2.0

Adjusted Signal

2.0

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

43.3K

Stars

Language

446.3K

Lines of Code

2.2K

Files

776

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 731 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.3/100 · LOW

Are imports declared and package/API names verified? 26 finding(s).

Agent Over-Engineering Ratio 0.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 28 finding(s).

PR Review Velocity Impact 9.4/100 · LOW

Which changes need focused human review? 776 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 4MEDIUM 44LOW 728

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 776 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block647 hits · 633 pts

Severity	File	Line	Snippet	Context
LOW	CMakeLists.txt	1	#***************************************************************************	COMMENT
LOW	CMakeLists.txt	2321	# Consumed variables:	COMMENT
LOW	CMakeLists.txt	2341	"${PROJECT_SOURCE_DIR}/curl-config.in"	COMMENT
LOW	CMakeLists.txt	2361	# LIBCURL_PC_REQUIRES	COMMENT
LOW	CMakeLists.txt	2401	set(PACKAGE_FIND_VERSION_COUNT 1)	COMMENT
LOW	CMakeLists.txt	2421	# HAVE_LIBZ ZLIB_VERSION_MAJOR	COMMENT
LOW	appveyor.sh	1	#!/usr/bin/env bash	COMMENT
LOW	appveyor.yml	1	#***************************************************************************	COMMENT
LOW	CMake/CurlTests.c	21	* SPDX-License-Identifier: curl	COMMENT
LOW	CMake/CurlTests.c	101	}	COMMENT
LOW	CMake/CurlTests.c	181	{	COMMENT
LOW	CMake/CurlTests.c	221	#endif	COMMENT
LOW	CMake/CurlTests.c	241	return 0;	COMMENT
LOW	CMake/CurlTests.c	341	#include <sys/types.h>	COMMENT
LOW	CMake/CurlTests.c	361	#endif	COMMENT
LOW	include/curl/mprintf.h	41	#ifdef __MINGW_PRINTF_FORMAT /* mingw-w64 3.0.0+. Needs stdio.h. */	COMMENT
LOW	include/curl/curl.h	61		COMMENT
LOW	include/curl/curl.h	121	#define CURL_HAS_DECLSPEC_ATTRIBUTE(x) 0	COMMENT
LOW	include/curl/curl.h	681	/* The following were added in 7.17.1 */	COMMENT
LOW	include/curl/curl.h	701	#define CURLE_FTP_ACCESS_DENIED CURLE_REMOTE_ACCESS_DENIED	COMMENT
LOW	include/curl/curl.h	841	#define CURLAUTH_DIGEST_IE (((unsigned long)1) << 4)	COMMENT
LOW	include/curl/curl.h	861		COMMENT
LOW	include/curl/curl.h	981	/* The default connection upkeep interval in milliseconds. */	COMMENT
LOW	include/curl/curl.h	1081		COMMENT
LOW	include/curl/curl.h	1101	#define CURLPROTO_IMAPS (1L << 13)	COMMENT
LOW	include/curl/curl.h	2361		COMMENT
LOW	include/curl/curl.h	2401	#define CURL_SSLVERSION_TLSv1_3 7L	COMMENT
LOW	include/curl/curl.h	3201	typedef struct curl_version_info_data curl_version_info_data;	COMMENT
LOW	include/curl/curl.h	3221	#define CURL_VERSION_TLSAUTH_SRP (1<<14) /* TLS-SRP auth is supported */	COMMENT
LOW	include/curl/curl.h	3341	stuff before they can be included! */	COMMENT
LOW	include/curl/curl.h	3361	recursive macros, use a two-stage solution. */	COMMENT
LOW	include/curl/system.h	61	# define CURL_TYPEOF_CURL_OFF_T __int64	COMMENT
LOW	include/curl/system.h	81	# endif	COMMENT
LOW	include/curl/system.h	101	# endif	COMMENT
LOW	include/curl/system.h	121	# ifndef __LP64	COMMENT
LOW	include/curl/system.h	141	# define CURL_SUFFIX_CURL_OFF_T i64	COMMENT
LOW	include/curl/system.h	161	# define CURL_SUFFIX_CURL_OFF_TU UL	COMMENT
LOW	include/curl/system.h	181	#elif defined(__MVS__)	COMMENT
LOW	include/curl/system.h	201	# ifdef _LONG_LONG	COMMENT
LOW	include/curl/system.h	221	# define CURL_FORMAT_CURL_OFF_T "ld"	COMMENT
LOW	include/curl/system.h	241	defined(__sparcv8plus))	COMMENT
LOW	include/curl/system.h	261	# define CURL_TYPEOF_CURL_OFF_T long long	COMMENT
LOW	include/curl/system.h	281	# define CURL_FORMAT_CURL_OFF_TU "llu"	COMMENT
LOW	include/curl/system.h	301	# include <inttypes.h>	COMMENT
LOW	include/curl/system.h	321	defined(__sparc__) \|\| defined(__mips__) \|\| defined(__sh__) \|\| \	COMMENT
LOW	include/curl/system.h	341	# define CURL_FORMAT_CURL_OFF_T "ld"	COMMENT
LOW	include/curl/system.h	361	# define CURL_SUFFIX_CURL_OFF_TU ULL	COMMENT
LOW	include/curl/urlapi.h	81	CURLUPART_FRAGMENT,	COMMENT
LOW	projects/OS400/makefile.sh	1	#!/bin/sh	COMMENT
LOW	projects/OS400/makefile.sh	21	#	COMMENT
LOW	projects/OS400/initscript.sh	1	#!/bin/sh	COMMENT
LOW	projects/OS400/initscript.sh	101	# OS/400 specific definitions.	COMMENT
LOW	projects/OS400/make-tests.sh	1	#!/bin/sh	COMMENT
LOW	projects/OS400/ccsidcurl.c	21	* SPDX-License-Identifier: curl	COMMENT
LOW	projects/OS400/ccsidcurl.c	41	#include "urldata.h"	COMMENT
LOW	projects/OS400/make-src.sh	1	#!/bin/sh	COMMENT
LOW	projects/OS400/make-include.sh	1	#!/bin/sh	COMMENT
LOW	projects/OS400/make-docs.sh	1	#!/bin/sh	COMMENT
LOW	projects/OS400/make-docs.sh	61	# Man page is useless as OS/400 has no man command.	COMMENT
LOW	projects/OS400/os400sys.c	41	#ifdef HAVE_LIBZ	COMMENT
587 more matches not shown…

Self-Referential Comments22 hits · 66 pts

Severity	File	Line	Snippet	Context
MEDIUM	projects/OS400/makefile.sh	50	# Create the OS/400 library if it does not exist.	COMMENT
MEDIUM	projects/OS400/makefile.sh	58	# Create the DOCS source file if it does not exist.	COMMENT
MEDIUM	projects/OS400/makefile.sh	88	# Create the RPGXAMPLES source file if it does not exist.	COMMENT
MEDIUM	projects/OS400/make-src.sh	89	# Create the IFS command.	COMMENT
MEDIUM	projects/OS400/make-src.sh	101	# Create the CL interface program.	COMMENT
MEDIUM	projects/OS400/make-src.sh	112	# Create the CL command.	COMMENT
MEDIUM	projects/OS400/make-include.sh	34	# Create the OS/400 source program file for the header files.	COMMENT
MEDIUM	projects/OS400/make-include.sh	45	# Create the IFS directory for the header files.	COMMENT
MEDIUM	projects/OS400/make-lib.sh	120	# Create the service program exportation file in DB2 member if needed.	COMMENT
MEDIUM	tests/runner.pm	25	# This module contains entry points to run a single test. runner_init	COMMENT
MEDIUM	tests/runner.pm	184	# Create a separate process in multiprocess mode	COMMENT
MEDIUM	tests/globalconfig.pm	25	# This module contains global variables used in multiple modules in the test	COMMENT
MEDIUM	tests/util.py	68	# Create the test filename	COMMENT
MEDIUM	tests/test613.pl	47	# Create the files in alphabetical order, to increase the chances	COMMENT
MEDIUM	tests/servers.pm	25	# This module contains functions that are useful for managing the lifecycle of	COMMENT
MEDIUM	tests/servers.pm	174	# Create a server socket on a random (unused) port, then close it and	COMMENT
MEDIUM	tests/servers.pm	192	# Initialize configuration variables	COMMENT
MEDIUM	tests/devtest.pl	69	# This function is currently required to be here by servers.pm	COMMENT
MEDIUM	tests/ftpserver.pl	1147	# This function is dumb (so far) and removes the quotes if present.	COMMENT
MEDIUM	tests/testutil.pm	25	# This module contains miscellaneous functions needed in several parts of	COMMENT
MEDIUM	tests/runtests.pl	30	# The following sections need to be modified:	COMMENT
MEDIUM	tests/http/testenv/h2o.py	283	# Create a simple test file	COMMENT

Decorative Section Separators10 hits · 36 pts

Severity	File	Line	Snippet	Context
MEDIUM	projects/vms/make_gnv_curl_install.sh	24	#==========================================================================	COMMENT
MEDIUM	projects/vms/gnv_curl_configure.sh	22	#==========================================================================	COMMENT
MEDIUM⚡	tests/ftpserver.pl	2959	#----------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/ftpserver.pl	2960	#----------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/ftpserver.pl	2962	#----------------------------------------------------------------------	COMMENT
MEDIUM⚡	tests/ftpserver.pl	2963	#----------------------------------------------------------------------	COMMENT
MEDIUM	scripts/checksrc.pl	634	# ------------------------------------------------------------	COMMENT
MEDIUM	scripts/checksrc.pl	637	# ------------------------------------------------------------	COMMENT
MEDIUM	scripts/checksrc.pl	663	# ------------------------------------------------------------	COMMENT
MEDIUM	scripts/checksrc.pl	666	# ------------------------------------------------------------	COMMENT

AI Slop Vocabulary11 hits · 33 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/runner.pm	1116	# Test harness ssh server does not have this synchronization mechanism,	COMMENT
MEDIUM	tests/serverhelp.pm	70	# For convenience, test harness uses 'https' literal as values for 'proto'	COMMENT
MEDIUM	tests/globalconfig.pm	26	# harness but not really "owned" by any one.	COMMENT
MEDIUM	tests/servers.pm	872	# For convenience, test harness uses 'https' literal	COMMENT
MEDIUM	tests/devtest.pl	27	# runtests.pl harness. Do not try to use this unless you know what you are	COMMENT
MEDIUM	tests/devtest.pl	119	# Initialize the test harness to run tests	COMMENT
MEDIUM	tests/secureserver.pl	27	# harness. Actually a layer that runs stunnel properly using the	COMMENT
MEDIUM	tests/secureserver.pl	28	# non-secure test harness servers.	COMMENT
MEDIUM	tests/sshserver.pl	26	# Starts sshd for use in the SCP and SFTP curl test harness tests.	COMMENT
MEDIUM	tests/testcurl.pl	664	# build test harness programs for selected cross-compiles	COMMENT
MEDIUM	tests/runtests.pl	29	# are able to run curl but are unable to run the test harness.	COMMENT

Deep Nesting26 hits · 26 pts

Severity	File	Line	Context
LOW	tests/negtelnetserver.py	120	CODE
LOW	tests/negtelnetserver.py	165	CODE
LOW	tests/http/test_24_ocsp.py	89	CODE
LOW	tests/http/conftest.py	52	CODE
LOW	tests/http/test_02_download.py	680	CODE
LOW	tests/http/test_17_ssl_use.py	244	CODE
LOW	tests/http/scorecard.py	774	CODE
LOW	tests/http/scorecard.py	149	CODE
LOW	tests/http/scorecard.py	193	CODE
LOW	tests/http/scorecard.py	235	CODE
LOW	tests/http/scorecard.py	299	CODE
LOW	tests/http/scorecard.py	636	CODE
LOW	tests/http/scorecard.py	701	CODE
LOW	tests/http/test_20_websockets.py	189	CODE
LOW	tests/http/test_20_websockets.py	193	CODE
LOW	tests/http/testenv/curl.py	189	CODE
LOW	tests/http/testenv/curl.py	227	CODE
LOW	tests/http/testenv/curl.py	416	CODE
LOW	tests/http/testenv/curl.py	1028	CODE
LOW	tests/http/testenv/curl.py	1122	CODE
LOW	tests/http/testenv/curl.py	1190	CODE
LOW	tests/http/testenv/env.py	113	CODE
LOW	tests/http/testenv/env.py	744	CODE
LOW	tests/http/testenv/env.py	784	CODE
LOW	tests/http/testenv/client.py	81	CODE
LOW	tests/http/testenv/ws_dl_server.py	34	CODE

Empty Error Handlers4 hits · 20 pts

Severity	File	Line	Snippet	Context
HIGH	tests/http/test_06_eyeballs.py	111	except socket.timeout:	CODE
HIGH	tests/http/test_20_websockets.py	226	except OSError:	CODE
HIGH	tests/http/testenv/curl.py	92	except psutil.NoSuchProcess:	CODE
HIGH	tests/http/testenv/curl.py	299	except (json.JSONDecodeError, TypeError, ValueError):	CODE

Redundant / Tautological Comments13 hits · 20 pts

Severity	File	Line	Snippet	Context
LOW	projects/OS400/initscript.sh	72	# Check if perl available.	COMMENT
LOW	projects/OS400/initscript.sh	171	# Set LINK to "YES" if the module has been compiled.	COMMENT
LOW	projects/OS400/make-src.sh	33	# Check if built-in manual can be generated.	COMMENT
LOW	tests/test1222.pl	170	# Check if paragraph is mentioning deprecation.	COMMENT
LOW	tests/test1222.pl	288	# Print results.	COMMENT
LOW	tests/servers.pm	266	# Check if a given child process has died. Reaps it if so.	COMMENT
LOW	tests/ech_tests.sh	284	# Check if ports other than 443 are blocked from this	COMMENT
LOW	tests/testcurl.pl	321	# Set timestamp to the UTC this script is running. Its value might	COMMENT
LOW	tests/testcurl.pl	414	# Set timestamp to the UTC the git update took place.	COMMENT
LOW	tests/testcurl.pl	463	# Set timestamp to the one in curlver.h if this is not a git test build.	COMMENT
LOW	tests/runtests.pl	320	# Check if we have nghttpx available and if it talks http/3	COMMENT
LOW	tests/runtests.pl	487	# Check if the operating environment supports UTF-8.	COMMENT
LOW	scripts/cmakeopts.sh	6	# Verify if CMake options are documented	COMMENT

Unused Imports20 hits · 20 pts

Severity	File	Line	Context
LOW	tests/http/testenv/__init__.py	31	CODE
LOW	tests/http/testenv/__init__.py	31	CODE
LOW	tests/http/testenv/__init__.py	31	CODE
LOW	tests/http/testenv/__init__.py	33	CODE
LOW	tests/http/testenv/__init__.py	34	CODE
LOW	tests/http/testenv/__init__.py	34	CODE
LOW	tests/http/testenv/__init__.py	35	CODE
LOW	tests/http/testenv/__init__.py	36	CODE
LOW	tests/http/testenv/__init__.py	37	CODE
LOW	tests/http/testenv/__init__.py	38	CODE
LOW	tests/http/testenv/__init__.py	39	CODE
LOW	tests/http/testenv/__init__.py	39	CODE
LOW	tests/http/testenv/__init__.py	40	CODE
LOW	tests/http/testenv/__init__.py	41	CODE
LOW	tests/http/testenv/__init__.py	41	CODE
LOW	tests/http/testenv/__init__.py	41	CODE
LOW	tests/http/testenv/__init__.py	41	CODE
LOW	tests/http/testenv/__init__.py	42	CODE
LOW	tests/http/testenv/__init__.py	43	CODE
LOW	tests/http/testenv/__init__.py	44	CODE

AI Structural Patterns8 hits · 8 pts

Severity	File	Line	Context
LOW	tests/http/scorecard.py	235	CODE
LOW	tests/http/scorecard.py	701	CODE
LOW	tests/http/testenv/dnsd.py	171	CODE
LOW	tests/http/testenv/curl.py	627	CODE
LOW	tests/http/testenv/curl.py	735	CODE
LOW	tests/http/testenv/curl.py	811	CODE
LOW	tests/http/testenv/curl.py	1104	CODE
LOW	tests/http/testenv/certs.py	85	CODE

Fake / Example Data6 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	tests/libtest/lib1507.c	59	curl_easy_setopt(curl, CURLOPT_USERNAME, "user@example.com");	CODE
LOW	docs/libcurl/opts/CURLOPT_UPLOAD_FLAGS.md	100	curl_easy_setopt(curl, CURLOPT_USERNAME, "user@example.com");	CODE
LOW	docs/examples/ftpuploadfrommem.c	34	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. "	CODE
LOW	docs/examples/ftpuploadfrommem.c	34	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. "	CODE
LOW	docs/examples/post-callback.c	35	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. "	CODE
LOW	docs/examples/post-callback.c	35	"Lorem ipsum dolor sit amet, consectetur adipiscing elit. "	CODE

Excessive Try-Catch Wrapping5 hits · 5 pts

Severity	File	Line	Snippet	Context
LOW	tests/negtelnetserver.py	350	except Exception:	CODE
LOW	tests/dictserver.py	175	except Exception:	CODE
LOW	tests/http/testenv/curl.py	253	except Exception:	CODE
LOW	tests/http/testenv/env.py	301	except Exception:	CODE
LOW	tests/http/testenv/env.py	412	except Exception:	CODE

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	tests/libtest/mk-lib1521.pl	28	# Usage:	COMMENT
LOW	docs/examples/version-check.pl	36	# Usage:	COMMENT

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
MEDIUM	lib/vtls/gtls.c	1806	given hostname. This is a basic implementation of the matching described	CODE

Hyper-Verbose Identifiers1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	tests/http/testenv/env.py	587	def curl_lib_version_at_least(cls, libname: str, min_version) -> bool:	CODE

curl/curl

Open-Source Code Quality, Security and Technical Debt Review