RocksDB/LevelDB inspired key-value database in Go
This report summarizes scanner evidence for cockroachdb/pebble, a Go project with 6,051 GitHub stars. SynthScan examined 277,584 lines of code across 853 source files, recording 1400 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 5.8 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1374 finding(s).
Are imports declared and package/API names verified? 25 finding(s).
Are wrappers, guards, and repeated structures necessary? 6 finding(s).
Which changes need focused human review? 1400 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1400 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | blob_rewrite.go | 81 | // rewrites a blob file without rewriting sstables. When the compaction | COMMENT |
| LOW | range_keys.go | 61 | } | COMMENT |
| LOW | range_keys.go | 121 | func containsAnyRangeKeys(iter manifest.LevelIterator) bool { | COMMENT |
| LOW | range_keys.go | 141 | // RangeKeyMasking.Suffix, it acts as a mask. | COMMENT |
| LOW | range_keys.go | 161 | // | COMMENT |
| LOW | range_keys.go | 181 | // IterOptions.RangeKeyMasking field has an optional Filter option. This Filter | COMMENT |
| LOW | range_keys.go | 201 | // property filter interface with two new methods: KeyIsWithinLowerBound and | COMMENT |
| LOW | range_keys.go | 221 | // block property filter indicates that it does NOT intersect, the filter's | COMMENT |
| LOW | range_keys.go | 301 | // iteration. Whenever a point key is covered by a non-empty Span, the | COMMENT |
| LOW | range_keys.go | 321 | // s 8 | • l@8 | COMMENT |
| LOW | range_keys.go | 361 | return false | COMMENT |
| LOW | range_keys.go | 381 | // | COMMENT |
| LOW | range_keys.go | 421 | func (m *rangeKeyMasking) KeyIsWithinLowerBound(key []byte) bool { | COMMENT |
| LOW | range_keys.go | 441 | // lazyCombinedIter implements the internalIterator interface, wrapping a | COMMENT |
| LOW | range_keys.go | 461 | // When one is discovered, they set triggered=true and key to the smallest | COMMENT |
| LOW | range_keys.go | 481 | c.triggered = true | COMMENT |
| LOW | range_keys.go | 521 | // switch to combined iteration was itself a seek, and we can use that key. | COMMENT |
| LOW | range_keys.go | 541 | // L6: 000001:[bar.SET.2] 000002:[bax.RANGEKEYSET.8] | COMMENT |
| LOW | range_keys.go | 581 | // iterator that's now initialized with our current state. | COMMENT |
| LOW | checkpoint.go | 21 | COMMENT | |
| LOW | checkpoint.go | 41 | // performed with Sync = false. Otherwise, the guarantee will already be met. | COMMENT |
| LOW | checkpoint.go | 201 | virtualBackingFiles := make(map[base.DiskFileNum]struct{}) | COMMENT |
| LOW | recovery.go | 241 | Path: path, | COMMENT |
| LOW | recovery.go | 441 | // replayWAL replays the edits in the specified WAL. If the DB is in read | COMMENT |
| LOW | recovery.go | 541 | // surfaces record.ErrInvalidChunk or record.ErrZeroedChunk. These | COMMENT |
| LOW | table_stats.go | 21 | "github.com/cockroachdb/pebble/sstable/block" | COMMENT |
| LOW | table_stats.go | 41 | // so a completing job triggers a new job if necessary. Only one job runs at a | COMMENT |
| LOW | table_stats.go | 441 | // If the table is in the last level of the LSM, there is no data | COMMENT |
| LOW | table_stats.go | 461 | // deletion is ingested into L5 and subsequently compacted into L6 but | COMMENT |
| LOW | table_stats.go | 621 | // FileSize RawValueSize | COMMENT |
| LOW | table_stats.go | 641 | } | COMMENT |
| LOW | table_stats.go | 661 | func (d *DB) examineTablesBeneathTombstones( | COMMENT |
| LOW | table_stats.go | 681 | // Determine whether we need to update size estimates and | COMMENT |
| LOW | table_stats.go | 821 | } | COMMENT |
| LOW | table_stats.go | 861 | return 0 | COMMENT |
| LOW | table_stats.go | 881 | // point tombstone on average covers 1 key and using average value sizes. | COMMENT |
| LOW | table_stats.go | 921 | // The shadowed keys have the same exact user keys as the tombstones | COMMENT |
| LOW | table_stats.go | 941 | return uint64((tombstonesLogicalSize + shadowedLogicalSize) * compressionRatio) | COMMENT |
| LOW | table_stats.go | 961 | // of both range deletions and range key deletions. | COMMENT |
| LOW | table_stats.go | 981 | // |--------| |-------| RANGEKEYDEL | COMMENT |
| LOW | table_stats.go | 1061 | mIter.Init(comparer, transform, new(keyspanimpl.MergingBuffers)) | COMMENT |
| LOW | table_stats.go | 1081 | // SSTables" where the table metadata's effective bounds can again be | COMMENT |
| LOW | ingest_test.go | 2881 | COMMENT | |
| LOW | ingest_test.go | 2901 | time.Sleep(100 * time.Millisecond) | COMMENT |
| LOW | merging_iter_v2_slab.go | 21 | // merging iterator. | COMMENT |
| LOW | merging_iter_v2_slab.go | 41 | } | COMMENT |
| LOW | event.go | 281 | // JobID is the ID of the compaction job. | COMMENT |
| LOW | event.go | 381 | JobID int | COMMENT |
| LOW | event.go | 621 | } | COMMENT |
| LOW | event.go | 861 | // SINGLEDEL and delete an arbitrary subset of data below that SINGLEDEL. | COMMENT |
| LOW | event.go | 881 | // ways some of these keys can first meet in a compaction. | COMMENT |
| LOW | event.go | 901 | // SET g#40 in L2 | COMMENT |
| LOW | event.go | 921 | // violation callback. This example doesn't need multi-level compactions: | COMMENT |
| LOW | event.go | 981 | COMMENT | |
| LOW | compaction_value_separation.go | 181 | // existing references. | COMMENT |
| LOW | level_iter_v2.go | 21 | // levelIterV2 provides a merged view of the sstables in a level. | COMMENT |
| LOW | level_iter_v2.go | 41 | // | COMMENT |
| LOW | level_iter_v2.go | 61 | // potentially spurious: it does not necessarily correspond to a change in range | COMMENT |
| LOW | level_iter_v2.go | 81 | // tableOpts.{Lower,Upper}Bound are nil, the corresponding iteration boundary | COMMENT |
| LOW | level_iter_v2.go | 101 | iterFile *manifest.TableMetadata | COMMENT |
| 1269 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | checkpoint.go | 202 | for backing := range d.mu.versions.latest.virtualBackings.All() { | CODE |
| CRITICAL | checkpoint.go | 205 | versionBlobFiles := d.mu.versions.latest.blobFiles.Metadatas() | CODE |
| CRITICAL | db.go | 2312 | backingStats := d.mu.versions.latest.virtualBackings.Stats() | CODE |
| CRITICAL | db.go | 2313 | blobStats, _ := d.mu.versions.latest.blobFiles.Stats() | CODE |
| CRITICAL | db.go | 2748 | l0ReadAmp := d.mu.versions.latest.l0Organizer.ReadAmplification() | CODE |
| CRITICAL | db.go | 2938 | if err := d.mu.log.metrics.LogWriterMetrics.Merge(&metrics); err != nil { | CODE |
| CRITICAL | ingest.go | 1034 | if backing, ok := d.mu.versions.latest.virtualBackings.Get(n); ok { | CODE |
| CRITICAL | ingest.go | 1037 | d.mu.versions.latest.virtualBackings.Protect(n) | CODE |
| CRITICAL | ingest.go | 1062 | d.mu.versions.latest.virtualBackings.Unprotect(meta.TableBacking.DiskFileNum) | CODE |
| CRITICAL | checkpoint_test.go | 160 | fileNums := d.mu.versions.latest.virtualBackings.DiskFileNums() | CODE |
| CRITICAL | compaction_test.go | 1195 | s := d.mu.versions.latest.virtualBackings.String() | CODE |
| CRITICAL | compaction.go | 396 | if err := d.mu.versions.latest.l0Organizer.UpdateStateForStartedCompaction(l0Inputs, isBase); err != nil { | CODE |
| CRITICAL | compaction.go | 1354 | d.mu.versions.latest.l0Organizer.InitCompactingFileInfo(l0InProgress) | CODE |
| CRITICAL | iterator.go | 2529 | i.readState.db.mu.compact.readCompactions.combine(&i.readSampling.pendingCompactions, i.cmp) | CODE |
| CRITICAL | snapshot.go | 97 | s.db.mu.compact.wideTombstones.UpdateWithEarliestSnapshot(e) | CODE |
| CRITICAL | snapshot.go | 424 | es.db.mu.compact.cond.Wait() | CODE |
| CRITICAL | sstable/reader_iter_two_lvl.go | 525 | smallest = i.secondLevel.reader.Comparer.Split.Prefix(smallest) | CODE |
| CRITICAL | sstable/reader_iter_two_lvl.go | 527 | largest = i.secondLevel.reader.Comparer.Split.Prefix(largest) | CODE |
| CRITICAL | sstable/reader_iter_two_lvl.go | 1051 | return i.seekPrefixGE(i.secondLevel.reader.Comparer.Split.Prefix(i.secondLevel.synthetic.seekKey), | CODE |
| CRITICAL | metamorphic/generator.go | 911 | key = g.keyManager.kf.Comparer.Split.Prefix(key) | CODE |
| CRITICAL | metamorphic/cockroachkvs.go | 268 | if !kg.keyManager.prefixExists(kg.keyManager.kf.Comparer.Split.Prefix(key)) { | CODE |
| CRITICAL | objstorage/objstorageprovider/cold_writable.go | 102 | w.meta.file, w.err = w.p.st.Local.FS.Create(w.metaPath(), w.diskWriteCategory) | CODE |
| CRITICAL | objstorage/objstorageprovider/cold_writable.go | 167 | _ = w.p.st.Local.FS.Remove(w.metaPath()) | CODE |
| CRITICAL | objstorage/objstorageprovider/vfs.go | 245 | fsDir, err := p.st.Local.ColdTier.FS.OpenDir(p.st.Local.ColdTier.FSDirName) | CODE |
| CRITICAL | objstorage/objstorageprovider/vfs.go | 251 | coldListing, err := p.st.Local.ColdTier.FS.List(p.st.Local.ColdTier.FSDirName) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | compaction.go | 208 | // NOTE: This function iterates up to compactionKindVirtualRewrite. If a new | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 125 | # Step 3: Build clean HEAD test binary | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 133 | # Step 4: Run crossversion test WITHOUT the bug (should PASS) | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 167 | # Step 5: Apply the intentional bug patch | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 177 | # Step 6: Build buggy HEAD test binary | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 185 | # Step 7: Test buggy version by itself (should PASS - verifies patch doesn't break single-version) | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 219 | # Step 8: Revert the patch | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 225 | # Step 9: Run crossversion test WITH the bug multiple times (should FAIL at least once) | COMMENT |
| LOW | scripts/crossversion_smoke_test.sh | 93 | # Step 1: Find the latest release branch | COMMENT |
| LOW | scripts/crossversion_smoke_test.sh | 111 | # Step 2: Build test binary from release branch | COMMENT |
| LOW | scripts/crossversion_smoke_test.sh | 264 | # Step 10: Verify that the test failed in phase 2 | COMMENT |
| LOW⚡ | .github/workflows/cockroach-go.yaml | 55 | # Step 1: Fetch the branch tip SHA for cache key | COMMENT |
| LOW⚡ | .github/workflows/cockroach-go.yaml | 62 | # Step 2: Restore cache (per branch + commit SHA) | COMMENT |
| LOW⚡ | .github/workflows/cockroach-go.yaml | 69 | # Step 3: Install bootstrap Go (needed to build fork) | COMMENT |
| LOW⚡ | .github/workflows/cockroach-go.yaml | 75 | # Step 4: Run tests with custom Go | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | scripts/crossversion_smoke_test.sh | 125 | # Step 3: Build clean HEAD test binary | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 133 | # Step 4: Run crossversion test WITHOUT the bug (should PASS) | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 167 | # Step 5: Apply the intentional bug patch | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 177 | # Step 6: Build buggy HEAD test binary | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 185 | # Step 7: Test buggy version by itself (should PASS - verifies patch doesn't break single-version) | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 219 | # Step 8: Revert the patch | COMMENT |
| LOW⚡ | scripts/crossversion_smoke_test.sh | 225 | # Step 9: Run crossversion test WITH the bug multiple times (should FAIL at least once) | COMMENT |
| LOW | scripts/crossversion_smoke_test.sh | 93 | # Step 1: Find the latest release branch | COMMENT |
| LOW | scripts/crossversion_smoke_test.sh | 111 | # Step 2: Build test binary from release branch | COMMENT |
| LOW | scripts/crossversion_smoke_test.sh | 264 | # Step 10: Verify that the test failed in phase 2 | COMMENT |
| LOW⚡ | .github/workflows/cockroach-go.yaml | 55 | # Step 1: Fetch the branch tip SHA for cache key | COMMENT |
| LOW⚡ | .github/workflows/cockroach-go.yaml | 62 | # Step 2: Restore cache (per branch + commit SHA) | COMMENT |
| LOW⚡ | .github/workflows/cockroach-go.yaml | 69 | # Step 3: Install bootstrap Go (needed to build fork) | COMMENT |
| LOW⚡ | .github/workflows/cockroach-go.yaml | 75 | # Step 4: Run tests with custom Go | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ingest.go | 1183 | // for data overlap is a little more nuanced. Consider the following examples: | COMMENT |
| MEDIUM | iterator.go | 1416 | // We also leverage the IterAtLimit <=> i.pos invariant defined in the | COMMENT |
| MEDIUM | sstable/format.go | 109 | // The ideal solution for P2 would allow user-facing reads to utilize the | COMMENT |
| MEDIUM | sstable/format.go | 203 | // For robust correctness, non-obsolete SINGLEDELs in foreign sstables should | COMMENT |
| MEDIUM | sstable/reader_iter.go | 113 | // An implication of the above is that if we are going to somehow utilize | COMMENT |
| MEDIUM | internal/compact/iterator.go | 133 | // that backs a compact.Iter is nuanced and care must be taken when | COMMENT |
| MEDIUM | internal/iterv2/iter.go | 115 | // A more nuanced example: | COMMENT |
| MEDIUM | internal/base/lazy_value.go | 176 | // iterator that initially provided this LazyValue. Hence, to utilize this | COMMENT |
| MEDIUM | objstorage/objstorageprovider/remote_readable.go | 208 | // could enhance this to utilize a suffix of the needed data. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/js/write-throughput.js | 12 | function writeThroughputSummaryURL() { | CODE |
| LOW | docs/js/write-throughput.js | 37 | function bisectAndRenderWriteThroughputDetail(data, detailDate) { | CODE |
| LOW | docs/js/write-throughput.js | 64 | function renderWriteThroughputSummary(allData) { | CODE |
| LOW | docs/js/write-throughput.js | 304 | function fetchWriteThroughputSummaryData(file) { | CODE |
| LOW | docs/js/write-throughput.js | 334 | function renderWriteThroughputSummaryDetail(workload, date, opsSec, rawData) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | internal/rangekeystack/user_iterator.go | 45 | // ╭────────────────┴───────────────╮ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sstable/external_reader.go | 19 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | internal/lint/lint_test.go | 361 | "Don't forget to add amend the result to the correct commits.", | CODE |