The JavaScript / Wasm runtime that powers Cloudflare Workers
This report presents the forensic synthetic code analysis of cloudflare/workerd, a C++ project with 8,649 GitHub stars. SynthScan v2.0 examined 490,093 lines of code across 1640 source files, recording 1658 pattern matches distributed across 21 syntactic categories. The overall adjusted score of 3.8 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1658 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/clang-tidy/unsafe-continuation-capture.h | 1 | #pragma once | COMMENT |
| LOW | tools/clang-tidy/unsafe-continuation-capture.h | 21 | // - `kj::WeakRef<T>` / `jsg::WeakRef<T>` -- if the continuation should | COMMENT |
| LOW | tools/clang-tidy/promise-ignore-result.h | 1 | #pragma once | COMMENT |
| LOW | tools/clang-tidy/visit-for-gc.h | 1 | // Copyright (c) 2017-2022 Cloudflare, Inc. | COMMENT |
| LOW | tools/clang-tidy/visit-for-gc.h | 21 | // | COMMENT |
| LOW | tools/unix/apply-big-move.sh | 1 | #! /bin/bash | COMMENT |
| LOW | types/test/types/rpc.ts | 941 | expectTypeOf(error).toEqualTypeOf<Error>(); | COMMENT |
| LOW | types/generated-snapshot/index.ts | 15481 | // Type for method return or property on an RPC interface. | COMMENT |
| LOW | types/generated-snapshot/index.ts | 15521 | // Type of `env`. | COMMENT |
| LOW | types/generated-snapshot/index.ts | 15541 | // // thus should behave as Durable Object namsepace bindings. | COMMENT |
| LOW | types/generated-snapshot/index.d.ts | 15341 | // https://developers.cloudflare.com/pub-sub/ | COMMENT |
| LOW | types/generated-snapshot/index.d.ts | 15561 | // | COMMENT |
| LOW | types/generated-snapshot/index.d.ts | 16901 | // for Onset and SpanOpen events this would be the parent span id | COMMENT |
| LOW | types/generated-snapshot/experimental/index.ts | 15581 | // PubSubMessage represents an incoming PubSub message. | COMMENT |
| LOW | types/generated-snapshot/experimental/index.ts | 15801 | // You can use `wrangler types` to generate the `Env` type automatically. | COMMENT |
| LOW | types/generated-snapshot/experimental/index.ts | 17121 | | Exception | COMMENT |
| LOW | types/generated-snapshot/experimental/index.d.ts | 15621 | readonly broker: string; | COMMENT |
| LOW | types/generated-snapshot/experimental/index.d.ts | 15821 | { | COMMENT |
| LOW | types/generated-snapshot/experimental/index.d.ts | 15841 | // | COMMENT |
| LOW | types/generated-snapshot/experimental/index.d.ts | 17161 | | SpanClose | COMMENT |
| LOW | types/defines/trace.d.ts | 201 | | Exception | COMMENT |
| LOW | types/defines/pubsub.d.ts | 1 | // PubSubMessage represents an incoming PubSub message. | COMMENT |
| LOW | types/defines/rpc.d.ts | 121 | // Everything else can't be passed over PRC. | COMMENT |
| LOW | types/defines/rpc.d.ts | 161 | COMMENT | |
| LOW | types/defines/rpc.d.ts | 181 | // mainModule: typeof import("my-main-module"); | COMMENT |
| LOW | types/defines/disposable.d.ts | 1 | // `Disposable` was added to TypeScript's standard lib types in version 5.2. | COMMENT |
| LOW | types/src/transforms/import-resolve.ts | 1 | // Copyright (c) 2022-2023 Cloudflare, Inc. | COMMENT |
| LOW | types/src/transforms/import-resolve.ts | 21 | // | COMMENT |
| LOW | types/src/transforms/import-resolve.ts | 41 | // const _default: { | COMMENT |
| LOW | types/src/transforms/iterators.ts | 1 | // Copyright (c) 2022-2023 Cloudflare, Inc. | COMMENT |
| LOW | types/src/transforms/iterators.ts | 21 | // export interface ThingIteratorNext { | COMMENT |
| LOW | types/src/transforms/importable.ts | 1 | // Copyright (c) 2022-2023 Cloudflare, Inc. | COMMENT |
| LOW | types/src/transforms/ambient.ts | 1 | // Copyright (c) 2022-2023 Cloudflare, Inc. | COMMENT |
| LOW | types/src/transforms/globals.ts | 1 | // Copyright (c) 2022-2023 Cloudflare, Inc. | COMMENT |
| LOW | types/src/transforms/globals.ts | 21 | // btoa(value: string): string; | COMMENT |
| LOW | types/src/transforms/internal-namespace.ts | 1 | // Copyright (c) 2022-2023 Cloudflare, Inc. | COMMENT |
| LOW | types/src/transforms/internal-namespace.ts | 21 | // readonly property: boolean; | COMMENT |
| LOW | types/src/transforms/internal-namespace.ts | 41 | // function bindStore(store: AsyncLocalStorage, ...): void; | COMMENT |
| LOW | types/src/transforms/overrides/index.ts | 21 | // `compileOverridesDefines()` must be used to compile overrides and defines | COMMENT |
| LOW | types/src/transforms/overrides/index.ts | 41 | // get(key: string, type: "text"): Promise<string | null>; | COMMENT |
| LOW | types/src/transforms/overrides/compiler.ts | 21 | ): [compiled: string, isReplacement: boolean] { | COMMENT |
| LOW | samples/tcp/gopher.js | 1 | // Copyright (c) 2022-2023 Cloudflare, Inc. | COMMENT |
| LOW | …les/nodejs-compat-fs-graceful/graceful-fs/polyfills.js | 321 | if (stats.uid < 0) stats.uid += 0x100000000 | COMMENT |
| LOW | samples/durable-objects-chat/chat.js | 1 | // Copyright (c) 2022-2023 Cloudflare, Inc. | COMMENT |
| LOW | samples/durable-objects-chat/chat.js | 21 | // exporting a new handler that call into the other Workers as appropriate. | COMMENT |
| LOW | samples/durable-objects-chat/chat.js | 41 | // | COMMENT |
| LOW | samples/durable-objects-chat/chat.js | 61 | // in .html should be uploaded as "Data", equivalent to content-type `application/octet-stream`. | COMMENT |
| LOW | samples/durable-objects-chat/chat.js | 141 | // "anyone with the link can access" sharing. Additionally, IDs generated this way have | COMMENT |
| LOW | samples/durable-objects-chat/chat.js | 181 | } | COMMENT |
| LOW | samples/durable-objects-chat/chat.js | 441 | // ======================================================================================= | COMMENT |
| LOW | samples/durable-objects-chat/chat.js | 521 | // we have to provide a dummy URL that will be ignored at the other end anyway. | COMMENT |
| LOW | npm/lib/node-platform.ts | 141 | // | COMMENT |
| LOW | npm/lib/node-install.ts | 181 | else fs.unlinkSync(entryPath); | COMMENT |
| LOW | npm/lib/node-install.ts | 201 | // Docker. Avoid idempotency issues by just not optimizing when using Yarn. | COMMENT |
| LOW | npm/lib/node-shim.ts | 1 | #!/usr/bin/env node | COMMENT |
| LOW | src/workerd/util/sqlite-metadata.h | 1 | // Copyright (c) 2024 Cloudflare, Inc. | COMMENT |
| LOW | src/workerd/util/string-buffer.h | 1 | // Copyright (c) 2023 Cloudflare, Inc. | COMMENT |
| LOW | src/workerd/util/batch-queue.h | 1 | // Copyright (c) 2017-2022 Cloudflare, Inc. | COMMENT |
| LOW | src/workerd/util/batch-queue.h | 21 | // When the RAII object is destroyed, it resets the size and capacity of the pop buffer. | COMMENT |
| LOW | src/workerd/util/batch-queue.h | 61 | } | COMMENT |
| 1205 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | types/test/generator/index.spec.ts | 20 | function initAsReferencableTypesGroup( | CODE |
| LOW | types/test/transforms/overrides/index.spec.ts | 19 | function printDefinitionsWithOverrides(root: StructureGroups): string { | CODE |
| LOW | types/src/generator/structure.ts | 49 | function createIteratorMethodPartial( | CODE |
| LOW | types/src/generator/structure.ts | 66 | function createInstancePropertyPartial( | CODE |
| LOW | types/src/generator/structure.ts | 148 | function createInterfaceMemberNode( | CODE |
| LOW | types/src/generator/structure.ts | 220 | function createIteratorInterfaceMemberNode( | CODE |
| LOW | types/src/generator/structure.ts | 326 | function createIteratorClassMemberNode( | CODE |
| LOW | types/src/generator/type.ts | 139 | export function createParamDeclarationNodes( | CODE |
| LOW | types/src/transforms/comments.ts | 15 | export function createCommentsTransformer( | CODE |
| LOW | types/src/transforms/helpers.ts | 52 | function ensureModifierRequirements( | CODE |
| LOW | types/src/transforms/onmessage-declaration.ts | 7 | export function createAddOnMessageDeclarationTransformer(): ts.TransformerFactory<ts.SourceFile> { | CODE |
| LOW | types/src/transforms/import-resolve.ts | 53 | export function createImportResolveTransformer(): ts.TransformerFactory<ts.SourceFile> { | CODE |
| LOW | types/src/transforms/import-resolve.ts | 81 | function createImportResolveVisitor(ctx: ts.TransformationContext): ts.Visitor { | CODE |
| LOW | types/src/transforms/import-resolve.ts | 102 | function createModuleImportResolveVisitor( | CODE |
| LOW | types/src/transforms/iterators.ts | 45 | export function createIteratorTransformer( | CODE |
| LOW | types/src/transforms/iterators.ts | 71 | function createIteratorDeclarationsVisitor( | CODE |
| LOW | types/src/transforms/iterators.ts | 183 | function createIteratorUsagesVisitor( | CODE |
| LOW | types/src/transforms/importable.ts | 23 | export function createImportableTransformer(): ts.TransformerFactory<ts.SourceFile> { | CODE |
| LOW | types/src/transforms/class-to-interface.ts | 36 | export function createClassToInterfaceTransformer( | CODE |
| LOW | types/src/transforms/class-to-interface.ts | 64 | function transformClassToInterface( | CODE |
| LOW | types/src/transforms/class-to-interface.ts | 78 | function createInterfaceDeclaration( | CODE |
| LOW | types/src/transforms/class-to-interface.ts | 126 | function transformClassMemberToInterface( | CODE |
| LOW | types/src/transforms/class-to-interface.ts | 236 | function createGetAccessorSignature( | CODE |
| LOW | types/src/transforms/class-to-interface.ts | 269 | function createVariableDeclaration( | CODE |
| LOW | types/src/transforms/globals.ts | 38 | export function createGlobalScopeTransformer( | CODE |
| LOW | types/src/transforms/internal-namespace.ts | 68 | export function createInternalNamespaceTransformer( | CODE |
| LOW | types/src/transforms/internal-namespace.ts | 84 | function collectInternalModuleStructures( | CODE |
| LOW | types/src/transforms/internal-namespace.ts | 99 | function createInternalNamespaceVisitor( | CODE |
| LOW | types/src/transforms/overrides/index.ts | 61 | export function createOverrideDefineTransformer( | CODE |
| LOW | types/src/transforms/overrides/index.ts | 300 | function createOverrideDefineVisitor( | CODE |
| LOW | ci/v8_update.py | 87 | def _update_aligned_dependencies(): | CODE |
| LOW⚡ | ci/jsonc.py | 319 | def test_comments_trailing_the_document_move_inside(self): | CODE |
| LOW⚡ | ci/jsonc.py | 327 | def test_comment_in_empty_container(self): | CODE |
| LOW⚡ | ci/jsonc.py | 331 | def test_blank_lines_are_dropped(self): | CODE |
| LOW⚡ | ci/jsonc.py | 356 | def test_comments_are_not_found_in_strings(self): | CODE |
| LOW⚡ | ci/jsonc.py | 362 | def test_scalar_and_empty_documents(self): | CODE |
| LOW⚡ | ci/jsonc.py | 370 | def test_plain_data_matches_json(self): | CODE |
| LOW⚡ | ci/jsonc.py | 395 | def test_non_ascii_is_literal(self): | CODE |
| LOW⚡ | ci/jsonc.py | 398 | def test_comments_on_absent_members_are_ignored(self): | CODE |
| LOW⚡ | ci/jsonc.py | 402 | def test_dump_appends_newline(self): | CODE |
| LOW⚡ | ci/jsonc.py | 409 | def test_position_ignores_comments(self): | CODE |
| LOW⚡ | ci/jsonc.py | 414 | def test_block_comments_are_rejected(self): | CODE |
| LOW⚡ | ci/jsonc.py | 417 | def test_trailing_commas_are_rejected(self): | CODE |
| LOW | fuzzilli/analytics-mock.js | 5 | function getChaoticAnalyticsResponse() { | CODE |
| LOW | samples/web-streams/streams-util.js | 69 | export function createSyncLoremByteStream(numChunks) { | CODE |
| LOW | samples/web-streams/streams-util.js | 86 | export function createAsyncLoremByteStream(numChunks) { | CODE |
| LOW | samples/web-streams/streams-util.js | 104 | export function createSyncUppercaseTransform() { | CODE |
| LOW | samples/web-streams/streams-util.js | 123 | export function createAsyncUppercaseTransform() { | CODE |
| LOW | npm/lib/node-platform.ts | 26 | export function pkgAndSubpathForCurrentPlatform(): { | CODE |
| LOW | src/workerd/server/tests/python/asgi/worker.py | 158 | async def test_error_after_response_is_logged(env): | CODE |
| LOW | src/workerd/server/tests/python/asgi/worker.py | 189 | async def test_background_task_error_is_logged(): | CODE |
| LOW | src/workerd/server/tests/python/asgi/worker.py | 235 | async def test_app_exception_before_response_is_logged(): | CODE |
| LOW | src/workerd/server/tests/python/sockets/worker.py | 189 | def test_double_close_after_eof(self): | CODE |
| LOW | src/workerd/server/tests/python/sockets/worker.py | 196 | def test_recv_after_remote_close(self): | CODE |
| LOW | src/workerd/server/tests/python/sockets/worker.py | 232 | def test_settimeout_nonblocking_and_restore(self): | CODE |
| LOW | src/workerd/server/tests/python/sockets/worker.py | 257 | async def test_asyncio_sock_connect_recv_sendall(self): | CODE |
| LOW | src/workerd/server/tests/python/sockets/worker.py | 272 | async def test_asyncio_sock_recv_into(self): | CODE |
| LOW | src/workerd/server/tests/python/sockets/worker.py | 289 | async def test_asyncio_open_connection(self): | CODE |
| LOW | src/workerd/server/tests/python/sockets/worker.py | 300 | async def test_asyncio_open_connection_hostname(self): | CODE |
| LOW | src/workerd/server/tests/python/sockets/worker.py | 313 | async def test_asyncio_concurrent_connections(self): | CODE |
| 118 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | types/generated-snapshot/index.ts | 12180 | // ── Error types ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | types/generated-snapshot/index.ts | 12213 | // ── Binding ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | types/generated-snapshot/index.d.ts | 12166 | // ── Error types ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | types/generated-snapshot/index.d.ts | 12199 | // ── Binding ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | types/generated-snapshot/experimental/index.ts | 12455 | // ── Error types ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | types/generated-snapshot/experimental/index.ts | 12488 | // ── Binding ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | types/generated-snapshot/experimental/index.d.ts | 12441 | // ── Error types ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | types/generated-snapshot/experimental/index.d.ts | 12474 | // ── Binding ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | types/defines/artifacts.d.ts | 146 | // ── Error types ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | types/defines/artifacts.d.ts | 182 | // ── Binding ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 22 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 24 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 68 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 70 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 114 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 116 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 182 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 184 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 220 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 222 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 258 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | .github/scripts/check-compat-flag-docs.py | 260 | # ------------------------------------------------------------------ | COMMENT |
| MEDIUM | src/workerd/server/tests/python/asgi/worker.py | 96 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | src/workerd/server/tests/python/asgi/worker.py | 98 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/workerd/api/node/tests/tty-nodejs-test.js | 9 | // Note: test was generated by claude with manual tweaks | COMMENT |
| HIGH | src/workerd/api/node/tests/v8-nodejs-test.js | 9 | // Note: test was generated by claude with manual tweaks | COMMENT |
| HIGH | src/workerd/api/node/tests/trace-events-nodejs-test.js | 9 | // Note: test was generated by claude with manual tweaks | COMMENT |
| HIGH | src/workerd/api/node/tests/domain-nodejs-test.js | 10 | // Note: test was generated by claude with manual tweaks | COMMENT |
| HIGH | src/workerd/api/node/tests/vm-test.js | 9 | // Note: test was generated by claude with manual tweaks | COMMENT |
| HIGH | src/workerd/api/node/tests/dgram-nodejs-test.js | 9 | // Note: test was generated by claude with manual tweaks | COMMENT |
| HIGH | src/workerd/api/node/tests/wasi-nodejs-test.js | 9 | // Note: test was generated by claude with manual tweaks | COMMENT |
| HIGH | src/rust/cxx/kj-rs/tests/test_own.rs | 258 | // This is one test generated by Claude. I am unsure it sufficiently tests multithreading. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .opencode/skills/update-v8/SKILL.md | 27 | ### Step 1: Identify the target version | COMMENT |
| LOW | .opencode/skills/update-v8/SKILL.md | 39 | ### Step 2: Sync local V8 to the current workerd version | COMMENT |
| LOW | .opencode/skills/update-v8/SKILL.md | 47 | ### Step 3: Apply workerd's patches onto a branch | COMMENT |
| LOW | .opencode/skills/update-v8/SKILL.md | 65 | ### Step 4: Rebase patches onto the new V8 version | COMMENT |
| LOW⚡ | .opencode/skills/update-v8/SKILL.md | 79 | ### Step 5: Regenerate patches | COMMENT |
| LOW⚡ | .opencode/skills/update-v8/SKILL.md | 87 | ### Step 6: Replace patches in workerd | COMMENT |
| LOW⚡ | .opencode/skills/update-v8/SKILL.md | 97 | ### Step 7: Update `build/deps/v8.MODULE.bazel` | COMMENT |
| LOW | .opencode/skills/update-v8/SKILL.md | 114 | ### Step 8: Update V8's dependencies | COMMENT |
| LOW | .opencode/skills/update-v8/SKILL.md | 139 | ### Step 9: Build and test | COMMENT |
| LOW | .opencode/skills/update-v8/SKILL.md | 164 | ### Step 10: Commit and submit | COMMENT |
| LOW | docs/reference/adding-a-compatibility-flag.md | 5 | ## Step 1: Choose flag names | COMMENT |
| LOW | docs/reference/adding-a-compatibility-flag.md | 15 | ## Step 2: Add to `compatibility-date.capnp` | COMMENT |
| LOW | docs/reference/adding-a-compatibility-flag.md | 45 | ## Step 3: Use the flag in C++ code | COMMENT |
| LOW | docs/reference/adding-a-compatibility-flag.md | 70 | ## Step 4: Add tests | COMMENT |
| LOW | docs/reference/adding-a-compatibility-flag.md | 95 | ## Step 5: Document the flag | COMMENT |
| LOW | docs/reference/adding-a-compatibility-flag.md | 108 | ## Step 6: Build and verify | COMMENT |
| LOW⚡ | src/workerd/api/tests/worker-loader-test.js | 1138 | // Step 1: sub-request sets up the pending promise via a separate entrypoint. | COMMENT |
| LOW⚡ | src/workerd/api/tests/worker-loader-test.js | 1143 | // Step 2: IoContext B has drained. Give the runtime a moment to clean up. | COMMENT |
| LOW⚡ | src/workerd/api/tests/worker-loader-test.js | 1146 | // Step 3: resolve the saved promise from IoContext A. The inner .then() continuation throws | COMMENT |
| LOW⚡ | …/workerd/api/tests/stdio-writesync-reentry-uaf-test.js | 50 | // Step 1: Prime lineBuffer with non-newline data (buffered, no | COMMENT |
| LOW⚡ | …/workerd/api/tests/stdio-writesync-reentry-uaf-test.js | 54 | // Step 2: Arm the getter and trigger the newline path. | COMMENT |
| LOW⚡ | src/workerd/api/node/tests/zlib-nodejs-test.js | 2850 | // Step 1: writeSync with Z_NO_FLUSH — data is buffered internally. | COMMENT |
| LOW⚡ | src/workerd/api/node/tests/zlib-nodejs-test.js | 2857 | // Step 2: params() directly on native handle — no preceding flush. | COMMENT |
| LOW⚡ | src/workerd/api/node/tests/zlib-nodejs-test.js | 2865 | // Step 3: finish the stream — must still produce a valid deflate stream. | COMMENT |
| LOW | src/workerd/api/node/tests/zlib-nodejs-test.js | 2878 | // Step 4: concatenate both output chunks and decompress. | COMMENT |
| LOW⚡ | src/per_isolate/webstreams/writable.ts | 1181 | // Step 4: GetChunkSize — runs size() which may re-entrantly mutate | COMMENT |
| LOW⚡ | src/per_isolate/webstreams/writable.ts | 1188 | // Step 5: Re-check writer.[[stream]] — size() may have called | COMMENT |
| LOW⚡ | src/per_isolate/webstreams/writable.ts | 1214 | // Step 11: Add write request. | COMMENT |
| LOW⚡ | src/per_isolate/webstreams/writable.ts | 1217 | // Step 12: ControllerWrite (with pre-computed chunkSize, no size() | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | src/workerd/api/tests/js-rpc-test.js | 875 | await assert.rejects(() => env.MyService.objectProperty.nonRpc.bar.baz(), { | CODE |
| CRITICAL | src/workerd/api/tests/js-rpc-test.js | 887 | () => env.MyService.objectProperty.env.MyService.noArgsMethod(), | CODE |
| CRITICAL | src/pyodide/python-entrypoint-helper.ts | 149 | return await pyodide._module.API.pyodide_base.pyimport_impl.callPromising( | CODE |
| CRITICAL | src/pyodide/internal/pool/builtin_wrappers.ts | 102 | return API.config.jsglobals.Function.prototype.apply.apply(func, [ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/update_opencode_version.py | 38 | except Exception as e: | CODE |
| MEDIUM | tools/update_opencode_version.py | 39 | print(f"Error fetching latest opencode-ai version: {e}", file=sys.stderr) | CODE |
| LOW | tools/update_node_version.py | 39 | except Exception as e: | CODE |
| MEDIUM | tools/update_node_version.py | 40 | print(f"Error fetching tags: {e}", file=sys.stderr) | CODE |
| LOW | tools/cross/internal_build.py | 46 | except Exception as err: | CODE |
| LOW | tools/cross/internal_build.py | 82 | except Exception as err: | CODE |
| LOW | tools/cross/format.py | 324 | except Exception: | CODE |
| LOW | samples/python-benchmark/worker.py | 33 | except Exception: | CODE |
| LOW | …d/server/tests/python/metadata-read-overflow/worker.py | 21 | except Exception: | CODE |
| LOW | src/workerd/server/tests/python/sdk/worker.py | 385 | except Exception as exc: | CODE |
| LOW⚡ | src/workerd/server/tests/python/sdk/worker.py | 510 | except Exception as err: | CODE |
| LOW⚡ | src/workerd/server/tests/python/sdk/worker.py | 517 | except Exception as err: | CODE |
| LOW⚡ | src/workerd/server/tests/python/sdk/worker.py | 524 | except Exception as err: | CODE |
| LOW | …/workerd/server/tests/python/top-level-tests/worker.py | 54 | except Exception as e: | CODE |
| MEDIUM | src/pyodide/create_vendor_zip.py | 97 | print(f"Error: site-packages not found at {site_packages}") | CODE |
| LOW | src/pyodide/create_vendor_zip.py | 141 | except Exception as e: | CODE |
| MEDIUM | src/pyodide/create_vendor_zip.py | 142 | print(f"Error vendoring packages {package_names!r}: {e}") | CODE |
| MEDIUM | src/pyodide/create_vendor_zip.py | 170 | print("Error: Package name is required") | CODE |
| MEDIUM | src/pyodide/make_snapshots.py | 223 | print(f"Error: Directory {outdir} exists and is not empty", file=sys.stderr) | CODE |
| LOW | src/pyodide/internal/workers-api/src/asgi.py | 212 | except Exception as e: | CODE |
| LOW | src/pyodide/internal/workers-api/src/asgi.py | 300 | except Exception: | CODE |
| MEDIUM | src/pyodide/internal/workers-api/src/asgi.py | 205 | def run_app(): | CODE |
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 1300 | except Exception as exc: | CODE |
| MEDIUM | …c/pyodide/internal/workers-api/src/workers/_workers.py | 1290 | def _closure(): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | samples/web-streams/streams-util.js | 12 | // Sample words for generating lorem ipsum-style text | COMMENT |
| LOW | samples/web-streams/streams-util.js | 35 | // Creates a ReadableStream that generates random lorem ipsum-style text synchronously | COMMENT |
| LOW | samples/web-streams/streams-util.js | 51 | // Creates a ReadableStream that generates random lorem ipsum-style text asynchronously | COMMENT |
| LOW | samples/web-streams/streams-util.js | 68 | // Creates a byte ReadableStream that generates random lorem ipsum-style text synchronously | COMMENT |
| LOW | samples/web-streams/streams-util.js | 85 | // Creates a byte ReadableStream that generates random lorem ipsum-style text asynchronously | COMMENT |
| LOW⚡ | src/workerd/server/tests/python/sdk/worker.py | 265 | js_data.append("key", "lorem ipsum") | CODE |
| LOW⚡ | src/workerd/server/tests/python/sdk/worker.py | 266 | js_data.append("key", "dolor sit amet") | CODE |
| LOW⚡ | src/workerd/server/tests/python/sdk/worker.py | 269 | assert data["key"] == "lorem ipsum" | CODE |
| LOW⚡ | src/workerd/server/tests/python/sdk/worker.py | 270 | assert data.get_all("key") == ["lorem ipsum", "dolor sit amet"] | CODE |
| LOW⚡ | src/workerd/server/tests/python/sdk/worker.py | 270 | assert data.get_all("key") == ["lorem ipsum", "dolor sit amet"] | CODE |
| LOW | src/workerd/api/tests/http-test.js | 133 | hostname: 'placeholder', | CODE |
| LOW⚡ | src/workerd/api/node/tests/legacy_url-nodejs-test.js | 673 | 'm2@example.ord/c2@example.org', | CODE |
| LOW⚡ | src/workerd/api/node/tests/legacy_url-nodejs-test.js | 674 | 'mid:m@example.ord/c@example.org', | CODE |
| LOW⚡ | src/workerd/api/node/tests/legacy_url-nodejs-test.js | 675 | 'mid:m@example.ord/m2@example.ord/c2@example.org', | CODE |
| LOW | src/workerd/api/node/tests/legacy_url-nodejs-test.js | 716 | 'mailto:user@example.org', | CODE |
| LOW | src/workerd/api/node/tests/util-nodejs-test.js | 1845 | 'Lorem ipsum dolor\nsit amet,\tconsectetur adipiscing elit, sed do ' + | CODE |
| LOW | src/workerd/api/node/tests/util-nodejs-test.js | 1864 | " [ [ 'Lorem ipsum dolor\\nsit amet,\\tconsectetur adipiscing elit, " + | CODE |
| LOW | src/workerd/api/node/tests/util-nodejs-test.js | 1881 | " 'Lorem ipsum dolor\\n' +", | CODE |
| LOW | src/workerd/api/node/tests/util-nodejs-test.js | 1900 | "'Lorem ipsum dolor\\n' +", | CODE |
| LOW | src/workerd/api/node/tests/zlib-nodejs-test.js | 1166 | 'ΩΩLorem ipsum dolor sit amet, consectetur adipiscing eli' + | CODE |
| LOW | src/workerd/api/node/tests/zlib-nodejs-test.js | 1166 | 'ΩΩLorem ipsum dolor sit amet, consectetur adipiscing eli' + | CODE |
| LOW | src/workerd/api/node/tests/zlib-nodejs-test.js | 1485 | 'ΩΩLorem ipsum dolor sit amet, consectetur adipiscing eli' + | CODE |
| LOW | src/workerd/api/node/tests/zlib-nodejs-test.js | 1485 | 'ΩΩLorem ipsum dolor sit amet, consectetur adipiscing eli' + | CODE |
| LOW | src/workerd/api/node/tests/zlib-nodejs-test.js | 2161 | 'ΩΩLorem ipsum dolor sit amet, consectetur adipiscing eli' + | CODE |
| LOW | src/workerd/api/node/tests/zlib-nodejs-test.js | 2161 | 'ΩΩLorem ipsum dolor sit amet, consectetur adipiscing eli' + | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | src/workerd/api/tests/worker-loader-test.js | 1138 | // Step 1: sub-request sets up the pending promise via a separate entrypoint. | COMMENT |
| LOW⚡ | src/workerd/api/tests/worker-loader-test.js | 1143 | // Step 2: IoContext B has drained. Give the runtime a moment to clean up. | COMMENT |
| LOW⚡ | src/workerd/api/tests/worker-loader-test.js | 1146 | // Step 3: resolve the saved promise from IoContext A. The inner .then() continuation throws | COMMENT |
| LOW⚡ | …/workerd/api/tests/stdio-writesync-reentry-uaf-test.js | 50 | // Step 1: Prime lineBuffer with non-newline data (buffered, no | COMMENT |
| LOW⚡ | …/workerd/api/tests/stdio-writesync-reentry-uaf-test.js | 54 | // Step 2: Arm the getter and trigger the newline path. | COMMENT |
| LOW⚡ | src/workerd/api/node/tests/zlib-nodejs-test.js | 2850 | // Step 1: writeSync with Z_NO_FLUSH — data is buffered internally. | COMMENT |
| LOW⚡ | src/workerd/api/node/tests/zlib-nodejs-test.js | 2857 | // Step 2: params() directly on native handle — no preceding flush. | COMMENT |
| LOW⚡ | src/workerd/api/node/tests/zlib-nodejs-test.js | 2865 | // Step 3: finish the stream — must still produce a valid deflate stream. | COMMENT |
| LOW | src/workerd/api/node/tests/zlib-nodejs-test.js | 2878 | // Step 4: concatenate both output chunks and decompress. | COMMENT |
| LOW | src/node/internal/streams_readable.js | 1167 | // We need to check if there is someone still listening to | COMMENT |
| LOW | src/node/internal/streams_readable.js | 1186 | // We need to check if there is someone still listening to | COMMENT |
| LOW⚡ | src/per_isolate/webstreams/writable.ts | 1181 | // Step 4: GetChunkSize — runs size() which may re-entrantly mutate | COMMENT |
| LOW⚡ | src/per_isolate/webstreams/writable.ts | 1188 | // Step 5: Re-check writer.[[stream]] — size() may have called | COMMENT |
| LOW⚡ | src/per_isolate/webstreams/writable.ts | 1214 | // Step 11: Add write request. | COMMENT |
| LOW⚡ | src/per_isolate/webstreams/writable.ts | 1217 | // Step 12: ControllerWrite (with pre-computed chunkSize, no size() | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | samples/durable-objects-chat/chat.js | 448 | // We utilize this in ChatRoom, above, to apply a per-IP-address rate limit. These limits are | COMMENT |
| MEDIUM | src/workerd/io/worker-fs.h | 130 | // instances are kj::Refcounted objects. We utilize the Isolate lock to safely | COMMENT |
| MEDIUM | src/workerd/io/trace.h | 1176 | // Interface for writing a span. Essentially, this is a mutable interface to a `Span` object, | COMMENT |
| MEDIUM | src/workerd/api/basics.h | 979 | // Essentially an awaitable alternative to setTimeout(). The wait | COMMENT |
| MEDIUM | src/workerd/api/tests/actor-alarms-name-test.js | 59 | // sleep well past the 1000ms alarm delay to stay robust under CI load. | COMMENT |
| MEDIUM | src/rust/cxx/kj-rs/convert.h | 5 | // This header provides seamless integration between Rust types and KJ (Cap'n Proto's C++ library) | COMMENT |
| MEDIUM | src/rust/cxx/kj-rs/convert.h | 90 | // - kj::str(rust::String) - uses KJ_STRINGIFY for seamless string conversion | COMMENT |
| MEDIUM | src/rust/jsg/lib.rs | 629 | /// This is more robust than the global `isNaN()` because it doesn't coerce | COMMENT |
| LOW⚡ | …c/pyodide/internal/workers-api/src/workers/_workers.py | 913 | # entrypoint is being used, it makes sense to be less loud about it and just pass through the | COMMENT |
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 935 | # implement a Python wrapper for it, but for now we'll just pass in None. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/cross/format.py | 2 | CODE | |
| LOW | …d/server/tests/python/vendor_dir_compat_flag/worker.py | 6 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 4 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 9 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 30 | CODE | |
| LOW | src/pyodide/internal/topLevelEntropy/entropy_patches.py | 29 | CODE | |
| LOW | …ide/internal/topLevelEntropy/entropy_import_context.py | 27 | CODE | |
| LOW | …ide/internal/topLevelEntropy/entropy_import_context.py | 20 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/unix/apply-big-move.sh | 64 | # Check if there's a new "Big Move" in the future and, if so, prompt the user to apply it too. | COMMENT |
| LOW | tools/unix/apply-big-move.sh | 110 | # Check if we already applied The Big Move in this branch, as indicated by $AFTER_MOVE_TAG being | COMMENT |
| LOW | tools/unix/apply-big-move.sh | 124 | # Check if $BEFORE_MOVE_TAG is in this branch's history. If not, we need to rebase first. | COMMENT |
| LOW | tools/unix/apply-big-move.sh | 167 | # Check if there's another move upcoming that we should apply next. | COMMENT |
| LOW | .github/workflows/release-python-runtime.yml | 59 | # Check if there are changes to python_metadata.bzl | COMMENT |
| LOW | .github/workflows/release-python-runtime.yml | 67 | # Check if there's an open PR for this branch | COMMENT |
| LOW | .github/workflows/internal-build.yml | 19 | # Check if this is a fork and if the author is a Cloudflare org member | COMMENT |
| LOW | .github/workflows/release-python-snapshots.yml | 78 | # Check if there are changes to python_metadata.bzl | COMMENT |
| LOW | .github/workflows/release-python-snapshots.yml | 86 | # Check if there's an open PR for this branch | COMMENT |
| LOW | src/pyodide/internal/workers-api/src/asgi.py | 166 | # Check if this is a server-sent events response | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/update_node_version.py | 19 | CODE | |
| LOW | tools/cross/format.py | 267 | CODE | |
| LOW | ci/jsonc.py | 155 | CODE | |
| LOW | .github/scripts/check-compat-flag-docs.py | 187 | CODE | |
| LOW | src/workerd/server/tests/python/sdk/worker.py | 19 | CODE | |
| LOW | src/workerd/server/tests/python/sdk/server.py | 5 | CODE | |
| LOW | src/pyodide/pack_python_packages.py | 30 | CODE | |
| LOW | src/pyodide/create_vendor_zip.py | 102 | CODE | |
| LOW | src/pyodide/internal/workers-api/src/asgi.py | 117 | CODE | |
| LOW | src/pyodide/internal/workers-api/src/asgi.py | 157 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 889 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 207 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 665 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 1197 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/workerd/server/tests/python/python-rpc/worker.py | 196 | js_undefined = await env.PythonRpc.identity(js.undefined) | CODE |
| HIGH⚡ | …c/pyodide/internal/workers-api/src/workers/_workers.py | 908 | return Exception(value.toString()) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/cross/format.py | 15 | # This file is symlinked into the internal repo as tools/format.py, so the root may be two levels up | COMMENT |
| MEDIUM | tools/unix/create-external.sh | 3 | # Create a symlink to Bazel's external/ directory. This simplifies the | COMMENT |
| MEDIUM | src/pyodide/internal/workers-api/src/asgi.py | 151 | # Create a transform stream for handling streaming responses | COMMENT |
| MEDIUM | …c/pyodide/internal/workers-api/src/workers/_workers.py | 1 | # This module defines a Workers API for Python. It is similar to the API provided by | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/workerd/jsg/promise.h | 77 | // your own first. (Don't forget to implement `visitForGc()`.) | COMMENT |
| LOW | src/workerd/server/tests/container-client/test.js | 21 | // When writing a test, don't forget to call waitUntilContainerIsHealthy | COMMENT |
| LOW | src/workerd/api/http.h | 608 | // When adding new properties to this struct, don't forget to update Request::serialize(). | COMMENT |
| LOW⚡ | …c/pyodide/internal/workers-api/src/workers/_workers.py | 917 | # types here, so if you're doing this make sure to do so behind a compat flag. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/workerd/jsg/setup.h | 680 | // Example usage: | COMMENT |
| LOW | src/workerd/jsg/jsg.h | 95 | // Example usage: | COMMENT |
| LOW | src/workerd/jsg/iterator.h | 996 | // Example usage: | COMMENT |
| LOW | src/workerd/jsg/iterator.h | 1090 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | samples/nodejs-compat-diagnosticschannel/library.js | 5 | export function doSomething() { | CODE |
| LOW | samples/nodejs-compat/worker.js | 28 | function doSomething(a, cb) { | CODE |
| LOW | src/workerd/server/tests/python/python-rpc/worker.py | 48 | async def handle_request(self, req): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/workerd/api/js-writable-stream.h | 213 | // guardrails in the design doc). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/pyodide/upload_bundles.py | 98 | def update_python_metadata_bzl(bundles: list[BundleInfo]) -> None: | CODE |
| LOW | …c/pyodide/internal/workers-api/src/workers/__init__.py | 30 | __all__ = [ | CODE |
| LOW | …ide/internal/topLevelEntropy/entropy_import_context.py | 40 | __all__ = ["get_bad_entropy_flag"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 940 | CODE | |
| LOW | …c/pyodide/internal/workers-api/src/workers/_workers.py | 1000 | CODE |