1.3

Adjusted Signal

1.3

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

21.4K

Stars

Language

307.7K

Lines of Code

1.6K

Files

336

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 324 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 1 finding(s).

Agent Over-Engineering Ratio 0.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 11 finding(s).

PR Review Velocity Impact 6.1/100 · LOW

Which changes need focused human review? 336 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 6MEDIUM 11LOW 319

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 336 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block305 hits · 305 pts

Severity	File	Line	Snippet	Context
LOW	cmd/containerd/server/server.go	101	// setTempDirEnv points the process' temp-directory environment variables at	COMMENT
LOW	cmd/containerd/server/config/config.go	61	Version int `toml:"version"`	COMMENT
LOW	cmd/containerd/server/config/config.go	81	OOMScore int `toml:"oom_score"`	COMMENT
LOW	cmd/containerd/server/config/config.go	101	// In configs prior to version 4, an unset TTRPC address is derived from	COMMENT
LOW	cmd/containerd/command/service_windows.go	201	if runServiceFlag {	COMMENT
LOW	cmd/containerd/command/service_windows.go	221	}	COMMENT
LOW	cmd/containerd-shim-runc-v2/task/service.go	121	running map[int][]containerProcess // pid -> running process, guarded by lifecycleMu	COMMENT
LOW	cmd/containerd-shim-runc-v2/task/service.go	141	}	COMMENT
LOW	cmd/containerd-shim-runc-v2/process/init.go	41	"golang.org/x/sys/unix"	COMMENT
LOW	core/metrics/cgroups/v1/metrics.go	81	//	COMMENT
LOW	core/metrics/cgroups/v2/metrics.go	61	task common.Statable	COMMENT
LOW	core/metrics/cgroups/v2/metrics.go	81	//	COMMENT
LOW	core/snapshots/snapshotter.go	41	// snapshot protocol). It is inherited by FilterInheritedLabels.	COMMENT
LOW	core/snapshots/snapshotter.go	161		COMMENT
LOW	core/snapshots/snapshotter.go	181	// with Commit. Active snapshots never become committed snapshots and vice	COMMENT
LOW	core/snapshots/snapshotter.go	201	// # Importing a Layer	COMMENT
LOW	core/snapshots/snapshotter.go	221	// the active snapshot. Mount this to the temporary location with the	COMMENT
LOW	core/snapshots/snapshotter.go	241	//	COMMENT
LOW	core/snapshots/snapshotter.go	261	//	COMMENT
LOW	core/snapshots/snapshotter.go	281	type Snapshotter interface {	COMMENT
LOW	core/snapshots/snapshotter.go	301	// the calculation.	COMMENT
LOW	core/snapshots/snapshotter.go	321	// The changes may be saved to a committed snapshot by calling Commit. When	COMMENT
LOW	core/snapshots/snapshotter.go	341		COMMENT
LOW	core/snapshots/snapshotter.go	361	// snapshotter which match the provided filters. If no filters are	COMMENT
LOW	core/snapshots/testsuite/issues.go	241	return err	COMMENT
LOW	core/snapshots/testsuite/issues.go	261	// See https://github.com/docker/docker/issues/19082	COMMENT
LOW	core/images/handlers.go	181	// handler may return `ErrSkipDesc` to signal to the dispatcher to not traverse	COMMENT
LOW	core/images/handlers.go	261	// ChildrenHandler decodes well-known manifest types and returns their children.	COMMENT
LOW	core/images/image.go	141	// Manifest resolves a manifest from the image for the given platform.	COMMENT
LOW	core/runtime/v2/task_mounts.go	41	// runtime-allow-mounts annotation, for a shim that does not attach a	COMMENT
LOW	core/runtime/v2/task_mounts_deprecated.go	21	"strings"	COMMENT
LOW	core/runtime/v2/task_mounts_deprecated.go	41	// deprecatedAllowedMounts, so querying them for it is skipped entirely. This	COMMENT
LOW	core/runtime/v2/socket_windows.go	21	// terminator gives 107 usable characters. The socket path passed to	COMMENT
LOW	core/runtime/v2/socket_unix.go	21	// maxSocketDirLen is the maximum length of the socket directory path.	COMMENT
LOW	core/runtime/v2/shim.go	201	// startup — so each call is bounded, and detached from the caller's context,	COMMENT
LOW	core/runtime/v2/shim.go	241	ID() string	COMMENT
LOW	core/runtime/v2/shim.go	261	// that does not implement it is treated as having advertised nothing.	COMMENT
LOW	core/runtime/v2/shim.go	401	}	COMMENT
LOW	core/runtime/v2/shim.go	661	// closed, the shimErr will not be nil. For this case, the event	COMMENT
LOW	core/runtime/v2/socket_linux.go	21	// null terminator gives 107 usable characters. The socket path passed	COMMENT
LOW	core/transfer/image/imagestore.go	61	type Reference struct {	COMMENT
LOW	core/transfer/local/transfer.go	181	type TransferConfig struct {	COMMENT
LOW	core/content/content.go	21	"io"	COMMENT
LOW	core/content/content.go	61	}	COMMENT
LOW	core/remotes/handlers.go	61	// The returned key is used as a content-store reference to correlate ongoing	COMMENT
LOW	core/remotes/docker/registry.go	21	"errors"	COMMENT
LOW	core/remotes/docker/registry.go	41	// \| Public Registry \| yes \| yes \| yes \|	COMMENT
LOW	core/remotes/docker/resolver.go	61	// contain large annotations or be non-images. A proper manifest	COMMENT
LOW	core/remotes/docker/resolver.go	101	// since the registry does not have upload tracking and the existing	COMMENT
LOW	core/remotes/docker/resolver.go	121	// Deprecated: use Hosts.	COMMENT
LOW	core/remotes/docker/fetcher.go	81	// - Buffer Recycling: Retrieved from/pushed to a pool to minimize allocations, reducing	COMMENT
LOW	core/remotes/docker/config/hosts.go	341	// - pull	COMMENT
LOW	core/remotes/docker/config/hosts_resolver_test.go	61	// The hosts.toml has a server and mirror.	COMMENT
LOW	core/remotes/docker/auth/parse.go	61	isToken octetType = 1 << iota	COMMENT
LOW	core/mount/manager.go	41	// Handler is an interface for plugins to perform a mount which is managed	COMMENT
LOW	core/mount/manager.go	61	// to view a filesystem or preparing a filesystem for a container that may	COMMENT
LOW	core/mount/mount.go	41	// Target specifies an optional subdirectory as a mountpoint. It assumes that	COMMENT
LOW	core/mount/manager/plan.go	41	// original mount type comes first). nil if mounts[i] had no transform	COMMENT
LOW	core/mount/manager/plan.go	61		COMMENT
LOW	core/unpack/unpacker.go	201		COMMENT
245 more matches not shown…

Decorative Section Separators7 hits · 21 pts

Severity	File	Line	Snippet	Context
MEDIUM	core/metadata/buckets.go	137	// └─────ingests	COMMENT
MEDIUM	…trib/checkpoint/checkpoint-restore-cri-disable-test.sh	179	# ==============================================================================	COMMENT
MEDIUM	…trib/checkpoint/checkpoint-restore-cri-disable-test.sh	181	# ==============================================================================	COMMENT
MEDIUM	…trib/checkpoint/checkpoint-restore-cri-disable-test.sh	206	# ==============================================================================	COMMENT
MEDIUM	…trib/checkpoint/checkpoint-restore-cri-disable-test.sh	208	# ==============================================================================	COMMENT
MEDIUM	…trib/checkpoint/checkpoint-restore-cri-disable-test.sh	222	# ==============================================================================	COMMENT
MEDIUM	…trib/checkpoint/checkpoint-restore-cri-disable-test.sh	224	# ==============================================================================	COMMENT

Cross-File Repetition4 hits · 20 pts

Severity	File	Snippet	Context
HIGH	releases/v2.3.0.toml	\ ### which file should i download? * `containerd-<version>-<os>-<arch>.tar.gz`: ✅recommended. dynamically linked with g	STRING
HIGH	releases/v2.1.0.toml	\ ### which file should i download? * `containerd-<version>-<os>-<arch>.tar.gz`: ✅recommended. dynamically linked with g	STRING
HIGH	releases/v2.2.0.toml	\ ### which file should i download? * `containerd-<version>-<os>-<arch>.tar.gz`: ✅recommended. dynamically linked with g	STRING
HIGH	releases/v2.4.0.toml	\ ### which file should i download? * `containerd-<version>-<os>-<arch>.tar.gz`: ✅recommended. dynamically linked with g	STRING

Structural Annotation Overuse10 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	core/images/usage/calculator.go	69	// NOTE: This function is best used with the manifest limit set to get a	COMMENT
LOW	core/remotes/docker/registry.go	101	// NOTE: This function will not join configurations, as soon as a non-empty	COMMENT
LOW	core/remotes/docker/registry.go	161	// NOTE: This function will always return a non-empty value or error	COMMENT
LOW	docs/managed-opt.md	85	1:M 01 Aug 15:59:52.870 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxcon	CODE
LOW	docs/getting-started.md	12	#### Step 1: Installing containerd	COMMENT
LOW	docs/getting-started.md	53	#### Step 2: Installing runc	COMMENT
LOW	docs/getting-started.md	64	#### Step 3: Installing CNI plugins	COMMENT
LOW	docs/getting-started.md	595	1:M 04 Aug 20:41:37.683 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxcon	CODE
LOW	docs/historical/reports/2017-03-17.md	179	1:M 17 Mar 17:20:25.326 # WARNING: The TCP backlog setting of 511 cannot be enforced because /proc/sys/net/core/somaxcon	CODE
LOW	client/image.go	106	// NOTE: This function is best used with the manifest limit set to get a	COMMENT

AI Slop Vocabulary4 hits · 10 pts

Severity	File	Line	Snippet	Context
MEDIUM	core/remotes/docker/resolver.go	396	// more robust, we mostly get this information from a secure trust store.	COMMENT
MEDIUM	test/init-buildx.sh	81	# Ensure we use a builder that can leverage it (the default on linux will not)	COMMENT
MEDIUM	internal/cri/opts/spec_windows.go	89	// Essentially this means firstArgFromImg should be true iff:	COMMENT
LOW	contrib/gce/configure.sh	23	# found python2, just use that	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	CONTRIBUTING.md	43	## Automated and AI-generated contributions	COMMENT

AI Response Leakage1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	docs/cri/config.md	531	# In this example, 'runc' is the RuntimeHandler string to match.	COMMENT

TODO Padding2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	core/images/usage/calculator_test.go	73	// TODO: Add test with snapshot	COMMENT
LOW	core/transfer/streaming/stream.go	195	// TODO: Handle error case	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	script/test/utils.sh	280	# Create the containerd ROOT dir and set full access to be inherited for "CREATOR OWNER"	COMMENT

Fake / Example Data1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	core/transfer/image/imagestore_test.go	71	Name: "placeholder",	CODE

containerd/containerd

Open-Source Code Quality, Security and Technical Debt Review