Home / codeigniter4 / CodeIgniter4
AI Slop Code RIsk Monitor

codeigniter4/CodeIgniter4

Open Source PHP Framework (originally from EllisLab)

9.9 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for codeigniter4/CodeIgniter4, a PHP project with 5,985 GitHub stars. SynthScan examined 283,200 lines of code across 3109 source files, recording 2842 pattern matches distributed across 5 syntactic categories. The legacy adjusted pattern signal is 9.9 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

9.9
Adjusted Signal
9.9
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
6.0K
Stars
PHP
Language
283.2K
Lines of Code
3.1K
Files
2.8K
Pattern Hits
2026-10-12
Scan Date
0.00
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 38.2/100 · MEDIUM

Can maintainers explain intent, assumptions, and trade-offs? 2774 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.3/100 · LOW

Are imports declared and package/API names verified? 68 finding(s).

Agent Over-Engineering Ratio 38.0/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 2751 finding(s).

PR Review Velocity Impact 39.5/100 · MEDIUM

Which changes need focused human review? 2842 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 1LOW 2841

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 2842 distinct pattern matches across 5 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers2751 hits · 2703 pts
SeverityFileLineSnippetContext
LOWtests/_support/API/ParentTransformer.php46 protected function includeChildrenCollection(): arrayCODE
LOWtests/system/DebugTraceableTraitTest.php27 public function testFactoryInstanceReturnsWhereItIsRaised(): voidCODE
LOWtests/system/CommonSingleServiceTest.php33 public function testSingleServiceWithNoParamsSupplied(string $service): voidCODE
LOWtests/system/CommonSingleServiceTest.php47 public function testSingleServiceWithAtLeastOneParamSupplied(string $service): voidCODE
LOWtests/system/CommonSingleServiceTest.php121 public function testSingleServiceWithAllParamsSupplied(): voidCODE
LOWtests/system/CommonSingleServiceTest.php135 public function testSingleServiceWithGibberishGiven(): voidCODE
LOWtests/system/ControllerTest.php115 public function testValidateWithStringRulesNotFound(): voidCODE
LOWtests/system/ControllerTest.php127 public function testValidateWithStringRulesFoundReadMessagesFromValidationConfig(): voidCODE
LOWtests/system/ControllerTest.php157 public function testValidateWithStringRulesFoundUseMessagesParameter(): voidCODE
LOWtests/system/ControllerTest.php205 public function testValidateDataWithCustomErrorMessage(): voidCODE
LOWtests/system/ControllerTest.php238 public function testValidateDataWithCustomErrorMessageLabeledStyle(): voidCODE
LOWtests/system/CommonFunctionsSendTest.php43 public function testRedirectResponseCookiesSent(): voidCODE
LOWtests/system/SuperglobalsTest.php46 public function testServerGetReturnsNullForNonExistent(): voidCODE
LOWtests/system/SuperglobalsTest.php114 public function testGetReturnsNullForNonExistent(): voidCODE
LOWtests/system/SuperglobalsTest.php164 public function testPostReturnsNullForNonExistent(): voidCODE
LOWtests/system/SuperglobalsTest.php214 public function testCookieReturnsNullForNonExistent(): voidCODE
LOWtests/system/SuperglobalsTest.php264 public function testRequestReturnsNullForNonExistent(): voidCODE
LOWtests/system/SuperglobalsTest.php324 public function testFilesSetArrayWithMultipleFiles(): voidCODE
LOWtests/system/SuperglobalsTest.php369 public function testGetGlobalArrayForFiles(): voidCODE
LOWtests/system/SuperglobalsTest.php386 public function testGetGlobalArrayThrowsExceptionForInvalidName(): voidCODE
LOWtests/system/SuperglobalsTest.php404 public function testSetGlobalArrayForFiles(): voidCODE
LOWtests/system/SuperglobalsTest.php422 public function testSetGlobalArrayThrowsExceptionForInvalidName(): voidCODE
LOWtests/system/SuperglobalsTest.php431 public function testConstructorWithCustomArrays(): voidCODE
LOWtests/system/SuperglobalsTest.php458 public function testConstructorSynchronizesWithPhpSuperglobals(): voidCODE
LOWtests/system/SuperglobalsTest.php487 public function testFluentApiMethodChaining(): voidCODE
LOWtests/system/SuperglobalsTest.php519 public function testFluentApiWithArraySetters(): voidCODE
LOWtests/system/SuperglobalsTest.php536 public function testFluentApiMixedOperations(): voidCODE
LOWtests/system/CodeIgniterTest.php90 public function testOutputBufferingControl(): voidCODE
LOWtests/system/CodeIgniterTest.php100 public function testRunEmptyDefaultRouteReturnResponse(): voidCODE
LOWtests/system/CodeIgniterTest.php222 public function testControllersCanReturnString(): voidCODE
LOWtests/system/CodeIgniterTest.php246 public function testControllersCanReturnResponseObject(): voidCODE
LOWtests/system/CodeIgniterTest.php273 public function testControllersCanReturnDownloadResponseObject(): voidCODE
LOWtests/system/CodeIgniterTest.php297 public function testRunExecuteFilterByClassName(): voidCODE
LOWtests/system/CodeIgniterTest.php325 public function testRegisterSameFilterTwiceWithDifferentArgument(): voidCODE
LOWtests/system/CodeIgniterTest.php363 public function testDisableControllerFilters(): voidCODE
LOWtests/system/CodeIgniterTest.php419 public function testTransfersCorrectHTTPVersion(): voidCODE
LOWtests/system/CodeIgniterTest.php451 public function testIgnoringErrorSuppressedByAt(): voidCODE
LOWtests/system/CodeIgniterTest.php492 public function testRunRedirectionWithNamed(): voidCODE
LOWtests/system/CodeIgniterTest.php516 public function testRunRedirectionWithURI(): voidCODE
LOWtests/system/CodeIgniterTest.php543 public function testRunRedirectionWithGET(): voidCODE
LOWtests/system/CodeIgniterTest.php661 public function testNotStoresPreviousURLByCheckingContentType(): voidCODE
LOWtests/system/CodeIgniterTest.php723 public function testSpoofRequestMethodCanUsePUT(): voidCODE
LOWtests/system/CodeIgniterTest.php748 public function testSpoofRequestMethodCannotUseGET(): voidCODE
LOWtests/system/CodeIgniterTest.php776 public function testPageCacheSendSecureHeaders(): voidCODE
LOWtests/system/CodeIgniterTest.php841 public function testPageCacheWithCacheQueryString(CODE
LOWtests/system/CodeIgniterTest.php910 public static function providePageCacheWithCacheQueryString(): iterableCODE
LOWtests/system/CodeIgniterTest.php947 public function testRunControllerNotFoundBeforeFilter(): voidCODE
LOWtests/system/CodeIgniterTest.php970 public function testStartControllerPermitsInvoke(): voidCODE
LOWtests/system/CodeIgniterTest.php989 public function testRouteAttributeCacheIntegration(): voidCODE
LOWtests/system/CodeIgniterTest.php1049 public function testRouteAttributeFilterIntegration(): voidCODE
LOWtests/system/CodeIgniterTest.php1077 public function testRouteAttributeFilterWithParamsIntegration(): voidCODE
LOWtests/system/CodeIgniterTest.php1105 public function testRouteAttributeRestrictIntegration(): voidCODE
LOWtests/system/CodeIgniterTest.php1127 public function testRouteAttributeRestrictThrowsException(): voidCODE
LOWtests/system/CodeIgniterTest.php1148 public function testRouteAttributeMultipleAttributesIntegration(): voidCODE
LOWtests/system/CodeIgniterTest.php1176 public function testRouteAttributeNoAttributesIntegration(): voidCODE
LOWtests/system/CodeIgniterTest.php1198 public function testRouteAttributeCustomCacheKeyIntegration(): voidCODE
LOWtests/system/CodeIgniterTest.php1232 public function testRouteAttributesDisabledInConfig(): voidCODE
LOWtests/system/CodeIgniterTest.php1312 public function testGatherOutputCalledOnceWhenControllerReturnsResponse(): voidCODE
LOWtests/system/HomeTest.php29 public function testPageLoadsSuccessfully(): voidCODE
LOWtests/system/CommonHelperTest.php95 public function testHelperWithFatalLocatorThrowsException(): voidCODE
2691 more matches not shown…
Fake / Example Data68 hits · 76 pts
SeverityFileLineSnippetContext
LOW⚡tests/system/Models/DataConverterModelTest.php293 $user['email'][] = 'private@example.org';CODE
LOW⚡tests/system/Models/DataConverterModelTest.php300 'private@example.org',CODE
LOW⚡tests/system/Models/DataConverterModelTest.php309 $user->email[] = 'private@example.org';CODE
LOW⚡tests/system/Models/DataConverterModelTest.php316 'private@example.org',CODE
LOW⚡tests/system/Models/DataConverterModelTest.php326 $user->addEmail('private@example.org');CODE
LOW⚡tests/system/Models/DataConverterModelTest.php333 'private@example.org',CODE
LOW⚡tests/system/Models/DataConverterModelTest.php343 $email[] = 'private@example.org';CODE
LOW⚡tests/system/Models/DataConverterModelTest.php351 'private@example.org',CODE
LOW⚡tests/system/Models/DataConverterModelTest.php360 $user['email'][] = 'private@example.org';CODE
LOW⚡tests/system/Models/DataConverterModelTest.php367 'private@example.org',CODE
LOW⚡tests/system/Models/DataConverterModelTest.php376 $user->email[] = 'private@example.org';CODE
LOW⚡tests/system/Models/DataConverterModelTest.php383 'private@example.org',CODE
LOW⚡tests/system/Models/DataConverterModelTest.php393 $user->addEmail('private@example.org');CODE
LOW⚡tests/system/Models/DataConverterModelTest.php400 'private@example.org',CODE
LOW⚡tests/system/Models/DataConverterModelTest.php410 $email[] = 'private@example.org';CODE
LOW⚡tests/system/Models/DataConverterModelTest.php418 'private@example.org',CODE
LOWtests/system/Models/UpdateModelTest.php398 $entity->email = 'jones@example.org';CODE
LOWtests/system/Models/UpdateModelTest.php419 $object->email = 'jones@example.org';CODE
LOW⚡tests/system/Models/UpdateModelTest.php440 $object->email = 'jones@example.org';CODE
LOW⚡tests/system/Models/UpdateModelTest.php448 'email' => 'john@example.org',CODE
LOWtests/system/HTTP/CURLRequestTest.php1404 $jsonBody = '{"name":"John Doe","age":30}';CODE
LOWtests/system/View/TableTest.php392 'email' => ['data' => 'foo@bar.com'],CODE
LOW⚡tests/system/View/ParserTest.php94 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOW⚡tests/system/View/ParserTest.php94 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOW⚡tests/system/View/ParserTest.php109 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOW⚡tests/system/View/ParserTest.php109 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOW⚡tests/system/View/ParserTest.php115 $result = "Page Title\nLorem ipsum dolor sit amet.";CODE
LOW⚡tests/system/View/ParserTest.php115 $result = "Page Title\nLorem ipsum dolor sit amet.";CODE
LOWtests/system/View/ParserTest.php79 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOWtests/system/View/ParserTest.php79 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOWtests/system/View/ParserTest.php1287 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOWtests/system/View/ParserTest.php1287 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOWtests/system/View/ParserTest.php1302 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOWtests/system/View/ParserTest.php1302 'body' => 'Lorem ipsum dolor sit amet.',CODE
LOWtests/system/View/ParserTest.php1566 'body' => 'Lorem ipsum',CODE
LOWtests/system/View/ParserTest.php1583 <p>Lorem ipsum</p>CODE
LOWtests/system/View/DBResultDummy.php36 'name' => 'John Doe',CODE
LOWtests/system/View/DBResultDummy.php41 'email' => 'foo@bar.com',CODE
LOWtests/system/Format/XMLFormatterTest.php161 'email' => 'foo@bar.com',CODE
LOWtests/system/Commands/Housekeeping/ClearLogsTest.php69 file_put_contents($path, 'Lorem ipsum');CODE
LOWtests/system/Commands/Housekeeping/ClearLogsTest.php155 file_put_contents($path, 'Lorem ipsum');CODE
LOWtests/system/Email/EmailTest.php605 $email->setFrom('john@example.com', 'John Doe');CODE
LOWtests/system/Email/EmailTest.php608 $this->assertSame('"John Doe" <john@example.com>', $headers['From']);CODE
LOWtests/system/Validation/ValidationTest.php2231 'name' => 'John Doe',CODE
LOWtests/system/Validation/ValidationTest.php2252 'name' => 'John Doe',CODE
LOWtests/system/Router/RouteCollectionTest.php752 $routes->resource('photos', ['placeholder' => ':num']);CODE
LOWsystem/Router/RouteCollection.php719 * 'placeholder' - The regex used by the Router. Defaults to '(:any)'COMMENT
LOWsystem/Router/RouteCollection.php760 $id = $options['placeholder'] ?? $this->placeholders[$this->defaultPlaceholder] ?? '(:segment)';CODE
LOWsystem/Router/RouteCollection.php818 * 'placeholder' - The regex used by the Router. Defaults to '(:any)'COMMENT
LOWsystem/Router/RouteCollection.php854 $id = $options['placeholder'] ?? $this->placeholders[$this->defaultPlaceholder] ?? '(:segment)';CODE
LOWuser_guide_src/source/database/queries/019.php11$name = 'John Doe';CODE
LOWuser_guide_src/source/outgoing/api_transformers/015.php7$user->name = 'John Doe';CODE
LOWuser_guide_src/source/outgoing/api_transformers/014.php7 'name' => 'John Doe',CODE
LOWuser_guide_src/source/outgoing/api_transformers/013.php8 'name' => 'John Doe',CODE
LOWuser_guide_src/source/outgoing/api_transformers/007.php22// Response: {"id": 1, "name": "John Doe"}COMMENT
LOWuser_guide_src/source/outgoing/api_transformers/018.php13$userData = ['id' => 1, 'name' => 'John Doe'];CODE
LOWuser_guide_src/source/cli/cli_library/017.php10 'Lorem Ipsum is simply dummy text of the printing and typesetting industry.',CODE
LOWuser_guide_src/source/cli/cli_library/017.php11 "Lorem Ipsum has been the industry's standard dummy text ever since the",CODE
LOWuser_guide_src/source/testing/fabricator/009.php5 'email' => 'king.alford@example.org',CODE
LOWuser_guide_src/source/testing/fabricator/018.php5 'email' => 'belingadon142@example.org',CODE
8 more matches not shown…
Over-Commented Block20 hits · 20 pts
SeverityFileLineSnippetContext
LOWapp/Config/Logger.php141 // /* The log levels this handler can handle. */COMMENT
LOWapp/Config/UserAgents.php121 */COMMENT
LOWapp/Config/Database.php61 // 'DBDriver' => 'SQLite3',COMMENT
LOWapp/Config/Database.php81 // public array $default = [COMMENT
LOWapp/Config/Database.php101 // ];COMMENT
LOWapp/Config/Database.php121 // 'encrypt' => false,COMMENT
LOWapp/Config/Database.php141 // */COMMENT
LOWapp/Config/Validation.php41 // --------------------------------------------------------------------COMMENT
LOWtests/system/CodeIgniterTest.php921 // URL #5COMMENT
LOWtests/system/Database/Live/TransactionTest.php81 ];COMMENT
LOWsystem/Debug/Toolbar/Views/toolbar.css361COMMENT
LOWsystem/Debug/Toolbar/Views/toolbar.css501 background-color: #252525;COMMENT
LOWsystem/Debug/Toolbar/Views/toolbar.css621#toolbarContainer.dark #debug-bar button,COMMENT
LOWsystem/Debug/Toolbar/Views/toolbar.css721 -webkit-box-shadow: 0 0 4px #DFDFDF;COMMENT
LOWuser_guide_src/source/conf.py1# Configuration file for the Sphinx documentation builder.COMMENT
LOWuser_guide_src/source/database/query_builder/108.php21// SQLite3 produces: INSERT INTO.. ON CONFLICT.. DO UPDATE..COMMENT
LOWuser_guide_src/source/outgoing/api_transformers/007.php21// Request: GET /users/1?fields=id,nameCOMMENT
LOWuser_guide_src/source/incoming/routing/074.php21// [priority] => 1COMMENT
LOW.github/scripts/random-tests-config.txt1# CodeIgniter4 Components Verified for Random Test ExecutionCOMMENT
LOW.github/scripts/run-random-tests.sh1#!/usr/bin/env bashCOMMENT
Self-Referential Comments1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUM.github/workflows/deploy-userguide-latest.yml60 # Create an artifact of the html outputCOMMENT
Slop Phrases2 hits · 2 pts
SeverityFileLineSnippetContext
LOWapp/Config/Session.php70 * WARNING: If you're using the database driver, don't forget to updateCOMMENT
LOWpublic/index.php12$minPhpVersion = '8.2'; // If you update this, don't forget to update `spark`.CODE