An open-source, self-hostable PaaS alternative to Vercel, Heroku & Netlify that lets you easily deploy static sites, databases, full-stack applications and 280+ one-click services on your own servers.
This report presents the forensic synthetic code analysis of coollabsio/coolify, a PHP project with 58,467 GitHub stars. SynthScan v2.0 examined 304,769 lines of code across 2162 source files, recording 569 pattern matches distributed across 14 syntactic categories. The overall adjusted score of 2.8 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 569 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | database/seeders/DevelopmentRailpackExamplesSeeder.php | 366 | private function ensureDevelopmentPrerequisitesExist(): void | CODE |
| LOW | database/seeders/DevelopmentRailpackExamplesSeeder.php | 425 | private function ensurePublicGithubSourceExists(): void | CODE |
| LOW | .cursor/skills/laravel-actions/references/job.md | 392 | public function getJobDeleteWhenMissingModels(): bool | CODE |
| LOW | docker/coolify-realtime/terminal-utils.js | 3 | export function getTerminalSessionTimeout() { | CODE |
| LOW | docker/coolify-realtime/terminal-utils.js | 84 | export function normalizeHostForAuthorization(host) { | CODE |
| LOW | bootstrap/helpers/shared.php | 241 | function validateDatabasesBackupInput(string $input): string | CODE |
| LOW | bootstrap/helpers/shared.php | 798 | function extractYamlEnvironmentComments(string $rawYaml): array | CODE |
| LOW | bootstrap/helpers/shared.php | 866 | function extractEnvVarCommentFromYamlLine(string $line): ?array | CODE |
| LOW | bootstrap/helpers/shared.php | 981 | function extractCommentFromRemainder(string $remainder): ?string | CODE |
| LOW | bootstrap/helpers/shared.php | 1108 | function queryDatabaseByUuidWithinTeam(string $uuid, string $teamId) | CODE |
| LOW | bootstrap/helpers/shared.php | 1356 | function parseCommandFromMagicEnvVariable(Str|string $key): Stringable | CODE |
| LOW | bootstrap/helpers/shared.php | 1787 | function isAnyDeploymentInprogress() | CODE |
| LOW | bootstrap/helpers/shared.php | 3480 | function convertToKeyValueCollection($environment) | CODE |
| LOW | bootstrap/helpers/shared.php | 3621 | function defaultNginxConfiguration(string $type = 'static'): string | CODE |
| LOW | bootstrap/helpers/shared.php | 3778 | function addPreviewDeploymentSuffix(string $name, int $pull_request_id = 0): string | CODE |
| LOW | bootstrap/helpers/shared.php | 3783 | function generateDockerComposeServiceName(mixed $services, int $pullRequestId = 0): Collection | CODE |
| LOW | bootstrap/helpers/shared.php | 3958 | function shouldSkipPasswordConfirmation(): bool | CODE |
| LOW | bootstrap/helpers/shared.php | 3983 | function verifyPasswordConfirmation(mixed $password, ?Component $component = null): bool | CODE |
| LOW | bootstrap/helpers/shared.php | 4008 | function extractHardcodedEnvironmentVariables(string $dockerComposeRaw): Collection | CODE |
| LOW | bootstrap/helpers/shared.php | 4138 | function resolveSharedEnvironmentVariables(?string $value, $resource): ?string | CODE |
| LOW | bootstrap/helpers/subscriptions.php | 33 | function isSubscriptionOnGracePeriod() | CODE |
| LOW | bootstrap/helpers/subscriptions.php | 59 | function getStripeCustomerPortalSession(Team $team) | CODE |
| LOW | bootstrap/helpers/subscriptions.php | 73 | function allowedPathsForUnsubscribedAccounts() | CODE |
| LOW | bootstrap/helpers/subscriptions.php | 85 | function allowedPathsForBoardingAccounts() | CODE |
| LOW | bootstrap/helpers/subscriptions.php | 93 | function allowedPathsForInvalidAccounts() | CODE |
| LOW | bootstrap/helpers/subscriptions.php | 104 | function updateStripeCustomerEmail(Team $team, string $newEmail): void | CODE |
| LOW | bootstrap/helpers/domains.php | 142 | function checkIfDomainIsAlreadyUsedViaAPI(Collection|array $domains, ?string $teamId = null, ?string $uuid = null) | CODE |
| LOW | bootstrap/helpers/docker.php | 14 | function getCurrentApplicationContainerStatus(Server $server, int $id, ?int $pullRequestId = null, ?bool $includePullreq | CODE |
| LOW | bootstrap/helpers/docker.php | 63 | function getCurrentServiceContainerStatus(Server $server, int $id): Collection | CODE |
| LOW | bootstrap/helpers/docker.php | 130 | function checkMinimumDockerEngineVersion($dockerVersion) | CODE |
| LOW | bootstrap/helpers/docker.php | 184 | function generateApplicationContainerName(Application $application, $pull_request_id = 0) | CODE |
| LOW | bootstrap/helpers/docker.php | 256 | function generateServiceSpecificFqdns(ServiceApplication|Application $resource) | CODE |
| LOW | bootstrap/helpers/docker.php | 651 | function generateLabelsApplication(Application $application, ?ApplicationPreview $preview = null): array | CODE |
| LOW | bootstrap/helpers/docker.php | 848 | function isDatabaseImageWithContext(string $imageName, array $serviceConfig): bool | CODE |
| LOW | bootstrap/helpers/docker.php | 990 | function convertDockerRunToCompose(?string $custom_docker_run_options = null) | CODE |
| LOW | bootstrap/helpers/docker.php | 1160 | function generateCustomDockerRunOptionsForDatabases($docker_run_options, $docker_compose, $container_name, $network) | CODE |
| LOW | bootstrap/helpers/docker.php | 1465 | function injectDockerComposeBuildArgs(string $command, string $buildArgsString): string | CODE |
| LOW | bootstrap/helpers/services.php | 28 | function extractBalancedBraceContent(string $str, int $startPos = 0): ?array | CODE |
| LOW | bootstrap/helpers/services.php | 71 | function splitOnOperatorOutsideNested(string $content): ?array | CODE |
| LOW | bootstrap/helpers/services.php | 139 | function getFilesystemVolumesFromServer(ServiceApplication|ServiceDatabase|Application $oneService, bool $isInit = false | CODE |
| LOW | bootstrap/helpers/services.php | 423 | function parseServiceEnvironmentVariable(string $key): array | CODE |
| LOW | bootstrap/helpers/services.php | 469 | function applyServiceApplicationPrerequisites(Service $service): void | CODE |
| LOW | bootstrap/helpers/github.php | 68 | function generateGithubInstallationToken(GithubApp $source) | CODE |
| LOW | bootstrap/helpers/github.php | 172 | function getGithubCommitRangeFiles(?GithubApp $source, string $owner, string $repo, string $beforeSha, string $afterSha) | CODE |
| LOW | bootstrap/helpers/github.php | 198 | function getGithubPullRequestFiles(?GithubApp $source, string $owner, string $repo, int $pullRequestId): array | CODE |
| LOW | bootstrap/helpers/proxy.php | 18 | function isDockerPredefinedNetwork(string $network): bool | CODE |
| LOW | bootstrap/helpers/proxy.php | 25 | function collectProxyDockerNetworksByServer(Server $server) | CODE |
| LOW | bootstrap/helpers/proxy.php | 40 | function collectDockerNetworksByServer(Server $server) | CODE |
| LOW | bootstrap/helpers/proxy.php | 170 | function extractCustomProxyCommands(Server $server, string $existing_config): array | CODE |
| LOW | bootstrap/helpers/proxy.php | 226 | function generateDefaultProxyConfiguration(Server $server, array $custom_commands = []) | CODE |
| LOW | bootstrap/helpers/proxy.php | 404 | function getExactTraefikVersionFromContainer(Server $server): ?string | CODE |
| LOW | bootstrap/helpers/proxy.php | 447 | function getTraefikVersionFromDockerCompose(Server $server): ?string | CODE |
| LOW | bootstrap/helpers/timezone.php | 12 | function formatDateInServerTimezone($date, $server = null) | CODE |
| LOW | bootstrap/helpers/parsers.php | 27 | function validateDockerComposeForInjection(string $composeYaml): void | CODE |
| LOW | bootstrap/helpers/parsers.php | 110 | function validateVolumeStringForInjection(string $volumeString): void | CODE |
| LOW | bootstrap/helpers/api.php | 184 | function removeUnnecessaryFieldsFromRequest(Request $request) | CODE |
| LOW | bootstrap/helpers/sudo.php | 23 | function parseCommandsByLineForSudo(Collection $commands, Server $server): array | CODE |
| LOW | app/Traits/HasNotificationSettings.php | 54 | public function isNotificationTypeEnabled(string $channel, string $event): bool | CODE |
| LOW | app/Traits/EnvironmentVariableProtection.php | 15 | protected function isProtectedEnvironmentVariable(string $key): bool | CODE |
| LOW | app/Traits/EnvironmentVariableProtection.php | 27 | protected function isEnvironmentVariableUsedInDockerCompose(string $key, ?string $dockerCompose): array | CODE |
| 279 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 6 | // ─── Malformed Variables ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 86 | // ─── Edge Cases with Braces and Special Characters ───────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 178 | // ─── Deeply Nested Defaults ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 263 | // ─── Backwards Compatibility ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseCredentialValidationPatternTest.php | 6 | // ── DB_IDENTIFIER_PATTERN ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseCredentialValidationPatternTest.php | 45 | // ── DB_PASSWORD_PATTERN ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseCredentialValidationPatternTest.php | 83 | // ── Rule helpers ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseCredentialValidationPatternTest.php | 131 | // ── Validator integration ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseHealthcheckCommandInjectionTest.php | 21 | // ─── PostgreSQL ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseHealthcheckCommandInjectionTest.php | 41 | // ─── KeyDB ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseHealthcheckCommandInjectionTest.php | 58 | // ─── Dragonfly ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseHealthcheckCommandInjectionTest.php | 75 | // ─── ClickHouse ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseHealthcheckCommandInjectionTest.php | 92 | // ─── Verify unaffected databases still use their safe patterns ──────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseSslCredentialEscapingTest.php | 10 | // ── executeInDocker + escapeshellarg chown pattern ──────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseSslCredentialEscapingTest.php | 90 | // ── MongoDB JS init script JSON-escaping ────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseSslCredentialEscapingTest.php | 137 | // ── Healthcheck CMD exec-form structure (no shell parsing) ──────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseCredentialDirtyValidationTest.php | 5 | // ── databasePasswordRules ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Unit/DatabaseCredentialDirtyValidationTest.php | 47 | // ── databaseIdentifierRules ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Feature/StorageApiTest.php | 64 | // ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Feature/StorageApiTest.php | 66 | // ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Feature/StorageApiTest.php | 288 | // ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tests/Feature/StorageApiTest.php | 290 | // ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | templates/test-database-detection.yaml | 9 | # ============================================================================= | COMMENT |
| MEDIUM⚡ | templates/test-database-detection.yaml | 11 | # ============================================================================= | COMMENT |
| MEDIUM | templates/test-database-detection.yaml | 115 | # ============================================================================= | COMMENT |
| MEDIUM | templates/test-database-detection.yaml | 117 | # ============================================================================= | COMMENT |
| MEDIUM | templates/test-database-detection.yaml | 256 | # ============================================================================= | COMMENT |
| MEDIUM | templates/test-database-detection.yaml | 258 | # ============================================================================= | COMMENT |
| MEDIUM | templates/test-database-detection.yaml | 333 | # ============================================================================= | COMMENT |
| MEDIUM | templates/test-database-detection.yaml | 335 | # ============================================================================= | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | other/nightly/install.sh | 62 | # Check if environment variables were explicitly provided | COMMENT |
| LOW | other/nightly/install.sh | 76 | # Check if systemctl is available | COMMENT |
| LOW | other/nightly/install.sh | 85 | # Check if service command is available | COMMENT |
| LOW | other/nightly/install.sh | 140 | # Check if daemon.json exists and extract existing address pool configuration | COMMENT |
| LOW | other/nightly/install.sh | 151 | # Check if environment variables were explicitly provided | COMMENT |
| LOW | other/nightly/install.sh | 156 | # Check if force override is enabled | COMMENT |
| LOW⚡ | other/nightly/install.sh | 273 | # Check if the OS is manjaro, if so, change it to arch | COMMENT |
| LOW⚡ | other/nightly/install.sh | 278 | # Check if the OS is Endeavour OS, if so, change it to arch | COMMENT |
| LOW⚡ | other/nightly/install.sh | 283 | # Check if the OS is Cachy OS, if so, change it to arch | COMMENT |
| LOW⚡ | other/nightly/install.sh | 288 | # Check if the OS is Asahi Linux, if so, change it to fedora | COMMENT |
| LOW⚡ | other/nightly/install.sh | 293 | # Check if the OS is popOS, if so, change it to ubuntu | COMMENT |
| LOW⚡ | other/nightly/install.sh | 298 | # Check if the OS is linuxmint, if so, change it to ubuntu | COMMENT |
| LOW⚡ | other/nightly/install.sh | 303 | #Check if the OS is zorin, if so, change it to ubuntu | COMMENT |
| LOW | other/nightly/install.sh | 700 | # Check if we need to update log settings | COMMENT |
| LOW | other/nightly/install.sh | 742 | # Check if address pools were changed | COMMENT |
| LOW | other/nightly/upgrade.sh | 69 | # Check if custom compose file exists | COMMENT |
| LOW | other/nightly/upgrade.sh | 75 | # Check if PostgreSQL upgrade override exists | COMMENT |
| LOW | other/nightly/upgrade.sh | 153 | # Check if Docker config file exists | COMMENT |
| LOW | scripts/install.sh | 62 | # Check if environment variables were explicitly provided | COMMENT |
| LOW | scripts/install.sh | 76 | # Check if systemctl is available | COMMENT |
| LOW | scripts/install.sh | 85 | # Check if service command is available | COMMENT |
| LOW | scripts/install.sh | 140 | # Check if daemon.json exists and extract existing address pool configuration | COMMENT |
| LOW | scripts/install.sh | 151 | # Check if environment variables were explicitly provided | COMMENT |
| LOW | scripts/install.sh | 156 | # Check if force override is enabled | COMMENT |
| LOW⚡ | scripts/install.sh | 273 | # Check if the OS is manjaro, if so, change it to arch | COMMENT |
| LOW⚡ | scripts/install.sh | 278 | # Check if the OS is Endeavour OS, if so, change it to arch | COMMENT |
| LOW⚡ | scripts/install.sh | 283 | # Check if the OS is Cachy OS, if so, change it to arch | COMMENT |
| LOW⚡ | scripts/install.sh | 288 | # Check if the OS is Asahi Linux, if so, change it to fedora | COMMENT |
| LOW⚡ | scripts/install.sh | 293 | # Check if the OS is popOS, if so, change it to ubuntu | COMMENT |
| LOW⚡ | scripts/install.sh | 298 | # Check if the OS is linuxmint, if so, change it to ubuntu | COMMENT |
| LOW⚡ | scripts/install.sh | 303 | #Check if the OS is zorin, if so, change it to ubuntu | COMMENT |
| LOW | scripts/install.sh | 700 | # Check if we need to update log settings | COMMENT |
| LOW | scripts/install.sh | 742 | # Check if address pools were changed | COMMENT |
| LOW | scripts/upgrade.sh | 69 | # Check if custom compose file exists | COMMENT |
| LOW | scripts/upgrade.sh | 75 | # Check if PostgreSQL upgrade override exists | COMMENT |
| LOW | scripts/upgrade.sh | 162 | # Check if Docker config file exists | COMMENT |
| LOW | templates/compose/calcom.yaml | 40 | # Set this to 1 if you don't want Cal to collect anonymous usage | COMMENT |
| LOW | templates/compose/dify.yaml | 494 | # Check if the certificate and key files for the specified domain exist | COMMENT |
| LOW | templates/compose/matrix-synapse-with-sqlite.yaml | 34 | # Set public_baseurl to actual deployment URL (may differ from server_name) | COMMENT |
| LOW | templates/compose/electricsql.yaml | 9 | ## Set DATABASE_URL to an existing Postgres instance with logical replication enabled. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …/monaco-editor-0.52.2/min/vs/language/css/cssWorker.js | 73 | This is used to produce an effect that is known as tate-ch\u016B-yoko (\u7E26\u4E2D\u6A2A) in Japanese, or as \u76F4\u66 | CODE |
| MEDIUM | …onaco-editor-0.52.2/min/vs/language/html/htmlWorker.js | 259 | * To learn about this declaration in Firefox for Mobile, see [this article](https://developer.mozilla.org/en-US/do | COMMENT |
| MEDIUM | …onaco-editor-0.52.2/min/vs/language/html/htmlWorker.js | 270 | Default mode, which indicates no preference for the decoding mode. The browser decides what is best for the user.`}},{na | CODE |
| MEDIUM | …onaco-editor-0.52.2/min/vs/language/html/htmlWorker.js | 270 | Default mode, which indicates no preference for the decoding mode. The browser decides what is best for the user.`}},{na | CODE |
| MEDIUM | …onaco-editor-0.52.2/min/vs/language/html/htmlWorker.js | 288 | **Note**: Sites that automatically play audio (or videos with an audio track) can be an unpleasant experience for users, | CODE |
| MEDIUM | templates/compose/nextcloud-with-mysql.yaml | 2 | # slogan: NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication | COMMENT |
| MEDIUM | templates/compose/nextcloud-with-postgres.yaml | 2 | # slogan: NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication | COMMENT |
| MEDIUM | templates/compose/observium.yaml | 2 | # slogan: Observium is a comprehensive network monitoring platform designed to deliver powerful monitoring capabilities, | COMMENT |
| MEDIUM | templates/compose/gitlab.yaml | 2 | # slogan: The all-in-one DevOps platform for seamless collaboration and continuous delivery. | COMMENT |
| MEDIUM | templates/compose/pingvinshare.yaml | 3 | # slogan: A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient fil | COMMENT |
| MEDIUM | templates/compose/nextcloud.yaml | 2 | # slogan: NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication | COMMENT |
| MEDIUM | templates/compose/cloudflare-ddns.yaml | 2 | # slogan: A small, feature-rich, and robust Cloudflare DDNS updater. | COMMENT |
| MEDIUM | templates/compose/sparkyfitness.yaml | 2 | # slogan: SparkyFitness is a comprehensive fitness tracking and management application designed to help users monitor th | COMMENT |
| MEDIUM | templates/compose/unleash-with-postgresql.yaml | 4 | # tags: unleash,feature flags,feature toggles,ab testing,open source | COMMENT |
| MEDIUM | templates/compose/unleash-with-postgresql.yaml | 5 | # logo: svgs/unleash.svg | COMMENT |
| MEDIUM | templates/compose/nextcloud-with-mariadb.yaml | 2 | # slogan: NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication | COMMENT |
| MEDIUM | templates/compose/pingvinshare-with-clamav.yaml | 3 | # slogan: A self-hosted file sharing platform that combines lightness and beauty, perfect for seamless and efficient fil | COMMENT |
| MEDIUM | templates/compose/unleash-without-database.yaml | 4 | # tags: unleash,feature flags,feature toggles,ab testing,open source | COMMENT |
| MEDIUM | templates/compose/unleash-without-database.yaml | 5 | # logo: svgs/unleash.svg | COMMENT |
| MEDIUM | templates/compose/logto.yaml | 2 | # slogan: A comprehensive identity solution covering both the front and backend, complete with pre-built infrastructure | COMMENT |
| MEDIUM | templates/compose/logto.yaml | 19 | # Or, you can leverage it for local testing. | COMMENT |
| MEDIUM | templates/compose/cloudbeaver.yaml | 2 | # slogan: CloudBeaver is a lightweight web application designed for comprehensive data management. | COMMENT |
| MEDIUM | templates/compose/mixpost.yaml | 2 | # slogan: Mixpost is a robust and versatile social media management software, designed to streamline social media operat | COMMENT |
| MEDIUM | templates/compose/edgedb.yaml | 3 | # slogan: An open-source database designed as a spiritual successor to SQL and the relational paradigm. Powered by the P | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | bootstrap/helpers/docker.php | 1320 | // Step 1: Escape backslashes first (must be done before other escaping) | COMMENT |
| LOW⚡ | bootstrap/helpers/docker.php | 1323 | // Step 2: Escape double quotes | COMMENT |
| LOW⚡ | bootstrap/helpers/docker.php | 1326 | // Step 3: Escape backticks (command substitution) | COMMENT |
| LOW⚡ | bootstrap/helpers/docker.php | 1329 | // Step 4: Escape invalid $ patterns while preserving valid variable references | COMMENT |
| LOW⚡ | app/Livewire/Server/New/ByHetzner.php | 37 | // Step 1: Token selection | COMMENT |
| LOW⚡ | app/Livewire/Server/New/ByHetzner.php | 40 | // Step 2: Server configuration | COMMENT |
| LOW | app/Actions/Server/CleanupDocker.php | 93 | // Step 1: Always prune dangling images (untagged) | COMMENT |
| LOW | app/Actions/User/DeleteUserTeams.php | 188 | // In Stripe, we need to check if the customer email matches the user's email | COMMENT |
| LOW⚡ | app/Actions/Application/CleanupPreviewDeployment.php | 50 | // Step 1: Cancel all active deployments for this PR and kill helper containers | COMMENT |
| LOW⚡ | app/Actions/Application/CleanupPreviewDeployment.php | 57 | // Step 2: Stop and remove all running PR containers | COMMENT |
| LOW⚡ | app/Actions/Application/CleanupPreviewDeployment.php | 64 | // Step 3: Find or use provided preview, then dispatch cleanup job for thorough cleanup | COMMENT |
| LOW | app/Jobs/DatabaseBackupJob.php | 324 | // Step 1: Create local backup | COMMENT |
| LOW | app/Jobs/DatabaseBackupJob.php | 425 | // Step 2: Upload to S3 if enabled (independent of local backup) | COMMENT |
| LOW | app/Jobs/DatabaseBackupJob.php | 442 | // Step 3: Update status and send notifications based on results | COMMENT |
| LOW | app/Jobs/ApplicationDeploymentJob.php | 2846 | // Step 1: Generate build plan with railpack prepare | COMMENT |
| LOW | app/Jobs/ApplicationDeploymentJob.php | 2873 | // Step 2: Build image using docker buildx with railpack frontend. | COMMENT |
| LOW | app/Jobs/ApplicationDeploymentJob.php | 2904 | // Step 3: If static, copy built assets into nginx image | COMMENT |
| LOW⚡ | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 322 | // Step 1: Extract outer content | COMMENT |
| LOW⚡ | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 327 | // Step 2: Split on outer operator | COMMENT |
| LOW⚡ | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 333 | // Step 3: Find all nested variables in default | COMMENT |
| LOW⚡ | tests/Unit/NestedEnvironmentVariableParsingTest.php | 167 | // Step 1: Extract outer variable content | COMMENT |
| LOW⚡ | tests/Unit/NestedEnvironmentVariableParsingTest.php | 171 | // Step 2: Split on operator | COMMENT |
| LOW⚡ | tests/Unit/NestedEnvironmentVariableParsingTest.php | 177 | // Step 3: Extract nested variable | COMMENT |
| LOW⚡ | tests/Feature/ServerManagerJobShouldRunNowTest.php | 63 | // Step 1: 15:00 — not due for midnight cron, but seeds cache | COMMENT |
| LOW⚡ | tests/Feature/ServerManagerJobShouldRunNowTest.php | 69 | // Step 2: Next day at 00:05 — delayed 5 minutes past midnight | COMMENT |
| LOW⚡ | tests/Feature/ScheduledJobManagerShouldRunNowTest.php | 126 | // Step 1: 10:00 — not due, but seeds cache with previousDue (02:00 today) | COMMENT |
| LOW⚡ | tests/Feature/ScheduledJobManagerShouldRunNowTest.php | 130 | // Step 2: Next day at 02:03 — delayed 3 minutes past cron. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | bootstrap/helpers/docker.php | 1320 | // Step 1: Escape backslashes first (must be done before other escaping) | COMMENT |
| LOW⚡ | bootstrap/helpers/docker.php | 1323 | // Step 2: Escape double quotes | COMMENT |
| LOW⚡ | bootstrap/helpers/docker.php | 1326 | // Step 3: Escape backticks (command substitution) | COMMENT |
| LOW⚡ | bootstrap/helpers/docker.php | 1329 | // Step 4: Escape invalid $ patterns while preserving valid variable references | COMMENT |
| LOW⚡ | app/Livewire/Server/New/ByHetzner.php | 37 | // Step 1: Token selection | COMMENT |
| LOW⚡ | app/Livewire/Server/New/ByHetzner.php | 40 | // Step 2: Server configuration | COMMENT |
| LOW | app/Actions/Server/CleanupDocker.php | 93 | // Step 1: Always prune dangling images (untagged) | COMMENT |
| LOW⚡ | app/Actions/Application/CleanupPreviewDeployment.php | 50 | // Step 1: Cancel all active deployments for this PR and kill helper containers | COMMENT |
| LOW⚡ | app/Actions/Application/CleanupPreviewDeployment.php | 57 | // Step 2: Stop and remove all running PR containers | COMMENT |
| LOW⚡ | app/Actions/Application/CleanupPreviewDeployment.php | 64 | // Step 3: Find or use provided preview, then dispatch cleanup job for thorough cleanup | COMMENT |
| LOW | app/Jobs/DatabaseBackupJob.php | 324 | // Step 1: Create local backup | COMMENT |
| LOW | app/Jobs/DatabaseBackupJob.php | 425 | // Step 2: Upload to S3 if enabled (independent of local backup) | COMMENT |
| LOW | app/Jobs/DatabaseBackupJob.php | 442 | // Step 3: Update status and send notifications based on results | COMMENT |
| LOW | app/Jobs/ApplicationDeploymentJob.php | 2846 | // Step 1: Generate build plan with railpack prepare | COMMENT |
| LOW | app/Jobs/ApplicationDeploymentJob.php | 2873 | // Step 2: Build image using docker buildx with railpack frontend. | COMMENT |
| LOW | app/Jobs/ApplicationDeploymentJob.php | 2904 | // Step 3: If static, copy built assets into nginx image | COMMENT |
| LOW⚡ | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 322 | // Step 1: Extract outer content | COMMENT |
| LOW⚡ | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 327 | // Step 2: Split on outer operator | COMMENT |
| LOW⚡ | tests/Unit/EnvironmentVariableParsingEdgeCasesTest.php | 333 | // Step 3: Find all nested variables in default | COMMENT |
| LOW⚡ | tests/Unit/NestedEnvironmentVariableParsingTest.php | 167 | // Step 1: Extract outer variable content | COMMENT |
| LOW⚡ | tests/Unit/NestedEnvironmentVariableParsingTest.php | 171 | // Step 2: Split on operator | COMMENT |
| LOW⚡ | tests/Unit/NestedEnvironmentVariableParsingTest.php | 177 | // Step 3: Extract nested variable | COMMENT |
| LOW⚡ | tests/Feature/ServerManagerJobShouldRunNowTest.php | 63 | // Step 1: 15:00 — not due for midnight cron, but seeds cache | COMMENT |
| LOW⚡ | tests/Feature/ServerManagerJobShouldRunNowTest.php | 69 | // Step 2: Next day at 00:05 — delayed 5 minutes past midnight | COMMENT |
| LOW⚡ | tests/Feature/ScheduledJobManagerShouldRunNowTest.php | 126 | // Step 1: 10:00 — not due, but seeds cache with previousDue (02:00 today) | COMMENT |
| LOW⚡ | tests/Feature/ScheduledJobManagerShouldRunNowTest.php | 130 | // Step 2: Next day at 02:03 — delayed 3 minutes past cron. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | templates/compose/spacebot.yaml | 2 | # slogan: An agentic AI system with specialized processes for thinking, working, and remembering. | COMMENT |
| MEDIUM | templates/compose/spacebot.yaml | 4 | # tags: ai, agent, anthropic, openai, discord, slack, llm, agentic | COMMENT |
| MEDIUM | templates/compose/flowise.yaml | 2 | # slogan: Flowise is an open source low-code tool for developers to build customized LLM orchestration flows & AI agents | COMMENT |
| MEDIUM | templates/compose/flowise-with-databases.yaml | 2 | # slogan: Flowise is an open source low-code tool for developers to build customized LLM orchestration flows & AI agents | COMMENT |
| MEDIUM | templates/compose/dify.yaml | 3 | # slogan: Dify is an open-source LLM app development platform. Dify's intuitive interface combines AI workflow, RAG pipe | COMMENT |
| MEDIUM | templates/compose/dify.yaml | 5 | # tags: ai, weaviate, openai, gpt, llm, lmops, dify, redis, postgres, qdrant, RAG, agent | COMMENT |
| MEDIUM | templates/compose/unstructured.yaml | 2 | # slogan: Unstructured provides a platform and tools to ingest and process unstructured documents for Retrieval Augmente | COMMENT |
| MEDIUM | templates/compose/unstructured.yaml | 4 | # tags: workflow, orchestration, data-pipeline, python, data, machine-learning, data-science, nlp, unstructured, ocr, da | COMMENT |
| MEDIUM | templates/compose/labelstudio.yaml | 4 | # tags: workflow, orchestration, data-pipeline, python, labelstudio, ai, elasticsearch, datasets, data, machine-learning | COMMENT |
| MEDIUM | templates/compose/anythingllm.yaml | 2 | # slogan: AnythingLLM is the easiest to use, all-in-one AI application that can do RAG, AI Agents, and much more with no | COMMENT |
| MEDIUM | templates/compose/sftpgo.yaml | 2 | # slogan: SFTPGo is an event-driven SFTP, FTP/S, HTTP/S and WebDAV server. | COMMENT |
| MEDIUM | templates/compose/prefect.yaml | 2 | # slogan: Prefect is an orchestration and observability platform that empowers developers to build and scale workflows q | COMMENT |
| MEDIUM | templates/compose/prefect.yaml | 4 | # tags: workflow, orchestration, data-pipeline, python, automation, data-processing, data-integration, etl | COMMENT |
| MEDIUM | templates/compose/argilla.yaml | 4 | # tags: workflow, orchestration, data-pipeline, python, argilla, ai, elasticsearch, datasets, data, machine-learning, da | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL⚡ | public/js/apexcharts.js | 7 | "use strict"; function t(t, e) { var i = Object.keys(t); if (Object.getOwnPropertySymbols) { var a = Object.getOwnPr | CODE |
| CRITICAL⚡ | public/js/apexcharts.js | 15 | function () { function t(t) { t.remember("_draggable", this), this.el = t } t.prototype.init = function (t, e) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …sor/skills/laravel-best-practices/rules/http-client.md | 140 | 'name' => 'John Doe', | CODE |
| LOW | …s/laravel-best-practices/rules/events-notifications.md | 43 | Notification::route('mail', 'admin@example.com')->notify(new SystemAlert()); | CODE |
| LOW | …sources/views/components/forms/env-var-input.blade.php | 221 | placeholder="{{ $attributes->get('placeholder') }}" | CODE |
| LOW | resources/views/components/forms/input.blade.php | 24 | name="{{ $name }}" placeholder="{{ $attributes->get('placeholder') }}" | CODE |
| LOW | resources/views/components/forms/input.blade.php | 25 | aria-placeholder="{{ $attributes->get('placeholder') }}" | CODE |
| LOW | resources/views/components/forms/input.blade.php | 59 | placeholder="{{ $attributes->get('placeholder') }}" | CODE |
| LOW | resources/views/components/forms/textarea.blade.php | 39 | name="{{ $name }}" placeholder="{{ $attributes->get('placeholder') }}" | CODE |
| LOW | resources/views/components/forms/textarea.blade.php | 40 | aria-placeholder="{{ $attributes->get('placeholder') }}"> | CODE |
| LOW | resources/views/livewire/settings/index.blade.php | 53 | @input="open = true" class="w-full input" :placeholder="placeholder" | CODE |
| LOW | resources/views/livewire/server/show.blade.php | 242 | @input="open = true" class="w-full input" :placeholder="placeholder" | CODE |
| LOW | tests/Unit/HetznerServiceTest.php | 37 | $service = new HetznerService('fake-token'); | CODE |
| LOW | tests/Unit/HetznerServiceTest.php | 64 | $service = new HetznerService('fake-token'); | CODE |
| LOW | tests/Unit/HetznerServiceTest.php | 90 | $service = new HetznerService('fake-token'); | CODE |
| LOW | tests/Unit/HetznerServiceTest.php | 104 | $service = new HetznerService('fake-token'); | CODE |
| LOW | tests/Unit/HetznerServiceTest.php | 146 | $service = new HetznerService('fake-token'); | CODE |
| LOW | tests/Unit/Notifications/Channels/EmailChannelTest.php | 20 | $user2 = new User(['email' => 'admin@example.com']); | CODE |
| LOW | tests/Feature/CaCertificateCommandInjectionTest.php | 67 | 'ssl_certificate' => 'placeholder', | CODE |
| LOW | tests/Feature/CaCertificateCommandInjectionTest.php | 83 | 'ssl_certificate' => 'placeholder', | CODE |
| LOW | …nts/skills/laravel-best-practices/rules/http-client.md | 140 | 'name' => 'John Doe', | CODE |
| LOW | …s/laravel-best-practices/rules/events-notifications.md | 43 | Notification::route('mail', 'admin@example.com')->notify(new SystemAlert()); | CODE |
| LOW | …ude/skills/laravel-best-practices/rules/http-client.md | 140 | 'name' => 'John Doe', | CODE |
| LOW | …s/laravel-best-practices/rules/events-notifications.md | 43 | Notification::route('mail', 'admin@example.com')->notify(new SystemAlert()); | CODE |
| LOW | public/js/purify.min.js | 2 | !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define | CODE |
| LOW | …onaco-editor-0.52.2/min/vs/language/html/htmlWorker.js | 440 | **Note:** Do not use this attribute, as it is non-standard and only implemented in some versions of Microsoft Internet E | CODE |
| LOW | …/monaco-editor-0.52.2/min/vs/base/worker/workerMain.js | 29 | `||e===" "}}),X(J[69],Z([0,1]),function(W,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.WrappingInd | CODE |
| LOW | templates/compose/hatchet.yaml | 15 | # Default credentials are "admin@example.com" and "Admin123!!" | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose-maxio.dev.yml | 121 | mailpit: | COMMENT |
| LOW | docker-compose-maxio.dev.yml | 161 | # pull_policy: always | COMMENT |
| LOW | cliff.toml | 1 | # git-cliff ~ default configuration file | COMMENT |
| LOW | cliff.toml | 41 | # render body even when there are no releases to process | COMMENT |
| LOW | bootstrap/helpers/parsers.php | 2561 | // Preserve empty strings and null values with correct Docker Compose semantics: | COMMENT |
| LOW | app/Http/Middleware/CanUpdateResource.php | 21 | use Illuminate\Support\Facades\Gate; | COMMENT |
| LOW | app/Http/Middleware/CanUpdateResource.php | 41 | // } elseif ($request->route('database_uuid')) { | COMMENT |
| LOW | app/Http/Middleware/CanUpdateResource.php | 61 | // } elseif ($request->route('project_uuid')) { | COMMENT |
| LOW | app/Actions/Server/CleanupDocker.php | 101 | })->implode('|'); | COMMENT |
| LOW | app/Console/Commands/Emails.php | 181 | 'database_id' => $db->id, | COMMENT |
| LOW | config/purify.php | 121 | // 'serializer' => [ | COMMENT |
| LOW | other/nightly/install.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tests/Pest.php | 61 | // { | COMMENT |
| LOW | tests/Unit/ApplicationComposeEditorLoadTest.php | 61 | // 5. BUT component property is never updated, so Monaco editor stays empty | COMMENT |
| LOW | scripts/install.sh | 1 | #!/bin/bash | COMMENT |
| LOW | scripts/railpack-smoke.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | templates/compose/posthog.yaml | 2021 | # command: sh -c "python manage.py migrate && python manage.py migrate_clickhouse && python manage.py run_async_migr | COMMENT |
| LOW | templates/compose/calcom.yaml | 1 | # ignore: true | COMMENT |
| LOW | templates/compose/zep.yaml | 61 | target: /app/config.yaml | COMMENT |
| LOW | templates/compose/zep.yaml | 141 | log: | COMMENT |
| LOW | templates/compose/zep.yaml | 161 | # <current_summary>{{.PrevSummary}}</current_summary> | COMMENT |
| LOW | templates/compose/glances.yaml | 21 | test: ["CMD", "curl", "-f", "http://localhost:61208"] | COMMENT |
| LOW | templates/compose/supabase.yaml | 381 | plugins: | COMMENT |
| LOW | templates/compose/supabase.yaml | 441 | config: | COMMENT |
| LOW | templates/compose/supabase.yaml | 1241 | - GOTRUE_SMS_AUTOCONFIRM=${ENABLE_PHONE_AUTOCONFIRM:-true} | COMMENT |
| LOW | templates/compose/cap.yaml | 1 | # documentation: https://cap.so | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | config/telescope.php | 131 | | a request or task is executed. Feel free to customize this list. | CODE |
| LOW⚡ | public/js/apexcharts.js | 7 | "use strict"; function t(t, e) { var i = Object.keys(t); if (Object.getOwnPropertySymbols) { var a = Object.getOwnPr | CODE |
| LOW | …/monaco-editor-0.52.2/min/vs/language/css/cssWorker.js | 32 | `),[{language:"html",value:r}]}doPrint(e,t){for(let r of e)this.doPrintElement(r,t),r.children&&this.doPrint(r.children, | CODE |
| MEDIUM | …onaco-editor-0.52.2/min/vs/language/html/htmlWorker.js | 306 | **Usage note:** Do not use this attribute, as it has been deprecated. The [\`<caption>\`](https://developer.mozilla.org/ | CODE |
| LOW | templates/compose/posthog.yaml | 1171 | Regexps are not aligned: don't forget to add ^ and $. Also don't forget to escape dot (.) | CODE |
| MEDIUM | templates/compose/wordpress-with-mysql.yaml | 2 | # slogan: WordPress is open source software you can use to create a beautiful website, blog, or app. | COMMENT |
| MEDIUM | templates/compose/wordpress-without-database.yaml | 2 | # slogan: WordPress is open source software you can use to create a beautiful website, blog, or app. | COMMENT |
| MEDIUM | templates/compose/wordpress-with-mariadb.yaml | 2 | # slogan: WordPress is open source software you can use to create a beautiful website, blog, or app. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | app/Models/Server.php | 353 | "# This file is generated by Coolify, do not edit it manually.\n". | CODE |
| MEDIUM | app/Models/Server.php | 569 | "# This file is automatically generated by Coolify.\n". | CODE |
| MEDIUM | other/nightly/install.sh | 705 | # Create a configuration without address pools to preserve existing ones | COMMENT |
| MEDIUM | scripts/install.sh | 705 | # Create a configuration without address pools to preserve existing ones | COMMENT |
| MEDIUM⚡ | templates/test-database-detection.yaml | 2 | # This file contains various services to test the isDatabaseImage() function | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | CONTRIBUTING.md | 221 | - **No AI-Generated Code**: Do not submit code generated by AI tools without fully understanding and verifying it. AI-ge | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/railpack-smoke.sh | 17 | # Usage: | COMMENT |