1.6

Adjusted Signal

1.6

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

11.2K

Stars

Language

137.5K

Lines of Code

516

Files

207

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 129 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.8/100 · LOW

Are imports declared and package/API names verified? 76 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2 finding(s).

PR Review Velocity Impact 7.4/100 · LOW

Which changes need focused human review? 207 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 2LOW 205

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 207 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block128 hits · 128 pts

Severity	File	Line	Snippet	Context
LOW	.golangci.yaml	21	- nolintlint	COMMENT
LOW	.golangci.yaml	41	# - gochecknoglobals	COMMENT
LOW	.golangci.yaml	61	# - gomodguard	COMMENT
LOW	.golangci.yaml	121	- localmodule	COMMENT
LOW	cmd/dex/config.go	741	// TOTPConfig holds configuration for a TOTP authenticator.	COMMENT
LOW	cmd/dex/config.go	761	// "none" — don't request attestation (simpler, more private)	COMMENT
LOW	server/config.go	101		COMMENT
LOW	server/signer/doc.go	1	// Package signer signs tokens and exposes the corresponding validation keys.	COMMENT
LOW	server/signer/vault_integration_test.go	21	//	COMMENT
LOW	server/grants/grants.go	101	type Responder interface {	COMMENT
LOW	server/grants/grants.go	121	// read it from the request or look it up in storage; returning an error	COMMENT
LOW	server/grants/doc.go	1	// Package grants implements the OAuth2 token endpoint (/token). It defines a	COMMENT
LOW	server/oauth2/doc.go	1	// Package oauth2 holds the OAuth2/OIDC protocol vocabulary shared across the	COMMENT
LOW	server/internal/doc.go	1	// Package internal holds the server's wire formats: the protobuf value types and	COMMENT
LOW	server/reqctx/doc.go	1	// Package reqctx carries per-request values (request ID, client IP) through the	COMMENT
LOW	server/logout/logout.go	61	}	COMMENT
LOW	server/logout/logout.go	161	}	COMMENT
LOW	server/logout/doc.go	1	// Package logout implements OIDC RP-Initiated Logout: the /logout and	COMMENT
LOW	server/introspection/introspection.go	21		COMMENT
LOW	server/introspection/introspection.go	41	// requested this token.	COMMENT
LOW	server/introspection/introspection.go	281	PreferredUsername: refresh.Claims.PreferredUsername,	COMMENT
LOW	server/authflow/response.go	81	}	COMMENT
LOW	server/authflow/doc.go	1	// Package authflow implements dex's interactive, browser-facing authorization	COMMENT
LOW	server/consent/doc.go	1	// Package consent owns the approval (consent) step of the authorization flow:	COMMENT
LOW	server/templates/doc.go	1	// Package templates renders dex's HTML pages — login, connector selection,	COMMENT
LOW	server/device/doc.go	1	// Package device implements the browser-facing side of the OAuth2 device	COMMENT
LOW	server/apiserver/refresh.go	101	// only the client that asked for it, because it has a requesting client to scope to	COMMENT
LOW	server/apiserver/doc.go	1	// Package apiserver implements the gRPC management API (api.DexServer): the CRUD	COMMENT
LOW	server/session/doc.go	1	// Package session owns dex's browser session: the session cookie, SSO session	COMMENT
LOW	docs/enhancements/auth-sessions-2026-02-18.md	341	// One per browser, referenced by session cookie.	COMMENT
LOW	docs/enhancements/auth-sessions-2026-02-18.md	401	```go	COMMENT
LOW	storage/storage.go	121	DeleteRefresh(ctx context.Context, id string) error	COMMENT
LOW	storage/storage.go	201		COMMENT
LOW	storage/storage.go	221	}	COMMENT
LOW	storage/storage.go	301		COMMENT
LOW	storage/storage.go	341	// WebAuthnSessionData stores temporary WebAuthn ceremony data (challenge, etc.)	COMMENT
LOW	storage/storage.go	501	type LogoutState struct {	COMMENT
LOW	storage/storage.go	561		COMMENT
LOW	storage/storage.go	601	Groups []string `json:"groups"`	COMMENT
LOW	storage/ent/db/password_query.go	261	//	COMMENT
LOW	storage/ent/db/password_query.go	281		COMMENT
LOW	storage/ent/db/authrequest_query.go	261	//	COMMENT
LOW	storage/ent/db/authrequest_query.go	281		COMMENT
LOW	storage/ent/db/oauth2client_query.go	261	//	COMMENT
LOW	storage/ent/db/oauth2client_query.go	281		COMMENT
LOW	storage/ent/db/connector_query.go	261	//	COMMENT
LOW	storage/ent/db/connector_query.go	281		COMMENT
LOW	storage/ent/db/authsession_query.go	261	//	COMMENT
LOW	storage/ent/db/authsession_query.go	281		COMMENT
LOW	storage/ent/db/useridentity_query.go	261	//	COMMENT
LOW	storage/ent/db/useridentity_query.go	281		COMMENT
LOW	storage/ent/db/offlinesession_query.go	261	//	COMMENT
LOW	storage/ent/db/offlinesession_query.go	281		COMMENT
LOW	storage/ent/db/authcode_query.go	261	//	COMMENT
LOW	storage/ent/db/authcode_query.go	281		COMMENT
LOW	storage/ent/db/keys_query.go	261	//	COMMENT
LOW	storage/ent/db/keys_query.go	281		COMMENT
LOW	storage/ent/db/devicetoken_query.go	261	//	COMMENT
LOW	storage/ent/db/devicetoken_query.go	281		COMMENT
LOW	storage/ent/db/refreshtoken_query.go	261	//	COMMENT
68 more matches not shown…

Fake / Example Data76 hits · 78 pts

Severity	File	Line	Snippet	Context
LOW	README.md	39	"name": "Jane Doe"	CODE
LOW	config.dev.yaml	32	- email: "admin@example.com"	CODE
LOW⚡	cmd/dex/excluding_handler_test.go	23	slog.String("email", "user@example.com"),	CODE
LOW⚡	cmd/dex/excluding_handler_test.go	32	slog.String("email", "user@example.com"),	CODE
LOW⚡	cmd/dex/excluding_handler_test.go	42	slog.String("email", "user@example.com"),	CODE
LOW	cmd/dex/excluding_handler_test.go	54	slog.String("email", "user@example.com"),	CODE
LOW	cmd/dex/excluding_handler_test.go	99	child := logger.With("email", "user@example.com", "connector_id", "github")	CODE
LOW	cmd/dex/config_test.go	163	- email: "admin@example.com"	CODE
LOW	cmd/dex/config_test.go	267	Email: "admin@example.com",	CODE
LOW	cmd/dex/config_test.go	398	- email: "admin@example.com"	CODE
LOW	cmd/dex/config_test.go	488	Email: "admin@example.com",	CODE
LOW	server/server_grant_password_test.go	134	Email: "user@example.com",	CODE
LOW	server/server_grant_password_test.go	151	v.Add("username", "user@example.com")	CODE
LOW	server/server_introspection_test.go	202	token: "fake-token",	CODE
LOW	server/server_introspection_test.go	221	token: "fake-token",	CODE
LOW	server/server_login_test.go	565	Email: "user@example.com",	CODE
LOW	server/server_test.go	436	Email: "foo@bar.com",	CODE
LOW	server/server_test.go	1180	Name: "Jane Doe",	CODE
LOW	server/server_test.go	1202	Username: "Jane Doe",	CODE
LOW	server/mfa/totp_test.go	19	key, err := totp.Generate(totp.GenerateOpts{Issuer: "dex", AccountName: "user@example.com"})	CODE
LOW	server/mfa/handler_test.go	107	Claims: storage.Claims{UserID: "user-1", Email: "user@example.com"},	CODE
LOW	server/mfa/handler_test.go	148	Claims: storage.Claims{UserID: "user-1", Email: "user@example.com"},	CODE
LOW	server/mfa/webauthn_test.go	52	Claims: storage.Claims{UserID: "user-1", Email: "user@example.com"},	CODE
LOW	server/mfa/webauthn_test.go	179	Email: "user@example.com",	CODE
LOW	server/mfa/webauthn_test.go	204	require.Equal(t, "user@example.com", user.WebAuthnName())	CODE
LOW	server/authflow/finalize_test.go	28	ident := connector.Identity{UserID: "user-1", Email: "user@example.com"}	CODE
LOW	server/authflow/finalize_test.go	39	Claims: storage.Claims{UserID: "user-1", Email: "user@example.com"},	CODE
LOW	server/authflow/finalize_test.go	86	ident := connector.Identity{UserID: "user-1", Email: "user@example.com"}	CODE
LOW	server/apiserver/api_test.go	1109	Claims: storage.Claims{UserID: "user1", Username: "test", Email: "test@test.com"},	CODE
LOW	server/apiserver/api_test.go	1345	Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,	CODE
LOW	server/apiserver/api_test.go	1360	Claims: storage.Claims{UserID: "user1", Email: "test@test.com"},	CODE
LOW	server/apiserver/api_test.go	1374	Email: "test@test.com", Hash: []byte("$2y$10$XXXXXXXXXXXXXXXXXXXXXX"), Username: "test", UserID: "user1",	CODE
LOW	server/apiserver/api_test.go	1403	if _, err := s.GetPassword(ctx, "test@test.com"); err == nil {	CODE
LOW	server/apiserver/api_test.go	1433	Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,	CODE
LOW	server/apiserver/api_test.go	1466	if identity.Claims.Email != "test@test.com" {	CODE
LOW	server/apiserver/api_test.go	1485	Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,	CODE
LOW	server/apiserver/api_test.go	1541	Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,	CODE
LOW	server/apiserver/api_test.go	1602	Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,	CODE
LOW	server/apiserver/api_test.go	1665	Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now, LastLogin: now,	CODE
LOW	server/apiserver/api_test.go	1801	Claims: storage.Claims{Email: "test@test.com"}, CreatedAt: now,	CODE
LOW	docs/enhancements/cel-expressions-2026-02-28.md	426	\| `dex.emailDomain` \| `(string) -> string` \| Returns the domain portion of an email address. `dex.emailDomain("user@exam	CODE
LOW	docs/enhancements/cel-expressions-2026-02-28.md	427	\| `dex.emailLocalPart` \| `(string) -> string` \| Returns the local part of an email address. `dex.emailLocalPart("user@ex	CODE
LOW	storage/conformance/transactions.go	130	Name: "Jane Doe",	CODE
LOW	storage/conformance/conformance.go	574	Name: "Jane Doe",	CODE
LOW	examples/config-dev.yaml	294	- email: "admin@example.com"	CODE
LOW	examples/k8s/dex.yaml	105	- email: "admin@example.com"	CODE
LOW	examples/example-app/server/forms.go	87	{Name: "username", Label: "Username", Type: "text", Placeholder: "user@example.com", Required: true},	CODE
LOW	connector/ldap/kerberos_test.go	252	c.UserSearch.NameAttr: {"John Doe"},	CODE
LOW	connector/ldap/kerberos_test.go	293	c.UserSearch.NameAttr: {"John Doe"},	CODE
LOW	connector/ldap/kerberos_test.go	455	c.UserSearch.EmailAttr: {"user@example.com"},	CODE
LOW	connector/ldap/kerberos_test.go	490	c.UserSearch.NameAttr: {"John Doe"},	CODE
LOW	connector/ldap/kerberos_test.go	549	c.UserSearch.NameAttr: {"John Doe"},	CODE
LOW	connector/google/google_test.go	117	DomainToAdminEmail: map[string]string{"*": "foo@bar.com"},	CODE
LOW	connector/google/google_test.go	128	DomainToAdminEmail: map[string]string{"bar.com": "foo@bar.com"},	CODE
LOW	connector/google/google_test.go	139	DomainToAdminEmail: map[string]string{"*": "foo@bar.com"},	CODE
LOW	connector/google/google_test.go	150	DomainToAdminEmail: map[string]string{"*": "foo@bar.com"},	CODE
LOW	connector/microsoft/microsoft_test.go	89	data: user{ID: "S56767889", Name: "Jane Doe", Email: "jane.doe@example.com"},	CODE
LOW	connector/microsoft/microsoft_test.go	100	expectEquals(t, identity.Username, "Jane Doe")	CODE
LOW	connector/microsoft/microsoft_test.go	111	data: user{ID: "S56767889", Name: "Jane Doe", Email: "jane.doe@example.com", MailNickname: "janedoe", OnPremisesSamAc	CODE
LOW	connector/microsoft/microsoft_test.go	122	{"name", "Jane Doe"},	CODE
16 more matches not shown…

Decorative Section Separators2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	connector/google/google_test.go	24	// ┌───────┤	COMMENT
MEDIUM	connector/google/google_test.go	26	// │ ├────────┐	COMMENT

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	examples/oidc-conformance/run.sh	8	# Usage:	COMMENT

dexidp/dex

Open-Source Code Quality, Security and Technical Debt Review