3.8

Adjusted Signal

3.8

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

4.9K

Stars

TypeScript

Language

173.4K

Lines of Code

1.1K

Files

394

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 277 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.1/100 · LOW

Are imports declared and package/API names verified? 19 finding(s).

Agent Over-Engineering Ratio 12.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 253 finding(s).

PR Review Velocity Impact 16.1/100 · LOW

Which changes need focused human review? 394 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 3MEDIUM 101LOW 290

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 394 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators98 hits · 294 pts

Severity	File	Line	Snippet	Context
MEDIUM	packages/encryption-binary-swift/scripts/build-swift.ts	26	// ── CLI args ────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-swift/scripts/build-swift.ts	46	// ── Paths ───────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-swift/scripts/build-swift.ts	53	// ── Build mode config ───────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-swift/scripts/build-swift.ts	89	// ── Phase 1: Compile ────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-swift/scripts/build-swift.ts	112	// ── Phase 2: Bundle ─────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-swift/scripts/build-swift.ts	184	// ── Codesign ────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/dashlane/test/dashlane.test.ts	33	// ── Test helper ──────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/dashlane/test/dashlane.test.ts	102	// ── Tests ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/passbolt/test/passbolt.test.ts	18	// ── Crypto fixtures ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/passbolt/test/passbolt.test.ts	112	// ── MSW Server ───────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/passbolt/test/passbolt.test.ts	337	// ── Test helper ──────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/passbolt/test/passbolt.test.ts	372	// ── Tests ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/bitwarden/src/plugin.ts	546	// ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/bitwarden/src/plugin.ts	558	// ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/keeper/test/keeper.test.ts	12	// ── Helpers ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/keeper/test/keeper.test.ts	68	// ── Tests ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/keeper/src/plugin.ts	19	// ════ PLUGIN CONFIGURATION ═══════════════════════════════════════════════════	COMMENT
MEDIUM	packages/plugins/keeper/src/plugin.ts	40	// ════ PLUGIN INSTANCE CLASS ═══════════════════════════════════════════════════	COMMENT
MEDIUM	packages/plugins/keeper/src/plugin.ts	315	// ════ ROOT DECORATOR: @initKeeper ════════════════════════════════════════════	COMMENT
MEDIUM	packages/plugins/keeper/src/plugin.ts	366	// ════ DATA TYPE: keeperSmToken ═══════════════════════════════════════════════	COMMENT
MEDIUM	packages/plugins/keeper/src/plugin.ts	402	// ════ RESOLVER FUNCTION: keeper() ═══════════════════════════════════════════	COMMENT
MEDIUM	packages/plugins/1password/test/1password.test.ts	23	// ── SDK mock setup ───────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/test/1password.test.ts	122	// ── Test helper ──────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/test/1password.test.ts	229	// ── Tests ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/test/1password.test.ts	232	// ── Service account CLI path ──────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/test/1password.test.ts	373	// ── App auth CLI path ─────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/test/1password.test.ts	433	// ── opLoadEnvironment ─────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/test/1password.test.ts	520	// ── Named instances ───────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/test/1password.test.ts	539	// ── Data types ────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/test/1password.test.ts	714	// ── Schema errors ─────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/src/plugin.ts	261	// ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/src/plugin.ts	263	// ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/src/plugin.ts	411	// ── Connect REST API helpers ──────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/src/plugin.ts	413	// ── CLI helpers (per-instance, for service account path only) ──────	COMMENT
MEDIUM	packages/plugins/1password/src/plugin.ts	531	// ── Connect REST API helpers ──────────────────────────────	COMMENT
MEDIUM	packages/plugins/1password/src/plugin.ts	669	// ── Core read methods ─────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/scripts/build-rust.ts	18	// ── CLI args ────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/scripts/build-rust.ts	29	// ── Paths ───────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/scripts/build-rust.ts	68	// ── Build ───────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/scripts/build-rust.ts	77	// ── Copy to native-bins ─────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/daemon_client.rs	468	// ── Stub for non-Windows platforms ──────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/secure_mem.rs	67	// ── Platform-specific memory locking ────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/ipc.rs	403	// ── Client handling ──────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/ipc.rs	482	// ── Unix client process verification ─────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/ipc.rs	536	// ── Peer session identity (Linux) ───────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/ipc.rs	779	// ── Windows pipe security ───────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/ipc.rs	871	// ── Windows client process verification ─────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/ipc.rs	939	// ── Windows named pipe client handling ───────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/ipc.rs	1048	// ── Tests ───────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/daemon.rs	223	// ── Message handlers ─────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/daemon.rs	363	// ── Biometric verification ───────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/daemon.rs	386	// ── Signal handling ──────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/main.rs	42	// ── CLI arg helpers ──────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/main.rs	54	// ── JSON output helpers ─────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/main.rs	76	// ── Commands ────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/key_store/mod.rs	106	// ── Path helpers ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/key_store/mod.rs	148	// ── Platform-specific key protection ─────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/key_store/mod.rs	326	// ── Public API ───────────────────────────────────────────────────	COMMENT
MEDIUM	packages/encryption-binary-rust/src/key_store/linux.rs	208	// ── Helpers ──────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/varlock/src/proxy/policy.test.ts	14	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
38 more matches not shown…

Hyper-Verbose Identifiers155 hits · 160 pts

Severity	File	Line	Snippet	Context
LOW	framework-tests/deploy/vercel-helpers.ts	230	export async function disableDeploymentProtection(): Promise<void> {	CODE
LOW	framework-tests/harness/test-fixture.ts	25	function addEdgeRuntimeToTemplateFiles(templateFiles?: TemplateFileMap): TemplateFileMap \| undefined {	CODE
LOW	packages/env-spec-parser/src/classes.ts	290	function commentedOutValueContinues(contents: string) {	CODE
LOW	packages/plugins/azure-key-vault/src/plugin.ts	145	function parseAppConfigConnectionString(raw: string): AppConfigConnection {	CODE
LOW	…plugins/google-secret-manager/src/workload-identity.ts	3	export function createSubjectTokenSupplier(	CODE
LOW	packages/plugins/proton-pass/src/plugin.ts	50	function getSecretFieldNameFromRef(secretRef: string): string \| undefined {	CODE
LOW	packages/plugins/kubernetes/src/plugin.ts	59	async function readServiceAccountNamespace(): Promise<string \| undefined> {	CODE
LOW	packages/varlock/scripts/test-local-binary.ts	52	function ensureWindowsHelperForWSL() {	CODE
LOW	packages/varlock/scripts/test-local-binary.ts	68	function copyWindowsHelperIfPresent() {	CODE
LOW	packages/varlock/src/proxy/approval-grants.ts	106	export function createGrantingApprovalProvider(opts: {	CODE
LOW	packages/varlock/src/proxy/request-target.ts	79	export function canonicalizeRequestTarget(rawTarget: string): CanonicalizeResult {	CODE
LOW	packages/varlock/src/proxy/request-target.ts	131	export function substitutedPathKeepsStructure(canonicalPath: string, substitutedPath: string): boolean {	CODE
LOW	packages/varlock/src/proxy/approval.ts	163	export function createAutoDenyApprovalProvider(): ApprovalProvider {	CODE
LOW	packages/varlock/src/proxy/approval.ts	205	export function createTtyApprovalProvider(opts?: {	CODE
LOW	packages/varlock/src/proxy/tunnel.ts	933	export function startTunnelClientListener(opts: {	CODE
LOW	packages/varlock/src/proxy/types.ts	52	export function proxySubstitutionTargetKey(target: ProxySubstitutionTarget): string {	CODE
LOW	packages/varlock/src/proxy/types.ts	70	export function isNeverAutoSubstituteHeader(name: string): boolean {	CODE
LOW	packages/varlock/src/proxy/types.ts	86	export function parseProxySubstitutionTarget(raw: string): ParsedProxySubstitutionTarget {	CODE
LOW	packages/varlock/src/proxy/types.ts	180	export function proxyTransformItemRefName(optionSpec: ProxyTransformOptionSpec, value: unknown): string \| undefined {	CODE
LOW	packages/varlock/src/proxy/types.ts	186	export function proxyTransformItemRefNames(optionSpec: ProxyTransformOptionSpec, value: unknown): Array<string> {	CODE
LOW	packages/varlock/src/proxy/types.ts	325	export function proxyTransformConsumedOptionName(spec: ProxyTransformSchemeSpec \| undefined): string \| undefined {	CODE
LOW	packages/varlock/src/proxy/types.ts	435	export function isForbiddenTransformHeader(name: string): boolean {	CODE
LOW	packages/varlock/src/proxy/types.ts	447	export function validateProxyTransformConfig(	CODE
LOW	packages/varlock/src/proxy/docs-examples.test.ts	42	function normalizeStandInResolvers(block: string): string {	CODE
LOW	packages/varlock/src/proxy/policy.ts	178	export function getRequestScopedManagedItems(	CODE
LOW	packages/varlock/src/proxy/runtime-proxy.ts	722	export function collectConsumedTransformKeys(	CODE
LOW	packages/varlock/src/proxy/runtime-proxy.ts	752	export function substitutePlaceholdersInSurface(	CODE
LOW	packages/varlock/src/proxy/runtime-proxy.ts	777	export function findUninjectedPlaceholder(	CODE
LOW	packages/varlock/src/proxy/runtime-proxy.ts	790	function replaceRealWithPlaceholders(value: string, managedItems: Array<ProxyManagedItem>): string {	CODE
LOW	packages/varlock/src/proxy/runtime-proxy.ts	1056	function forwardUpstreamResponseWithRedaction(	CODE
LOW	packages/varlock/src/proxy/request-transform.ts	39	export function computeTransformTimestamp(format: ProxyTransformTimestampFormat \| undefined, nowMs: number): string {	CODE
LOW	packages/varlock/src/proxy/sandbox-docker.ts	44	export function isContainerRuntimeAvailable(runtime: ContainerRuntime): boolean {	CODE
LOW	packages/varlock/src/proxy/sandbox-seatbelt.ts	37	export function isBuiltinSandboxSupported(platform: NodeJS.Platform = process.platform): boolean {	CODE
LOW	packages/varlock/src/proxy/session-registry.ts	318	export async function cleanupStaleProxySessions() {	CODE
LOW	packages/varlock/src/proxy/session-registry.ts	353	export async function reserveProxySessionIdentity(): Promise<{ id: string; uuid: string }> {	CODE
LOW	packages/varlock/src/proxy/session-registry.ts	395	export async function resolveActiveProxySession(	CODE
LOW	packages/varlock/src/proxy/session-registry.ts	445	export function resetActiveProxySessionCache() {	CODE
LOW	packages/varlock/src/proxy/session-registry.ts	466	export async function getProxyResolutionViewForEnv(	CODE
LOW⚡	packages/varlock/src/proxy/session-registry.ts	502	export async function addProxySessionAttachment(uuid: string, pid: number) {	CODE
LOW⚡	packages/varlock/src/proxy/session-registry.ts	510	export async function removeProxySessionAttachment(uuid: string, pid: number) {	CODE
LOW⚡	packages/varlock/src/proxy/session-registry.ts	517	export async function resolveProxySessionForCommand(opts?: {	CODE
LOW	packages/varlock/src/proxy/placeholder.ts	101	export async function generateProxyPlaceholderForItem(	CODE
LOW	packages/varlock/src/runtime/init.ts	51	function gateEdgeEntriesUntilReady(ready: Promise<void>) {	CODE
LOW	packages/varlock/src/runtime/patch-process-streams.ts	56	export function shouldRedactProcessStream(	CODE
LOW	packages/varlock/src/runtime/patch-server-response.ts	278	export function patchGlobalServerResponse(opts?: {	CODE
LOW	packages/varlock/src/runtime/patch-server-response.ts	326	ServerResponse.prototype.write = function varlockPatchedServerResponseWrite(...args) {	CODE
LOW	packages/varlock/src/runtime/env.ts	217	export function getRedactionHoldbackLength(str: string): number {	CODE
LOW	packages/varlock/src/runtime/env.ts	679	export function getPreInjectionProcessEnv(): Record<string, string \| undefined> {	CODE
LOW	packages/varlock/src/runtime/env.ts	908	export function getPublicDynamicConfigKeys(): Array<string> {	CODE
LOW⚡	packages/varlock/src/runtime/env.ts	930	function getDynamicBuildAccessMode() {	CODE
LOW⚡	packages/varlock/src/runtime/env.ts	935	function shouldGuardDynamicAccessDuringBuild() {	CODE
LOW⚡	packages/varlock/src/runtime/env.ts	940	function notifyDynamicConfigAccess(meta: DynamicConfigAccessMeta) {	CODE
LOW	packages/varlock/src/runtime/env.ts	956	function hasHydratedPublicDynamicEnv() {	CODE
LOW	…ckages/varlock/src/runtime/test/edge-evaluable.test.ts	35	function evaluateInEdgeLikeContext(entryFile: string, opts: {	CODE
LOW	…ckages/varlock/src/runtime/test/edge-evaluable.test.ts	95	function evaluateCjsBundleInEdgeLikeContext(bundleFile: string, opts: {	CODE
LOW	packages/varlock/src/runtime/lib/redact-stream.ts	49	function getUnmaskPrefixHoldbackLength(str: string): number {	CODE
LOW	packages/varlock/src/runtime/lib/redact-stream.ts	127	export function createRedactedStreamWriter(	CODE
LOW	…/varlock/src/env-graph/test/internal-decorator.test.ts	15	async function loadSchemaWithInternalType(contents: string) {	CODE
LOW	packages/varlock/src/env-graph/lib/decorators.ts	401	function assertNoRemovedProxyOptions(keys: Array<string>): void {	CODE
LOW	packages/varlock/src/env-graph/lib/decorators.ts	488	function assertProxySubstituteInArg(resolver: Resolver \| undefined): void {	CODE
95 more matches not shown…

Over-Commented Block81 hits · 78 pts

Severity	File	Line	Snippet	Context
LOW	socket.yml	1	# Socket (socket.dev) configuration — read by the Socket GitHub App.	COMMENT
LOW	framework-tests/harness/dev-server.ts	241	// environment, which detaches the server's output (and emits JSON logs) so	COMMENT
LOW	…rk-tests/frameworks/sveltekit/files/pages/prerender.ts	1	// Make the route fully static — exercises the Cloudflare adapter + varlock's	COMMENT
LOW	framework-tests/frameworks/nextjs/nextjs-shared.ts	161	const buildCommand = `next build ${buildToolFlag}`;	COMMENT
LOW	framework-tests/frameworks/nextjs/nextjs-canary.test.ts	1	import { describe } from 'vitest';	COMMENT
LOW	.claude/hooks/worktree-deps.sh	1	#!/usr/bin/env bash	COMMENT
LOW	smoke-tests/tests/proxy-python.test.ts	1	import { describe, expect, test } from 'vitest';	COMMENT
LOW	smoke-tests/smoke-test-nextjs/next-env.d.ts	1	/// <reference types="next" />	COMMENT
LOW	packages/env-spec-parser/README.md	101	- Decorator values will be parsed using the common value-handling rules (see below)	COMMENT
LOW	…swift/swift/Sources/SessionScoping/SessionScoper.swift	1	import Foundation	COMMENT
LOW	…swift/swift/Sources/SessionScoping/SessionScoper.swift	41	/// Varlock CLI launchers are also one-shot; scope to the host that invoked them.	COMMENT
LOW	…swift/swift/Sources/SessionScoping/SessionScoper.swift	181	// stay distinct even if a TTY device name happens to collide.	COMMENT
LOW	…wift/Sources/VarlockEnclave/SecureEnclaveManager.swift	1	import Foundation	COMMENT
LOW	…wift/Sources/VarlockEnclave/SecureEnclaveManager.swift	141	throw EnclaveError.keyNotFound("\(keyId) - \(error.localizedDescription)")	COMMENT
LOW	…ary-swift/swift/Sources/VarlockEnclave/IPCServer.swift	161	var probeAddr = sockaddr_un()	COMMENT
LOW	…wift/swift/Sources/VarlockEnclave/SessionManager.swift	1	import Foundation	COMMENT
LOW	packages/plugins/azure-key-vault/test/azure.test.ts	221	function servicePrincipalSchema(fake: FakeAzure, extraInitArgs = '') {	COMMENT
LOW	packages/plugins/azure-key-vault/test/azure.test.ts	621	# @plugin(${PLUGIN_PATH})	COMMENT
LOW	packages/plugins/doppler/README.md	41	# @initDoppler(	COMMENT
LOW	packages/plugins/infisical/README.md	61	# )	COMMENT
LOW	packages/plugins/infisical/README.md	201		COMMENT
LOW	packages/plugins/infisical/README.md	321	# @plugin(@varlock/infisical-plugin)	COMMENT
LOW	packages/plugins/bitwarden/test/bwp.test.ts	201	# @initBwp(id=work, sessionToken=$BWP_SESSION)	COMMENT
LOW	packages/plugins/bitwarden/src/plugin.ts	541		COMMENT
LOW	packages/encryption-binary-rust/src/daemon_client.rs	1	//! Daemon client for one-shot commands that need biometric verification.	COMMENT
LOW	packages/encryption-binary-rust/src/daemon_client.rs	21	/// Returns the decrypted plaintext.	COMMENT
LOW	packages/encryption-binary-rust/src/daemon_client.rs	221	.status();	COMMENT
LOW	…encryption-binary-rust/src/key_store/secret_service.rs	1	//! Linux Secret Service (libsecret / GNOME Keyring / KWallet) backend.	COMMENT
LOW	packages/encryption-binary-rust/src/key_store/mod.rs	1	//! Key storage abstraction.	COMMENT
LOW	packages/encryption-binary-rust/src/key_store/mod.rs	21	//! }	COMMENT
LOW	packages/encryption-binary-rust/src/key_store/polkit.rs	1	//! Linux biometric / user-presence verification via polkit.	COMMENT
LOW	…ckages/encryption-binary-rust/src/key_store/windows.rs	1	//! Windows key protection using DPAPI (CryptProtectData / CryptUnprotectData).	COMMENT
LOW	packages/encryption-binary-rust/src/key_store/linux.rs	1	//! Linux key protection using TPM2 seal/unseal via tpm2-tools.	COMMENT
LOW	packages/varlock/src/auto-load.ts	81	// chain, when a plaintext blob is present). Otherwise a command-local override under a	COMMENT
LOW	packages/varlock/src/auto-load.ts	121	}	COMMENT
LOW	packages/varlock/src/auto-load.ts	181	// No hook, but a tracker is already initialized (e.g. Sentry via `--import`). Throw so its	COMMENT
LOW	packages/varlock/src/proxy/runtime-proxy.ts	1221	// Mutable so `reconfigure` can hot-swap the enforced policy on a live proxy.	COMMENT
LOW	packages/varlock/src/proxy/runtime-proxy.ts	1581	? ''	COMMENT
LOW	packages/varlock/src/runtime/auto-init.ts	1	// Side-effect-on-import varlock runtime init (`import 'varlock/auto-init'`).	COMMENT
LOW	packages/varlock/src/runtime/env.ts	21	// Store redaction state on globalThis so all module instances (e.g., multiple CJS bundles	COMMENT
LOW	packages/varlock/src/runtime/env.ts	1141		COMMENT
LOW	packages/varlock/src/runtime/init-bundle.ts	1	// Self-contained init bundle: the `varlock/auto-init` sequence as a single CJS file (built	COMMENT
LOW	…varlock/src/env-graph/test/sensitive-decorator.test.ts	661	# @defaultRequired=false	COMMENT
LOW	…varlock/src/env-graph/test/required-decorators.test.ts	141	`,	COMMENT
LOW	…lib/type-generation/detect-process-env-augmentation.ts	41	}	COMMENT
LOW	packages/varlock/src/cli/commands/proxy.command.ts	1481	// Adopt the running session's env: the owner resolved it in its own context	COMMENT
LOW	packages/varlock/src/lib/native-app-client.ts	161		COMMENT
LOW	packages/varlock/src/lib/exec-sync-varlock.ts	201	// Search from cwd (if provided), callerDir, then process.cwd().	COMMENT
LOW	packages/integrations/cloudflare/src/init.ts	1	// Cloudflare Workers init module for varlock.	COMMENT
LOW	…s/integrations/cloudflare/src/shared-ssr-entry-code.ts	1	// Code injected at the top of the SSR entry module so varlock can load its	COMMENT
LOW	packages/integrations/vite/src/index.ts	361	let ssrInjectMode = opts.ssrInjectMode ?? 'init-only';	COMMENT
LOW	packages/integrations/vite/src/index.ts	561	// exposes it on the `vite-plugin-sveltekit-setup` plugin's `api.options`, so	COMMENT
LOW	packages/integrations/vite/src/index.ts	801	// unavailable. During builds isEntry is authoritative — and under	COMMENT
LOW	packages/integrations/nuxt/src/index.ts	61	// Restart the dev server when any loaded env file changes. Nuxt's own	COMMENT
LOW	packages/integrations/nuxt/src/index.ts	81	// refreshing the store here makes config-time reads (`varlock/auto-load`	COMMENT
LOW	packages/integrations/nextjs/src/loader.ts	281	// Edge context: no direct initVarlockEnv() call — env init is owned by the	COMMENT
LOW	packages/vscode-plugin/test/grammar.test.txt	1	# SYNTAX TEST "source.env-spec" "Comprehensive grammar tests"	COMMENT
LOW	packages/vscode-plugin/test/grammar.test.txt	21	# ^ keyword.operator.assignment.env-spec	COMMENT
LOW	packages/vscode-plugin/test/grammar.test.txt	41	# ======================	COMMENT
LOW	packages/vscode-plugin/test/grammar.test.txt	61	# <- comment.line.env-spec	COMMENT
21 more matches not shown…

Structural Annotation Overuse17 hits · 35 pts

Severity	File	Line	Snippet	Context
LOW	packages/plugins/bitwarden/src/plugin.ts	180	// Step 1: Exchange access token for JWT	COMMENT
LOW⚡	packages/plugins/bitwarden/src/plugin.ts	201	// Step 2: Derive key from encryption key (produces 64 bytes: 32 for enc, 32 for mac)	COMMENT
LOW⚡	packages/plugins/bitwarden/src/plugin.ts	206	// Step 3: Decrypt the organization key	COMMENT
LOW	packages/plugins/bitwarden/src/crypto-utils.ts	65	// Step 1: HMAC-SHA256 with key="bitwarden-accesstoken"	COMMENT
LOW⚡	packages/plugins/bitwarden/src/crypto-utils.ts	80	// Step 2: HKDF-Expand to 64 bytes (manual implementation since Web Crypto does Extract+Expand)	COMMENT
LOW⚡	packages/plugins/bitwarden/src/crypto-utils.ts	84	// Step 3: Split into encryption key (first 32 bytes) and MAC key (last 32 bytes)	COMMENT
LOW⚡	packages/plugins/keeper/README.md	175	### Step 1: Create a Secrets Manager Application	COMMENT
LOW⚡	packages/plugins/keeper/README.md	182	### Step 2: Share folders	COMMENT
LOW⚡	packages/plugins/keeper/README.md	188	### Step 3: Generate a one-time access token	COMMENT
LOW⚡	packages/plugins/keeper/README.md	193	### Step 4: Initialize and export the config	COMMENT
LOW	packages/plugins/keeper/README.md	206	### Step 5: Set up your schema	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	113	// Step 1: Create SRK (Storage Root Key) — deterministic	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	120	// Step 2: Seal the private key under the SRK via stdin (avoid temp file issues)	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	128	// Step 3: Read the sealed blobs	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	174	// Step 1: Recreate SRK (deterministic — same params = same key)	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	181	// Step 2: Load the sealed object	COMMENT
LOW	packages/encryption-binary-rust/src/key_store/linux.rs	192	// Step 3: Unseal	COMMENT

Verbosity Indicators12 hits · 25 pts

Severity	File	Line	Snippet	Context
LOW	packages/plugins/bitwarden/src/plugin.ts	180	// Step 1: Exchange access token for JWT	COMMENT
LOW⚡	packages/plugins/bitwarden/src/plugin.ts	201	// Step 2: Derive key from encryption key (produces 64 bytes: 32 for enc, 32 for mac)	COMMENT
LOW⚡	packages/plugins/bitwarden/src/plugin.ts	206	// Step 3: Decrypt the organization key	COMMENT
LOW	packages/plugins/bitwarden/src/crypto-utils.ts	65	// Step 1: HMAC-SHA256 with key="bitwarden-accesstoken"	COMMENT
LOW⚡	packages/plugins/bitwarden/src/crypto-utils.ts	80	// Step 2: HKDF-Expand to 64 bytes (manual implementation since Web Crypto does Extract+Expand)	COMMENT
LOW⚡	packages/plugins/bitwarden/src/crypto-utils.ts	84	// Step 3: Split into encryption key (first 32 bytes) and MAC key (last 32 bytes)	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	113	// Step 1: Create SRK (Storage Root Key) — deterministic	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	120	// Step 2: Seal the private key under the SRK via stdin (avoid temp file issues)	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	128	// Step 3: Read the sealed blobs	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	174	// Step 1: Recreate SRK (deterministic — same params = same key)	COMMENT
LOW⚡	packages/encryption-binary-rust/src/key_store/linux.rs	181	// Step 2: Load the sealed object	COMMENT
LOW	packages/encryption-binary-rust/src/key_store/linux.rs	192	// Step 3: Unseal	COMMENT

Cross-Language Confusion (JS/TS)3 hits · 22 pts

Severity	File	Line	Snippet	Context
HIGH⚡	smoke-tests/tests/proxy-python.test.ts	46	print('STATUS', r.status)	CODE
HIGH⚡	smoke-tests/tests/proxy-python.test.ts	48	print('STATUS', e.code)	CODE
HIGH⚡	smoke-tests/tests/proxy-python.test.ts	50	print('URLERROR', e.reason)	CODE

Fake / Example Data16 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	smoke-tests/tests/composite-values.test.ts	11	expect(vars.ALLOWED_EMAILS).toEqual(['admin@example.com', 'support@example.com']);	CODE
LOW	packages/varlock/src/proxy/session-registry.ts	473	view[key] = { kind: 'placeholder', value };	CODE
LOW	packages/varlock/src/proxy/placeholder.ts	105	const placeholderDec = item.getDec('placeholder');	CODE
LOW	packages/varlock/src/env-graph/test/data-types.test.ts	981	['credentials', 'user@example.com'],	CODE
LOW	packages/varlock/src/env-graph/test/data-types.test.ts	1626	expect(g.configSchema.ITEM.resolvedValue).toEqual(['user@example.com']);	CODE
LOW	packages/varlock/src/env-graph/test/data-types.test.ts	1803	'admin@example.com',	CODE
LOW	packages/varlock/src/env-graph/test/data-types.test.ts	2513	'admin@example.com',	CODE
LOW	packages/varlock/src/env-graph/test/proxy-mode.test.ts	885	{ NUM_SECRET: { kind: 'placeholder', value: 'vlk_placeholder_NUM_SECRET_abcd1234' } },	CODE
LOW	packages/varlock/src/env-graph/test/proxy-mode.test.ts	922	{ STATIC_SECRET: { kind: 'placeholder', value: 'vlk_placeholder_STATIC_SECRET_abcd' } },	CODE
LOW	packages/varlock/src/env-graph/lib/decorators.ts	1055	name: 'placeholder',	CODE
LOW	packages/varlock/src/env-graph/lib/env-graph.ts	198	{ kind: 'placeholder'; value: string } \| { kind: 'omit' }	CODE
LOW	packages/varlock/src/env-graph/lib/config-item.ts	1085	if (proxyDirective.kind === 'placeholder') {	CODE
LOW	packages/varlock/src/cli/commands/proxy.command.ts	2441	secrets.push({ key, label: `${ansis.cyan('placeholder')}: sensitive, no rule (not injected anywhere)` });	CODE
LOW	packages/varlock/src/lib/test/load-graph.test.ts	53	API_KEY: { kind: 'placeholder', value: '<<PROXY_PLACEHOLDER>>' },	CODE
LOW	packages/varlock/src/lib/test/load-graph.test.ts	92	API_KEY: { kind: 'placeholder', value: '<<PH>>' },	CODE
LOW	packages/utils/test/git-utils.test.ts	28	execSync('git config user.email "test@test.com"', { cwd: testDir });	CODE

Redundant / Tautological Comments7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	scripts/login-ghcr.sh	8	# Check if GitHub CLI is installed	COMMENT
LOW	scripts/login-ghcr.sh	15	# Check if already authenticated with correct scopes	COMMENT
LOW	scripts/publish-docker.sh	18	# Check if GitHub CLI is installed and authenticated	COMMENT
LOW	scripts/publish-docker.sh	31	# Check if user has access to the organization	COMMENT
LOW	…ages/varlock/src/cli/commands/printenv.command-spec.ts	43	varlock printenv MY_VAR # Print the value of MY_VAR	CODE
LOW	.github/workflows/test.yaml	78	# Check if native binary source changed (used to gate native builds)	COMMENT
LOW	.github/workflows/test.yaml	124	# Check if native binary caches exist (lookup-only, no download)	COMMENT

Modern AI Meta-Vocabulary2 hits · 5 pts

Severity	File	Line	Snippet	Context
MEDIUM	README.md	95	In many cases you can use our [drop-in integrations](https://varlock.dev/integrations/javascript/) for seamless experien	CODE
MEDIUM	framework-tests/harness/dev-server.ts	240	// Astro v7 auto-backgrounds `astro dev` when it detects an agentic/CI	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/notarize-native-macos.yaml	66	# Create a zip for notarization submission	COMMENT

AI Slop Vocabulary1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	packages/varlock/install.sh	118	# if homebrew is detected, we just use it	COMMENT

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	packages/varlock/src/lib/native-app-client.ts	155	// // Example usage:	COMMENT

dmno-dev/varlock

Open-Source Code Quality, Security and Technical Debt Review