1	// Package crypto centralizes the cryptographic primitives and TLS	COMMENT
LOW	crypto/doc.go	21	// CLI flag. No classical fallback is offered, so a peer that does not	COMMENT
LOW	quicktunnelauth/jwks.go	21	const (	COMMENT
LOW	proxy/proxy_test.go	821	defer r.Unlock()	COMMENT
LOW	connection/quic_connection.go	381	}	COMMENT
LOW	ingress/config.go	301	// HTTP proxy timeout for closing an idle connection	COMMENT
LOW	config/configuration.go	201	TCPKeepAlive *CustomDuration `yaml:"tcpKeepAlive" json:"tcpKeepAlive,omitempty"`	COMMENT
LOW	edgediscovery/allregions/discovery.go	81	TCP *net.TCPAddr	COMMENT
LOW	prechecks/types.go	81	type ResolvedTarget struct {	COMMENT
LOW	prechecks/types.go	121	// checks. Startup uses the tunnel's effective family after accounting for	COMMENT
LOW	prechecks/types.go	141	// SuggestedProtocol honours the override so that the summary message	COMMENT
LOW	prechecks/checker.go	321	p := connection.HTTP2	COMMENT
LOW	quic/v3/datagram.go	61		COMMENT
LOW	quic/v3/datagram.go	201	// The datagram structure for UDPSessionPayloadDatagram is:	COMMENT
LOW	quic/v3/datagram.go	281	// Session was received and is ready to proxy.	COMMENT
LOW	quic/v3/datagram.go	301	// 8\| (16 Bytes) \|	COMMENT
LOW	quic/v3/datagram.go	381		COMMENT

Hallucination Indicators2 hits · 20 pts

Severity	File	Line	Snippet	Context
CRITICAL	connection/control.go	112	c.observer.metrics.localConfigMetrics.pushesErrors.Inc()	CODE
CRITICAL	connection/control.go	115	c.observer.metrics.localConfigMetrics.pushes.Inc()	CODE

AI Slop Vocabulary5 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	.ci/release.gitlab-ci.yml	21	# we simply set both to the same value.	COMMENT
MEDIUM	ingress/origin_icmp_proxy.go	40	// response to utilize.	COMMENT
MEDIUM	ingress/origins/dns.go	206	// NewDNSDialer creates a custom dialer for the DNS resolver service to utilize.	COMMENT
MEDIUM⚡	component-tests/test_prechecks.py	266	# zerolog writes to stderr which is merged into stdout by the harness.	COMMENT
MEDIUM⚡	component-tests/test_prechecks.py	370	# zerolog writes to stderr which is merged into stdout by the harness.	COMMENT

Fake / Example Data7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	cfsetup.yaml	2	dummy_key: true	CODE
LOW⚡	quicktunnelauth/validation_test.go	24	{name: "single with leading spaces", values: []string{" user@example.com"}, expectedEmails: []string{"user@example.com	CODE
LOW⚡	quicktunnelauth/validation_test.go	25	{name: "single with trailing spaces", values: []string{"user@example.com "}, expectedEmails: []string{"user@example.co	CODE
LOW⚡	quicktunnelauth/validation_test.go	26	{name: "single with surrounding spaces", values: []string{" User@Example.com "}, expectedEmails: []string{"user@exampl	CODE
LOW⚡	quicktunnelauth/validation_test.go	28	{name: "deduplicated", values: []string{"User@example.com,user@example.com", "@Example.org,@example.org"}, expectedE	CODE
LOW⚡	quicktunnelauth/validation_test.go	28	{name: "deduplicated", values: []string{"User@example.com,user@example.com", "@Example.org,@example.org"}, expectedE	CODE
LOW	quicktunnelauth/validation_test.go	121	tooManyRules[index] = "user@example.com"	CODE

Excessive Try-Catch Wrapping5 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	github_release.py	311	except Exception as e:	CODE
LOW	release_pkgs.py	410	except Exception as e:	CODE
LOW	github_message.py	166	except Exception as e:	CODE
LOW	component-tests/util.py	175	except Exception as e:	CODE
MEDIUM	component-tests/util.py	172	def wait_tunnel_ready(tunnel_url=None, require_min_connections=1, cfd_logs=None)	CODE

Unused Imports6 hits · 6 pts

Severity	File	Line	Context
LOW	github_release.py	15	CODE
LOW	component-tests/test_management.py	5	CODE
LOW	component-tests/test_management.py	8	CODE
LOW	component-tests/test_tunnel.py	6	CODE
LOW	component-tests/test_tunnel.py	7	CODE
LOW	component-tests/test_tunnel.py	8	CODE

Self-Referential Comments2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	.ci/scripts/vuln-check.sh	4	# Define the file to store the list of vulnerabilities to ignore.	COMMENT
MEDIUM	.ci/scripts/component-tests.sh	16	# Define the cleanup function	COMMENT

Docstring Block Structure1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	component-tests/util.py	258	Decode the payload section of a JWT token without signature verification. JWT Structure: =============	STRING

Redundant / Tautological Comments3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	.ci/scripts/vuln-check.sh	8	# Check if the ignored vulnerabilities file exists. If not, create an empty one.	COMMENT
LOW	.ci/scripts/release-target.sh	4	# Check if a make target is provided as an argument	COMMENT
LOW	.ci/scripts/linux/build-packages.sh	4	# Check if architecture argument is provided	COMMENT

Deep Nesting2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	github_release.py	276		CODE
LOW	release_pkgs.py	172		CODE

AI Structural Patterns2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	component-tests/util.py	109		CODE
LOW	component-tests/cli.py	25		CODE

cloudflare/cloudflared

Open-Source Code Quality, Security and Technical Debt Review