Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.
This report summarizes scanner evidence for doorkeeper-gem/doorkeeper, a Ruby project with 5,523 GitHub stars. SynthScan examined 43,752 lines of code across 357 source files, recording 237 pattern matches distributed across 6 syntactic categories. The legacy adjusted pattern signal is 5.7 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 237 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 70 finding(s).
Which changes need focused human review? 237 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 237 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .rubocop_todo.yml | 1 | # This configuration was generated by | COMMENT |
| LOW | app/controllers/doorkeeper/tokens_controller.rb | 61 | # The client also includes its authentication credentials as described | COMMENT |
| LOW | app/controllers/doorkeeper/tokens_controller.rb | 81 | # RFC7009 | COMMENT |
| LOW | app/controllers/doorkeeper/authorizations_controller.rb | 81 | # super | COMMENT |
| LOW | …llers/doorkeeper/authorized_applications_controller.rb | 41 | # nil, and so does any block written as a bare lookup such as | COMMENT |
| LOW | spec/dummy/app/assets/config/manifest.js | 1 | // JS and CSS bundles | COMMENT |
| LOW | spec/dummy/config/environments/production.rb | 21 | COMMENT | |
| LOW | spec/dummy/config/environments/production.rb | 41 | # Use a different cache store in production | COMMENT |
| LOW | spec/dummy/config/environments/test.rb | 21 | # Show full error reports and disable caching | COMMENT |
| LOW | spec/dummy/config/initializers/backtrace_silencers.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | spec/dummy/config/initializers/session_store.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 21 | # Admin.find_by_id(session[:admin_id]) || redirect_to(new_admin_session_url) | COMMENT |
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 41 | # | COMMENT |
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 61 | # Change the way client credentials are retrieved from the request object. | COMMENT |
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 81 | # | COMMENT |
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 101 | # puts "BEFORE HOOK FIRED! #{request}" | COMMENT |
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 121 | # | COMMENT |
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 141 | # `authorized_client` is nil if and only if `authorized_token` is present, and vice versa. | COMMENT |
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 161 | # | COMMENT |
| LOW | spec/dummy/config/initializers/secret_token.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | spec/dummy/db/schema.rb | 1 | # This file is auto-generated from the current state of the database. Instead | COMMENT |
| LOW | spec/requests/endpoints/metadata_spec.rb | 201 | context "with a custom tokens controller outside the doorkeeper namespace" do | COMMENT |
| LOW | spec/requests/applications/api_only_spec.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | spec/support/helpers/application_model_helper.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | spec/lib/doorkeeper/orm/active_record_spec.rb | 61 | COMMENT | |
| LOW | spec/lib/doorkeeper/orm/active_record_spec.rb | 161 | expect(CustomStiAccessGrant.ancestors).to include( | COMMENT |
| LOW | lib/doorkeeper/request.rb | 81 | # credentials and body credentials is rejected even when only one of | COMMENT |
| LOW | lib/doorkeeper/http_fetcher.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/doorkeeper/http_fetcher.rb | 21 | # loopback interface is intentionally not implemented. These rules follow | COMMENT |
| LOW | lib/doorkeeper/http_fetcher.rb | 41 | # Ceiling on the whole exchange, so a body delivered one byte per | COMMENT |
| LOW | lib/doorkeeper/config.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/doorkeeper/config.rb | 61 | # @param { Hash } with grant_types as keys. | COMMENT |
| LOW | lib/doorkeeper/config.rb | 101 | # | COMMENT |
| LOW | lib/doorkeeper/config.rb | 141 | # (writable) database when automatic role switching is enabled. | COMMENT |
| LOW | lib/doorkeeper/config.rb | 221 | # Provide a different secret storage implementation class for tokens | COMMENT |
| LOW | lib/doorkeeper/config.rb | 341 | # | COMMENT |
| LOW | lib/doorkeeper/config.rb | 361 | # | COMMENT |
| LOW | lib/doorkeeper/config.rb | 381 | # Allows to forbid specific Application redirect URI's by custom rules. | COMMENT |
| LOW | lib/doorkeeper/config.rb | 401 | # | COMMENT |
| LOW | lib/doorkeeper/config.rb | 421 | # different server process; a multi-process deployment can supply a | COMMENT |
| LOW | lib/doorkeeper/config.rb | 441 | # private_key_jwt_jwks_cache Doorkeeper::DocumentCache.new(ttl: 300) | COMMENT |
| LOW | lib/doorkeeper/config.rb | 461 | COMMENT | |
| LOW | lib/doorkeeper/config.rb | 481 | # https://doorkeeper.gitbook.io/guides/configuration/other-configurations#custom-application-secret-generator | COMMENT |
| LOW | lib/doorkeeper/config.rb | 541 | # | COMMENT |
| LOW | lib/doorkeeper/config.rb | 581 | # Doorkeeper Access Token model class. | COMMENT |
| LOW | lib/doorkeeper/oauth/nonstandard.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/doorkeeper/oauth/nonstandard.rb | 21 | # | COMMENT |
| LOW | lib/doorkeeper/oauth/authorization_code_request.rb | 181 | COMMENT | |
| LOW | lib/doorkeeper/oauth/authorization_code_request.rb | 241 | COMMENT | |
| LOW | lib/doorkeeper/oauth/client.rb | 1 | # frozen_string_literal: true | COMMENT |
| LOW | lib/doorkeeper/oauth/token.rb | 21 | # RFC 6750 §2: "Clients MUST NOT use more than one method to transmit | COMMENT |
| LOW | lib/doorkeeper/oauth/refresh_token_request.rb | 141 | # used to obtain a new access token when the current access token | COMMENT |
| LOW | lib/doorkeeper/oauth/scopes.rb | 81 | # DEPRECATED: With dynamic scopes, #allowed should be called because | COMMENT |
| LOW | lib/doorkeeper/oauth/token_introspection.rb | 41 | private | COMMENT |
| LOW | lib/doorkeeper/oauth/token_introspection.rb | 121 | COMMENT | |
| LOW | lib/doorkeeper/oauth/token_introspection.rb | 141 | # much of the authorization server's state to a third party, the | COMMENT |
| LOW | lib/doorkeeper/oauth/token_introspection.rb | 161 | # before its expiration time). | COMMENT |
| LOW | lib/doorkeeper/oauth/token_introspection.rb | 181 | # place. | COMMENT |
| LOW | lib/doorkeeper/oauth/password_access_token_request.rb | 61 | # other authentication requirements), the client MUST authenticate with the authorization | COMMENT |
| 94 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/controllers/doorkeeper/tokens_controller.rb | 179 | def before_successful_authorization(context = nil) | CODE |
| LOW | app/controllers/doorkeeper/tokens_controller.rb | 183 | def after_successful_authorization(context) | CODE |
| LOW | app/controllers/doorkeeper/authorizations_controller.rb | 233 | def before_successful_authorization(context = nil) | CODE |
| LOW | app/controllers/doorkeeper/authorizations_controller.rb | 237 | def after_successful_authorization(context) | CODE |
| LOW⚡ | spec/support/helpers/model_helper.rb | 12 | def authorization_code_exists(options = {}) | CODE |
| LOW⚡ | spec/support/helpers/model_helper.rb | 20 | def access_grant_should_exist_for(client, resource_owner) | CODE |
| LOW⚡ | spec/support/helpers/model_helper.rb | 29 | def access_token_should_exist_for(client, resource_owner) | CODE |
| LOW | spec/support/helpers/model_helper.rb | 46 | def access_grant_should_have_scopes(*args) | CODE |
| LOW | spec/support/helpers/model_helper.rb | 51 | def access_token_should_have_scopes(*args) | CODE |
| LOW | spec/support/helpers/authorization_request_helper.rb | 4 | def resource_owner_is_authenticated(resource_owner = nil) | CODE |
| LOW⚡ | spec/support/helpers/authorization_request_helper.rb | 21 | def client_should_be_authorized(client) | CODE |
| LOW⚡ | spec/support/helpers/authorization_request_helper.rb | 25 | def client_should_not_be_authorized(client) | CODE |
| LOW⚡ | spec/support/helpers/authorization_request_helper.rb | 29 | def i_should_be_on_client_callback(client) | CODE |
| LOW⚡ | spec/support/helpers/authorization_request_helper.rb | 33 | def allowing_forgery_protection(&_block) | CODE |
| LOW | spec/support/helpers/url_helper.rb | 19 | def password_token_endpoint_params(options = {}) | CODE |
| LOW | spec/support/helpers/url_helper.rb | 30 | def authorization_endpoint_url(options = {}) | CODE |
| LOW | spec/support/helpers/url_helper.rb | 48 | def refresh_token_endpoint_params(options = {}) | CODE |
| LOW | spec/support/helpers/request_spec_helper.rb | 24 | def url_should_not_have_param(param) | CODE |
| LOW | spec/support/helpers/request_spec_helper.rb | 56 | def basic_auth_header_for_client(client) | CODE |
| LOW⚡ | spec/support/helpers/request_spec_helper.rb | 69 | def i_should_see_translated_error_message(key) | CODE |
| LOW⚡ | spec/support/helpers/request_spec_helper.rb | 73 | def i_should_not_see_translated_error_message(key) | CODE |
| LOW⚡ | spec/support/helpers/request_spec_helper.rb | 81 | def i_should_see_translated_invalid_request_error_message(key, value) | CODE |
| LOW⚡ | spec/support/helpers/request_spec_helper.rb | 85 | def translated_invalid_request_error_message(key, value) | CODE |
| LOW⚡ | spec/support/helpers/request_spec_helper.rb | 89 | def response_status_should_be(status) | CODE |
| LOW | spec/lib/oauth/client_spec.rb | 20 | def with_deprecation_warnings(enabled: true) | CODE |
| LOW | …ec/generators/previous_refresh_token_generator_spec.rb | 23 | def stub_previous_refresh_token_column(exists:) | CODE |
| LOW | spec/generators/refresh_token_scopes_generator_spec.rb | 15 | def stub_refresh_token_scopes_column(exists:) | CODE |
| LOW | …ec/generators/grant_reuse_revocation_generator_spec.rb | 16 | def stub_access_token_id_column(exists:) | CODE |
| LOW⚡ | spec/controllers/protected_resources_controller_spec.rb | 14 | def doorkeeper_unauthorized_render_options(*); end | CODE |
| LOW⚡ | spec/controllers/protected_resources_controller_spec.rb | 16 | def doorkeeper_forbidden_render_options(*); end | CODE |
| LOW⚡ | spec/controllers/protected_resources_controller_spec.rb | 18 | def doorkeeper_bad_request_render_options(*); end | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 199 | def doorkeeper_unauthorized_render_options(error: nil) | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 209 | def doorkeeper_unauthorized_render_options(error: nil); end | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 229 | def doorkeeper_unauthorized_render_options(**) | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 239 | def doorkeeper_unauthorized_render_options(error: nil); end | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 257 | def doorkeeper_unauthorized_render_options(**) | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 267 | def doorkeeper_unauthorized_render_options(error: nil); end | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 289 | def doorkeeper_forbidden_render_options(*); end | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 315 | def doorkeeper_forbidden_render_options(*) | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 336 | def doorkeeper_forbidden_render_options(*) | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 354 | def doorkeeper_forbidden_render_options(*) | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 373 | def doorkeeper_forbidden_render_options(*) | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 397 | def doorkeeper_bad_request_render_options(*); end | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 406 | def doorkeeper_bad_request_render_options(error: nil) | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 430 | def doorkeeper_bad_request_render_options(**) | CODE |
| LOW | spec/controllers/protected_resources_controller_spec.rb | 451 | def doorkeeper_bad_request_render_options(**) | CODE |
| LOW | lib/doorkeeper/request.rb | 14 | def client_authentication_method(request) | CODE |
| LOW | lib/doorkeeper/request.rb | 128 | def build_fallback_strategy_class(grant_or_request_type) | CODE |
| LOW | lib/doorkeeper/oauth/base_request.rb | 29 | def find_or_create_access_token(client, resource_owner, scopes, custom_attributes, server) | CODE |
| LOW | lib/doorkeeper/oauth/token.rb | 78 | def from_bearer_authorization(request) | CODE |
| LOW | lib/doorkeeper/oauth/token.rb | 100 | def transmission_methods_used(request, method) | CODE |
| LOW | lib/doorkeeper/oauth/token.rb | 144 | def decode_basic_credentials_token(encoded_header) | CODE |
| LOW | lib/doorkeeper/oauth/client_credentials/creator.rb | 68 | def find_active_existing_token_for(client, scopes, attributes) | CODE |
| LOW | lib/doorkeeper/oauth/authorization/token.rb | 107 | def public_client_expires_in_cap(configuration, application) | CODE |
| LOW | lib/doorkeeper/models/access_token_mixin.rb | 57 | def by_previous_refresh_token(previous_refresh_token) | CODE |
| LOW | lib/doorkeeper/models/access_token_mixin.rb | 110 | def find_access_token_in_batches(relation, **args, &block) | CODE |
| LOW | lib/doorkeeper/models/access_token_mixin.rb | 437 | def last_authorized_token_for(application_id, resource_owner) | CODE |
| LOW | lib/doorkeeper/models/access_token_mixin.rb | 467 | def extract_custom_attributes(attributes) | CODE |
| LOW | lib/doorkeeper/orm/active_record/mixins/application.rb | 106 | def read_attribute_for_serialization(key) | CODE |
| LOW | lib/doorkeeper/orm/active_record/mixins/application.rb | 161 | def extract_serializable_attributes(options = {}) | CODE |
| 10 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | spec/dummy/config/initializers/doorkeeper.rb | 144 | # them to make sure you doesn't get NoMethodError exception. | COMMENT |
| MEDIUM | lib/doorkeeper/config.rb | 362 | # For example you can add an additional database column to `oauth_applications` table, | COMMENT |
| MEDIUM | lib/generators/doorkeeper/templates/initializer.rb | 531 | # For example you can add an additional database column to `oauth_applications` table, | COMMENT |
| LOW | lib/generators/doorkeeper/templates/initializer.rb | 56 | # Don't forget to include Doorkeeper ORM mixins into your custom models: | COMMENT |
| LOW | lib/generators/doorkeeper/templates/initializer.rb | 87 | # [NOTE] If you apply this option on already existing project don't forget to manually | COMMENT |
| LOW | lib/generators/doorkeeper/templates/initializer.rb | 87 | # [NOTE] If you apply this option on already existing project don't forget to manually | COMMENT |
| LOW | lib/generators/doorkeeper/templates/initializer.rb | 653 | # them to make sure you doesn't get NoMethodError exception. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | spec/dummy/config/initializers/wrap_parameters.rb | 5 | # This file contains settings for ActionController::ParamsWrapper which | COMMENT |
| MEDIUM | spec/dummy/db/schema.rb | 1 | # This file is auto-generated from the current state of the database. Instead | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 7 | [![GuardRails badge](https://api.guardrails.io/v2/badges/21183?token=66768ce8f6995814df81f65a2cff40f739f688492704f973e62 | CODE |
| MEDIUM | .agents/skills/antipattern-prevention/SKILL.md | 82 | # GOOD — explicit orchestration in request objects | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | app/controllers/doorkeeper/tokens_controller.rb | 101 | # Token belongs to specific client, so we need to check if | COMMENT |
| LOW | lib/doorkeeper/orm/active_record/mixins/application.rb | 83 | # if application belongs to some owner we need to check if it's the same as | COMMENT |