28.0

Adjusted Signal

28.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

38.5K

Stars

Language

2.1M

Lines of Code

13.7K

Files

11.6K

Pattern Hits

2026-10-31

Scan Date

0.40

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 15.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 6145 finding(s).

Hallucinated Dependency & Supply Chain Risk 70.9/100 · HIGH

Are imports declared and package/API names verified? 5407 finding(s).

Agent Over-Engineering Ratio 1.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 404 finding(s).

PR Review Velocity Impact 76.1/100 · CRITICAL

Which changes need focused human review? 11585 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 5309HIGH 134MEDIUM 61LOW 6081

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 11585 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators5309 hits · 51854 pts

Severity	File	Line	Snippet	Context
CRITICAL⚡	docs/Helix.md	72	D:\a\_work\1\s\.packages\microsoft.dotnet.helix.sdk\7.0.0-beta.21559.3\tools\Microsoft.DotNet.Helix.Sdk.MultiQueue.targe	CODE
CRITICAL⚡	docs/Helix.md	73	D:\a\_work\1\s\.packages\microsoft.dotnet.helix.sdk\7.0.0-beta.21559.3\tools\Microsoft.DotNet.Helix.Sdk.MultiQueue.targe	CODE
CRITICAL⚡	docs/Helix.md	74	##[error].packages\microsoft.dotnet.helix.sdk\7.0.0-beta.21559.3\tools\Microsoft.DotNet.Helix.Sdk.MultiQueue.targets(78,	COMMENT
CRITICAL	.github/workflows/pr-docs-check/test_prepare_context.py	47	"Microsoft.AspNetCore.Components.Web.Foo.Bar() -> void", "public_api"),	CODE
CRITICAL	…eware/Rewrite/src/PatternSegments/ServerNameSegment.cs	12	return context.HttpContext.Request.Host.Host.ToString(CultureInfo.InvariantCulture);	CODE
CRITICAL	src/Middleware/HealthChecks/src/PublicAPI.Shipped.txt	2	~Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckMiddleware.InvokeAsync(Microsoft.AspNetCore.Http.HttpContext h	CODE
CRITICAL⚡	src/Middleware/HealthChecks/src/PublicAPI.Shipped.txt	14	Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckMiddleware.HealthCheckMiddleware(Microsoft.AspNetCore.Http.Requ	CODE
CRITICAL⚡	src/Middleware/HealthChecks/src/PublicAPI.Shipped.txt	15	Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckMiddleware.InvokeAsync(Microsoft.AspNetCore.Http.HttpContext! h	CODE
CRITICAL⚡	src/Middleware/HealthChecks/src/PublicAPI.Shipped.txt	19	Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckOptions.HealthCheckOptions() -> void	CODE
CRITICAL	…dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs	66	req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.ToString("r"));	CODE
CRITICAL	…dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs	83	req.Headers.Add("If-Modified-Since", original.Content.Headers.LastModified.Value.AddHours(-1).ToString("r"));	CODE
CRITICAL	…dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs	100	req.Headers.Add("If-Modified-Since", original.Content.Headers.LastModified.Value.ToString("r"));	CODE
CRITICAL	…dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs	117	req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.ToString("r"));	CODE
CRITICAL	…dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs	172	req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.Subtract(TimeSpan.FromDays(1)).ToString(	CODE
CRITICAL	…dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs	191	req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.Subtract(TimeSpan.FromDays(1)).ToString(	CODE
CRITICAL	…dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs	219	req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.ToString("r"));	CODE
CRITICAL	…dleware/StaticFiles/test/UnitTests/RangeHeaderTests.cs	246	req.Headers.Add("If-Range", original.Content.Headers.LastModified.Value.ToString("r"));	CODE
CRITICAL	src/Middleware/StaticFiles/src/PublicAPI.Shipped.txt	66	Microsoft.AspNetCore.StaticFiles.Infrastructure.SharedOptions.SharedOptions() -> void	CODE
CRITICAL	src/Middleware/StaticFiles/src/PublicAPI.Shipped.txt	75	Microsoft.AspNetCore.StaticFiles.Infrastructure.SharedOptionsBase.SharedOptionsBase(Microsoft.AspNetCore.StaticFiles.Inf	CODE
CRITICAL⚡	…e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt	15	Microsoft.AspNetCore.SpaServices.AngularCli.AngularCliBuilder.AngularCliBuilder(string! npmScript) -> void	CODE
CRITICAL⚡	…e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt	16	Microsoft.AspNetCore.SpaServices.AngularCli.AngularCliBuilder.Build(Microsoft.AspNetCore.SpaServices.ISpaBuilder! spaBui	CODE
CRITICAL⚡	…e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt	22	Microsoft.AspNetCore.SpaServices.Prerendering.ISpaPrerendererBuilder.Build(Microsoft.AspNetCore.SpaServices.ISpaBuilder!	CODE
CRITICAL⚡	…e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt	43	Microsoft.AspNetCore.SpaServices.StaticFiles.SpaStaticFilesOptions.SpaStaticFilesOptions() -> void	CODE
CRITICAL⚡	…e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt	49	static Microsoft.AspNetCore.SpaServices.AngularCli.AngularCliMiddlewareExtensions.UseAngularCliServer(this Microsoft.Asp	CODE
CRITICAL⚡	…e/Spa/SpaServices.Extensions/src/PublicAPI.Shipped.txt	50	static Microsoft.AspNetCore.SpaServices.ReactDevelopmentServer.ReactDevelopmentServerMiddlewareExtensions.UseReactDevelo	CODE
CRITICAL	…eCompression/test/ResponseCompressionMiddlewareTest.cs	1325	request.Headers.AcceptEncoding.Add(System.Net.Http.Headers.StringWithQualityHeaderValue.Parse(requestAcceptE	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	5	~Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.CorsMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next,	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	6	~Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.CorsMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next,	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	7	~Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.CorsMiddleware(Microsoft.AspNetCore.Http.RequestDelegate next,	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	8	~Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(Microsoft.AspNetCore.Http.HttpContext context, Microsoft	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	9	~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.AddDefaultPolicy(Microsoft.AspNetCore.Cors.Infrastructure.CorsPoli	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	10	~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.AddDefaultPolicy(System.Action<Microsoft.AspNetCore.Cors.Infrastru	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	11	~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.AddPolicy(string name, Microsoft.AspNetCore.Cors.Infrastructure.Co	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	12	~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.AddPolicy(string name, System.Action<Microsoft.AspNetCore.Cors.Inf	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	13	~Microsoft.AspNetCore.Cors.Infrastructure.CorsOptions.GetPolicy(string name) -> Microsoft.AspNetCore.Cors.Infrastructure	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	16	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowAnyHeader() -> Microsoft.AspNetCore.Cors.Infrastructure	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	17	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowAnyMethod() -> Microsoft.AspNetCore.Cors.Infrastructure	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	18	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowAnyOrigin() -> Microsoft.AspNetCore.Cors.Infrastructure	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	19	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.AllowCredentials() -> Microsoft.AspNetCore.Cors.Infrastructu	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	20	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.Build() -> Microsoft.AspNetCore.Cors.Infrastructure.CorsPoli	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	21	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.CorsPolicyBuilder(Microsoft.AspNetCore.Cors.Infrastructure.C	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	22	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.CorsPolicyBuilder(params string[] origins) -> void	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	23	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.DisallowCredentials() -> Microsoft.AspNetCore.Cors.Infrastru	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	24	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.SetIsOriginAllowed(System.Func<string, bool> isOriginAllowed	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	25	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.SetIsOriginAllowedToAllowWildcardSubdomains() -> Microsoft.A	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	26	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.SetPreflightMaxAge(System.TimeSpan preflightMaxAge) -> Micro	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	27	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.WithExposedHeaders(params string[] exposedHeaders) -> Micros	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	28	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.WithHeaders(params string[] headers) -> Microsoft.AspNetCore	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	29	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.WithMethods(params string[] methods) -> Microsoft.AspNetCore	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	30	~Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicyBuilder.WithOrigins(params string[] origins) -> Microsoft.AspNetCore	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	34	~Microsoft.AspNetCore.Cors.Infrastructure.CorsService.EvaluatePolicy(Microsoft.AspNetCore.Http.HttpContext context, Micr	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	35	~Microsoft.AspNetCore.Cors.Infrastructure.CorsService.EvaluatePolicy(Microsoft.AspNetCore.Http.HttpContext context, stri	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	36	~Microsoft.AspNetCore.Cors.Infrastructure.DefaultCorsPolicyProvider.GetPolicyAsync(Microsoft.AspNetCore.Http.HttpContext	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	38	~Microsoft.AspNetCore.Cors.Infrastructure.ICorsPolicyProvider.GetPolicyAsync(Microsoft.AspNetCore.Http.HttpContext conte	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	39	~Microsoft.AspNetCore.Cors.Infrastructure.ICorsService.ApplyResult(Microsoft.AspNetCore.Cors.Infrastructure.CorsResult r	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	40	~Microsoft.AspNetCore.Cors.Infrastructure.ICorsService.EvaluatePolicy(Microsoft.AspNetCore.Http.HttpContext context, Mic	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	41	~override Microsoft.AspNetCore.Cors.Infrastructure.CorsPolicy.ToString() -> string	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	42	~override Microsoft.AspNetCore.Cors.Infrastructure.CorsResult.ToString() -> string	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	61	~virtual Microsoft.AspNetCore.Cors.Infrastructure.CorsService.ApplyResult(Microsoft.AspNetCore.Cors.Infrastructure.CorsR	CODE
CRITICAL⚡	src/Middleware/CORS/src/PublicAPI.Shipped.txt	62	~virtual Microsoft.AspNetCore.Cors.Infrastructure.CorsService.EvaluatePreflightRequest(Microsoft.AspNetCore.Http.HttpCon	CODE
5249 more matches not shown…

Over-Commented Block5392 hits · 5198 pts

Severity	File	Line	Snippet	Context
LOW	.CodeQL.yml	1	# This file configures CodeQL runs and TSA bug autofiling. For more information, see:	COMMENT
LOW	eng/common/SetupNugetSources.sh	1	#!/usr/bin/env bash	COMMENT
LOW	eng/common/vmr-sync.sh	1	#!/bin/bash	COMMENT
LOW	eng/common/vmr-sync.sh	21	###	COMMENT
LOW	eng/common/native/init-distro-rid.sh	1	#!/bin/sh	COMMENT
LOW	eng/common/native/init-distro-rid.sh	61		COMMENT
LOW	…common/templates-official/variables/pool-providers.yml	1	# Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc pool	COMMENT
LOW	eng/common/templates/vmr-build-pr.yml	1	# This pipeline is used for running the VMR verification of the PR changes in repo-level PRs.	COMMENT
LOW	eng/common/templates/variables/pool-providers.yml	1	# Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc pool	COMMENT
LOW	eng/common/core-templates/stages/renovate.yml	1	# --------------------------------------------------------------------------------------	COMMENT
LOW	…g/common/core-templates/steps/get-github-app-token.yml	1	# Mints a short-lived GitHub App installation access token by signing a JWT	COMMENT
LOW	eng/common/core-templates/steps/install-microbuild.yml	1	parameters:	COMMENT
LOW	eng/common/core-templates/job/renovate.yml	1	# --------------------------------------------------------------------------------------	COMMENT
LOW	eng/common/core-templates/job/source-build.yml	1	parameters:	COMMENT
LOW	eng/common/core-templates/job/source-build.yml	21	# published by source-build.	COMMENT
LOW	eng/skill-evals/skills-vs-baseline.experiment.yaml	1	name: skills-vs-baseline	COMMENT
LOW	eng/skill-evals/pr-attention-queue/eval.vally.yaml	21	#	COMMENT
LOW	eng/scripts/CaptureHangDumps.sh	1	#!/usr/bin/env bash	COMMENT
LOW	.devcontainer/scripts/container-creation.sh	1	#!/usr/bin/env bash	COMMENT
LOW	.github/workflows/community-pr-issue-check.lock.yml	1	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"c38e90a99692cef031797374b3b27b835b852f211360f3c7d0e57950472	COMMENT
LOW	.github/workflows/community-pr-issue-check.lock.yml	21	# gh aw compile	COMMENT
LOW	.github/workflows/community-pr-issue-check.lock.yml	41	# - COPILOT_PAT_8	COMMENT
LOW	…kflows/agentics-maintenance-dotnet-AspNetCore.Docs.yml	1	# This file was automatically generated by pkg/workflow/side_repo_maintenance.go (v0.92.0). DO NOT EDIT. To debug this w	COMMENT
LOW	…kflows/agentics-maintenance-dotnet-AspNetCore.Docs.yml	21	#	COMMENT
LOW	.github/workflows/pull-request-review.lock.yml	1	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"658b96669160b402c68ea796103537bcbf56065bb3d182a1ef1772ba322	COMMENT
LOW	.github/workflows/pull-request-review.lock.yml	21	# gh aw compile	COMMENT
LOW	.github/workflows/pull-request-review.lock.yml	41	# - COPILOT_PAT_2	COMMENT
LOW	.github/workflows/pull-request-review.lock.yml	61	#	COMMENT
LOW	.github/workflows/browsertesting-deps-update.lock.yml	1	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"7b346b548935fbace10395a7417a05bbb92620af114a2f267b63ecbe5e0	COMMENT
LOW	.github/workflows/browsertesting-deps-update.lock.yml	21	# gh aw compile	COMMENT
LOW	.github/workflows/browsertesting-deps-update.lock.yml	41	# - COPILOT_PAT_8	COMMENT
LOW	.github/workflows/browsertesting-deps-update.lock.yml	1001	# --allow-tool shell(cat)	COMMENT
LOW	.github/workflows/cswin32-update.lock.yml	1	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"932d3374c1a272f1ab6ee62781879cb1ae6730c7ff0e26c89384ebb5c14	COMMENT
LOW	.github/workflows/cswin32-update.lock.yml	21	# gh aw compile	COMMENT
LOW	.github/workflows/cswin32-update.lock.yml	41	# - COPILOT_PAT_8	COMMENT
LOW	.github/workflows/cswin32-update.lock.yml	1001	# --allow-tool shell(bash)	COMMENT
LOW	.github/workflows/cswin32-update.lock.yml	1021	# --allow-tool shell(ls)	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	1	# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"3540216fc5f4b8c31f2e13d437026a70122e1e34f5e533a1638041c2e8d	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	21	# gh aw compile	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	41	# - COPILOT_PAT_8	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	61	# - ghcr.io/github/gh-aw-firewall/squid:0.28.57@sha256:be808c16b535ebabd070eebe086fe6bffd5bb86b2e5fe8e5cdad30068eb9c0a	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	81	# import json, os, urllib.request	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	101	#	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	121	# seen = set()	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	141	# "filename": f["filename"],	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	161	# # into the agent prompt. /tmp/ is NOT shared between pre_activation and agent jobs.	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	181	# name: Fetch re-quarantine issue numbers	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	201	# data = json.loads(resp.read())	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	221	# print("ERROR: GITHUB_OUTPUT is not set, cannot pass data to agent", file=sys.stderr)	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	241	# # We deliberately do NOT read PR/issue comment bodies as a trust signal: comments are	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	261	# # proof of a privileged decision — no author-identity check is needed on top of	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	281	# data = json.loads(resp.read())	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	301	# d = json.loads(resp.read())	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	321	# link = resp.headers.get("Link", "")	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	341	# labeled_prs_unquarantine = search_prs(	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	361	# else {"closed_at": None, "closed_by": None})	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	381	# get_label_added_at(number, NO_UNQUARANTINE_LABEL)	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	401	# # ISO-8601 timestamp of the most recent time `no-quarantine-for-30-days` was	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	421	# if len(js) > MAX_OUTPUT_BYTES:	COMMENT
LOW	.github/workflows/test-quarantine.lock.yml	441	# run: \|	COMMENT
5332 more matches not shown…

Synthetic Comment Markers130 hits · 971 pts

Severity	File	Line	Snippet	Context
HIGH	…vc/Mvc.Analyzers/src/TagHelpersInCodeBlocksAnalyzer.cs	25	// Generated Razor code is considered auto generated. By default analyzers skip over auto-generated code unless	COMMENT
HIGH	…erences#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…ingName#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…estBody#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…rollers#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…malApis#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…rollers#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…alTexts#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…rollers#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…rollers#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…OpenApi#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…Schemas#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…rollers#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…Formats#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…tionIds#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…Schemas#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…estBody#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	…estBody#OpenApiXmlCommentSupport.generated.verified.cs	4	// This code was generated by a tool.	COMMENT
HIGH	src/OpenApi/gen/XmlCommentGenerator.Emitter.cs	22	// This code was generated by a tool.	COMMENT
HIGH	…E2ETest/ServerRenderingTests/EnhancedNavigationTest.cs	777	// Staleness check is used to assert enhanced navigation is enabled/disabled, as requested	COMMENT
HIGH	…E2ETest/ServerRenderingTests/EnhancedNavigationTest.cs	857	// staleness check is used to assert enhanced navigation is enabled/disabled, as requested	COMMENT
HIGH	src/Http/Routing/tools/Swaggatherer/Template.cs	77	// This code was generated by the Swaggatherer	COMMENT
HIGH	…marks/Matching/MatcherGithubBenchmarkBase.generated.cs	9	// This code was generated by the Swaggatherer	COMMENT
HIGH	…kGeneration/LinkGenerationGithubBenchmark.generated.cs	10	// This code was generated by the Swaggatherer	COMMENT
HIGH	…_TakesCustomMetadataEmitter_Has_Metadata.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…ptyQueryStringValueProvided_StringReturn.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…urnsValidationProblemResult_Has_Metadata.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…icitQuery_NullableIntArrayParam_Optional.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…tion_ExplicitQuery_ComplexTypeArrayParam.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…thArrayQueryString_AndBody_ShouldUseBody.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…r/Baselines/MapAction_BindAsync_Snapshot.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…apAction_NoParam_StringReturn_WithFilter.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…ullableStringArrayParam_EmptyQueryValues.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…pAction_MultipleStringParam_StringReturn.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…ltiple_MapAction_WithParams_StringReturn.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…icitQuery_NullableIntArrayParam_Optional.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…es/MapAction_ReturnsVoid_Has_No_Metadata.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…n_ExplicitQuery_NullableStringArrayParam.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…pportsSameInterceptorsFromDifferentFiles.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…ion_ExplicitSource_SimpleReturn_Snapshot.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…QueryString_AndBody_ShouldUseQueryString.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…nBodyOrService_HandlesBothJsonAndService.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…MapAction_ImplicitQuery_StringArrayParam.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…/Multiple_MapAction_NoParam_StringReturn.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…tringArrayParam_Optional_QueryNotPresent.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…ion_ExplicitHeader_ComplexTypeArrayParam.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…_ExplicitHeader_NullableStringArrayParam.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…tor/Baselines/VerifyAsParametersBaseline.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…_ImplicitQuery_StringArrayParam_Optional.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…rtsDifferentInterceptorsFromSameLocation.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…y_IntArrayParam_Optional_QueryNotPresent.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…s/MapAction_SingleEnumParam_StringReturn.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…leIntArrayParam_Optional_QueryNotPresent.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…lines/MapAction_ReturnsTodo_Has_Metadata.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…/MapPost_WithArrayQueryString_ShouldFail.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…y_IntArrayParam_Optional_QueryNotPresent.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…thArrayQueryString_AndBody_ShouldUseBody.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…on_MultipleSpecialTypeParam_StringReturn.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…ion_ImplicitQuery_IntArrayParam_Optional.generated.txt	3	// This code was generated by a tool.	COMMENT
HIGH	…ion_ExplicitQuery_IntArrayParam_Optional.generated.txt	3	// This code was generated by a tool.	COMMENT
70 more matches not shown…

Hyper-Verbose Identifiers371 hits · 351 pts

Severity	File	Line	Snippet	Context
LOW	eng/common/cross/install-debs.py	51	async def download_deb_files_parallel(mirror, packages, tmp_dir):	CODE
LOW	eng/common/cross/install-debs.py	67	async def download_package_index_parallel(mirror, arch, suites, check_sig, keyring):	CODE
LOW	eng/common/cross/install-debs.py	339	def _rootfs_extraction_filter(member, dest_path):	CODE
LOW	.github/workflows/test-quarantine.lock.yml	5157	return async function handleCreateQuarantineIssue(item, resolvedTemporaryIds, temporaryIdMap) {	CODE
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	75	def source_two_quarantined_methods():	STRING
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	93	def source_two_unquarantined_methods():	STRING
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	344	def test_pull_request_repository():	STRING
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	368	def test_theory_target_binding(data="HttpProtocols.Http3", displayed="Http3", supported=True, provider=""):	STRING
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	476	def test_row_comment_ownership():	STRING
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	499	def test_shared_attribute_validation(operation):	STRING
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	598	def test_linked_source_freshness(change):	STRING
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	672	def test_unproven_shared_consumers(case):	STRING
LOW	…kflows/scripts/test-quarantine/test_workflow_policy.py	18	def test_part_two_analysis_is_mandatory(self):	CODE
LOW	…kflows/scripts/test-quarantine/test_workflow_policy.py	25	def test_incomplete_analysis_cannot_report_noop(self):	CODE
LOW⚡	…kflows/scripts/test-quarantine/test_workflow_policy.py	37	def test_incomplete_analysis_requires_report_incomplete(self):	CODE
LOW⚡	…kflows/scripts/test-quarantine/test_workflow_policy.py	47	def test_priority_defers_writes_not_analysis(self):	CODE
LOW⚡	…kflows/scripts/test-quarantine/test_workflow_policy.py	53	def test_unquarantine_analysis_is_not_unconditionally_deferred(self):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	292	def has_conditional_namespace(text):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	360	def project_quarantine_history(root, project_root, history_ref):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	509	def operating_system_from_queue(value):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1257	def historical_assembly_state(root, project_root, commit, state_cache):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1362	def assembly_quarantine_history(root, project_root, history_ref):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1406	def historical_project_source_index(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1651	def assembly_quarantine_transition(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1707	def type_quarantine_transition(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1958	def target_identity_rename_detected(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2141	def namespace_rename_detected(root, relative_path, type_name, history_ref):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2235	def method_quarantine_transitions(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2325	def data_quarantine_transitions(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2417	def target_quarantine_transitions(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2662	def type_quarantine_transitions(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2725	def classify_current_quarantine_history(events):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2753	def unproven_quarantine_paths(source_index):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2780	def current_quarantine_targets(source_index):	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2876	def collect_requarantine_history(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	3218	def project_history_is_complete(	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	3502	def quarantine_operating_systems(record_a, record_b, record_c, builds):	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	782	def test_inline_literal_resolution(raw="true", rendered="True"):	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	796	def test_unmatched_inline_row_fails_closed(cases=None):	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	833	def test_non_data_condition_rows(condition="[MsQuicSupported]"):	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	861	def test_kestrel_condition_rows():	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	880	def test_commented_row_attributes():	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	933	def test_build_source_ancestry():	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	1092	def test_history_cutoff_uses_first_parent_order():	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	1139	def test_requarantine_history():	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	260	def assert_already_quarantined(result):	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	266	def test_row_targets_require_conditional_theory():	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	337	def test_workflow_platform_evidence():	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	448	def test_source_c_platform_evidence():	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	506	def test_production_queue_evidence(	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	585	def test_theory_data_quarantine_support():	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	1827	def test_declaration_rewrites_are_not_renames(module=None):	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	1886	def test_mixed_rename_and_rewrite_is_ambiguous(module=None):	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	1935	def test_unrelated_type_edit_is_not_a_rename(module=None):	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	1984	def test_type_and_method_rename_is_ambiguous(module=None):	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	2025	def test_replaced_overload_rename_is_ambiguous(module=None):	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	2070	def test_assembly_history_ignores_child_removal_after_own_quarantine():	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	2099	def test_assembly_history_ignores_child_churn_during_own_quarantine():	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	2125	def test_method_history_ignores_assembly_churn_during_own_quarantine():	STRING
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	2151	def test_method_history_ignores_type_churn_during_own_quarantine():	STRING
311 more matches not shown…

Structural Annotation Overuse74 hits · 131 pts

Severity	File	Line	Snippet	Context
LOW	.github/workflows/cswin32-update.md	102	### Step 1: Check for a newer CsWin32 version	COMMENT
LOW	.github/workflows/cswin32-update.md	119	### Step 2: Restore and build	COMMENT
LOW	.github/workflows/cswin32-update.md	159	### Step 3: Research what changed in CsWin32	COMMENT
LOW	.github/workflows/cswin32-update.md	185	### Step 4: Find and fix CsWin32 workarounds	COMMENT
LOW	.github/workflows/issue-triage-agent.md	305	## Step 1: Area Classification	COMMENT
LOW	.github/workflows/issue-triage-agent.md	495	## Step 2: Type Classification	COMMENT
LOW	.github/workflows/issue-triage-agent.md	529	## Step 3: Additional Labels	COMMENT
LOW	.github/workflows/issue-triage-agent.md	545	## Step 4: Regression Detection	COMMENT
LOW	.github/workflows/issue-triage-agent.md	576	## Step 5: Duplicate Detection	COMMENT
LOW	.github/workflows/issue-triage-agent.md	597	## Step 6: Draft the Triage Comment	COMMENT
LOW	.github/workflows/issue-triage-agent.md	740	## Step 7: Apply Labels, Type, and Post the Comment	COMMENT
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	71	// Step 1: Safe methods are always allowed regardless of headers.	COMMENT
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	88	// Step 2: Trusted origins (from the applicable CORS policy) allow cross-origin requests	COMMENT
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	266	// Step 3: Sec-Fetch-Site header validation.	COMMENT
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	287	// Step 4: No Sec-Fetch-Site header → fall back to Origin vs Host comparison.	COMMENT
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	352	// Step 5: No Sec-Fetch-Site AND no Origin → non-browser → allowed.	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	19	// Step 1: Safe methods are always allowed.	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	25	// Step 2: Sec-Fetch-Site accept path. The vast majority of legitimate browser	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	34	// Step 3: Check trusted origins from the CORS policy that applies to this request	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	59	// Step 4: Sec-Fetch-Site deny path. Any value other than "same-origin"/"none"	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	66	// Step 5: No Sec-Fetch-Site header. Fall back to Origin vs Host comparison.	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	74	// Step 6: No Sec-Fetch-Site AND no Origin header.	COMMENT
LOW	…ncyInjection/MvcNewtonsoftJsonOptionsExtensionsTest.cs	240	// NOTE: This method was created to make sure to create a different instance of contract resolver as by default	COMMENT
LOW	…src/Infrastructure/DefaultPageHandlerMethodSelector.cs	87	// Step 1: match on HTTP method.	COMMENT
LOW	…src/Infrastructure/DefaultPageHandlerMethodSelector.cs	117	// Step 2: remove candidates with non-matching handlers.	COMMENT
LOW⚡	…c/Mvc.Core/src/Routing/ActionEndpointDataSourceBase.cs	127	// Step 1 - capture old token	COMMENT
LOW⚡	…c/Mvc.Core/src/Routing/ActionEndpointDataSourceBase.cs	130	// Step 2 - update endpoints	COMMENT
LOW⚡	…c/Mvc.Core/src/Routing/ActionEndpointDataSourceBase.cs	133	// Step 3 - create new change token	COMMENT
LOW⚡	…c/Mvc.Core/src/Routing/ActionEndpointDataSourceBase.cs	137	// Step 4 - trigger old token	COMMENT
LOW	…structure/DefaultActionDescriptorCollectionProvider.cs	167	// Step 4 - might be null if it's the first time.	COMMENT
LOW⚡	src/Components/AI/gen/ToolBlockGenerator.cs	14	// Step 1: Parse classes with [ToolBlock] into an equatable parse result	COMMENT
LOW⚡	src/Components/AI/gen/ToolBlockGenerator.cs	22	// Step 2: Report per-declaration diagnostics and emit a handler for each valid candidate.	COMMENT
LOW	src/Components/AI/gen/ToolBlockGenerator.cs	39	// Step 3: Collect all valid candidates and emit the aggregate registration.	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	29	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	33	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	37	// Step 3: validate that there's now a single key in the directory and that it's not protected	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	95	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	99	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	106	// Step 3: validate that there's now a single key in the directory and that it's protected with DPAPI	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	139	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	143	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	152	// Step 3: validate that there's now a single key in the directory and that it's is protected using	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	224	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	228	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	233	// Step 3: validate that there's now a single key in the directory and that it's is protected using the cert	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	253	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	257	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	262	// Step 3: validate that there's no key in the directory	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	293	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	297	// Step 2: instantiate the system and create some data	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	304	// Step 3: validate that there's now a single key in the directory and that it's is protected using the cert	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	312	// Step 4: setup a second system and validate it can decrypt keys and unprotect data	COMMENT
LOW	…tection/Extensions/test/DataProtectionProviderTests.cs	54	// Step 1: Instantiate the system and round-trip a payload	COMMENT
LOW	…tection/Extensions/test/DataProtectionProviderTests.cs	72	// Step 2: Validate that there's now a single key in the directory	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	342	// Step 1: Generate a random key modifier and IV for this operation.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	348	// Step 2: Decrypt the KDK, and use it to generate new encryption and HMAC keys.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	360	// Step 2: Copy the key modifier and the IV to the output stream since they'll act as a header.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	363	// Step 3: Generate IV for this operation right into the result array	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	367	// Step 4: Perform the encryption operation.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	377	// Step 5: Calculate the digest over the IV and ciphertext.	COMMENT
14 more matches not shown…

Verbosity Indicators66 hits · 116 pts

Severity	File	Line	Snippet	Context
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	71	// Step 1: Safe methods are always allowed regardless of headers.	COMMENT
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	88	// Step 2: Trusted origins (from the applicable CORS policy) allow cross-origin requests	COMMENT
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	266	// Step 3: Sec-Fetch-Site header validation.	COMMENT
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	287	// Step 4: No Sec-Fetch-Site header → fall back to Origin vs Host comparison.	COMMENT
LOW	…crosoft.AspNetCore.Tests/DefaultCsrfProtectionTests.cs	352	// Step 5: No Sec-Fetch-Site AND no Origin → non-browser → allowed.	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	19	// Step 1: Safe methods are always allowed.	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	25	// Step 2: Sec-Fetch-Site accept path. The vast majority of legitimate browser	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	34	// Step 3: Check trusted origins from the CORS policy that applies to this request	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	59	// Step 4: Sec-Fetch-Site deny path. Any value other than "same-origin"/"none"	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	66	// Step 5: No Sec-Fetch-Site header. Fall back to Origin vs Host comparison.	COMMENT
LOW⚡	…c/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs	74	// Step 6: No Sec-Fetch-Site AND no Origin header.	COMMENT
LOW	…src/Infrastructure/DefaultPageHandlerMethodSelector.cs	87	// Step 1: match on HTTP method.	COMMENT
LOW	…src/Infrastructure/DefaultPageHandlerMethodSelector.cs	117	// Step 2: remove candidates with non-matching handlers.	COMMENT
LOW	src/Mvc/Mvc.Core/src/Formatters/FormatFilter.cs	97	// We need to check if the action can generate the content type the user asked for. That is, treat the	COMMENT
LOW	…clients/ts/FunctionalTests/scripts/karma.local.conf.js	21	// On linux, the browsers just return the command, not a path, so we need to check if it exists.	COMMENT
LOW	…c/SignalR/clients/ts/signalr/src/WebSocketTransport.ts	97	// ErrorEvent is a browser only type we need to check if the type exists before using it	COMMENT
LOW	…c/SignalR/clients/ts/signalr/src/WebSocketTransport.ts	126	// ErrorEvent is a browser only type we need to check if the type exists before using it	COMMENT
LOW	src/SignalR/server/Core/src/HubConnectionContext.cs	690	// If there's a transfer format feature, we need to check if we're compatible and set th	COMMENT
LOW	…mponents/Web.JS/src/Rendering/Events/EventDelegator.ts	171	// when connection closed, it will detachWebRendererInterop, so we need to check if the renderer is still attached	COMMENT
LOW⚡	src/Components/AI/gen/ToolBlockGenerator.cs	14	// Step 1: Parse classes with [ToolBlock] into an equatable parse result	COMMENT
LOW⚡	src/Components/AI/gen/ToolBlockGenerator.cs	22	// Step 2: Report per-declaration diagnostics and emit a handler for each valid candidate.	COMMENT
LOW	src/Components/AI/gen/ToolBlockGenerator.cs	39	// Step 3: Collect all valid candidates and emit the aggregate registration.	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	29	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	33	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	37	// Step 3: validate that there's now a single key in the directory and that it's not protected	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	95	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	99	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	106	// Step 3: validate that there's now a single key in the directory and that it's protected with DPAPI	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	139	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	143	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	152	// Step 3: validate that there's now a single key in the directory and that it's is protected using	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	224	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	228	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	233	// Step 3: validate that there's now a single key in the directory and that it's is protected using the cert	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	253	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	257	// Step 2: instantiate the system and round-trip a payload	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	262	// Step 3: validate that there's no key in the directory	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	293	// Step 1: directory should be completely empty	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	297	// Step 2: instantiate the system and create some data	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	304	// Step 3: validate that there's now a single key in the directory and that it's is protected using the cert	COMMENT
LOW⚡	…tection/Extensions/test/DataProtectionProviderTests.cs	312	// Step 4: setup a second system and validate it can decrypt keys and unprotect data	COMMENT
LOW	…tection/Extensions/test/DataProtectionProviderTests.cs	54	// Step 1: Instantiate the system and round-trip a payload	COMMENT
LOW	…tection/Extensions/test/DataProtectionProviderTests.cs	72	// Step 2: Validate that there's now a single key in the directory	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	342	// Step 1: Generate a random key modifier and IV for this operation.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	348	// Step 2: Decrypt the KDK, and use it to generate new encryption and HMAC keys.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	360	// Step 2: Copy the key modifier and the IV to the output stream since they'll act as a header.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	363	// Step 3: Generate IV for this operation right into the result array	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	367	// Step 4: Perform the encryption operation.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	377	// Step 5: Calculate the digest over the IV and ciphertext.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	556	// Step 3: Calculate the correct MAC for this payload.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	564	// Step 4: Validate the MAC provided as part of the payload.	COMMENT
LOW⚡	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	567	// Step 5: Decipher the ciphertext and return it to the caller.	COMMENT
LOW	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	459	// Step 4: Validate the MAC provided as part of the payload.	COMMENT
LOW	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	514	// Step 1: Extract the key modifier and IV from the payload.	COMMENT
LOW	…rotection/src/Managed/ManagedAuthenticatedEncryptor.cs	530	// Step 2: Decrypt the KDK and use it to restore the original encryption and MAC keys.	COMMENT
LOW	…ion/src/KeyManagement/KeyRingBasedSpanDataProtector.cs	48	// Step 1: Write the magic header and key id	COMMENT
LOW	…ion/src/KeyManagement/KeyRingBasedSpanDataProtector.cs	63	// Step 2: Perform encryption into the destination writer	COMMENT
LOW⚡	…/src/SP800_108/Win7SP800_108_CTR_HMACSHA512Provider.cs	37	// Step 1: Calculate all necessary offsets into the temp input & output buffer.	COMMENT
LOW⚡	…/src/SP800_108/Win7SP800_108_CTR_HMACSHA512Provider.cs	43	// Step 2: Copy Label and Context into the temp input buffer.	COMMENT
LOW⚡	…/src/SP800_108/Win7SP800_108_CTR_HMACSHA512Provider.cs	47	// Step 3: copy [L] into last part of data to be hashed, big-endian	COMMENT
6 more matches not shown…

Fake / Example Data95 hits · 102 pts

Severity	File	Line	Snippet	Context
LOW⚡	.config/CredScanSuppressions.json	5	"placeholder": "aspnetcore",	CODE
LOW⚡	.config/CredScanSuppressions.json	9	"placeholder": "password",	CODE
LOW⚡	.config/CredScanSuppressions.json	13	"placeholder": "my password",	CODE
LOW⚡	.config/CredScanSuppressions.json	17	"placeholder": "newpassword",	CODE
LOW⚡	.config/CredScanSuppressions.json	21	"placeholder": "testpassword",	CODE
LOW⚡	.config/CredScanSuppressions.json	25	"placeholder": "AAABAgMEBQYHCAkKCwwNDg+ukCEMDf0yyQ29NYubggE=",	CODE
LOW⚡	.config/CredScanSuppressions.json	29	"placeholder": "1qaz!QAZ",	CODE
LOW⚡	.config/CredScanSuppressions.json	33	"placeholder": "1qaz@WSX",	CODE
LOW	…iddleware/ResponseCaching/test/ResponseCachingTests.cs	280	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	…iddleware/ResponseCaching/test/ResponseCachingTests.cs	303	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	…iddleware/ResponseCaching/test/ResponseCachingTests.cs	875	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	…iddleware/ResponseCaching/test/ResponseCachingTests.cs	879	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	…iddleware/ResponseCaching/test/ResponseCachingTests.cs	901	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	…iddleware/ResponseCaching/test/ResponseCachingTests.cs	911	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	…iddleware/ResponseCaching/test/ResponseCachingTests.cs	936	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	…iddleware/ResponseCaching/test/ResponseCachingTests.cs	946	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	src/Middleware/OutputCaching/test/OutputCacheTests.cs	321	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	src/Middleware/OutputCaching/test/OutputCacheTests.cs	345	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	src/Middleware/OutputCaching/test/OutputCacheTests.cs	879	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	src/Middleware/OutputCaching/test/OutputCacheTests.cs	883	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	src/Middleware/OutputCaching/test/OutputCacheTests.cs	903	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW	src/Middleware/OutputCaching/test/OutputCacheTests.cs	913	client.DefaultRequestHeaders.From = "user@example.com";	CODE
LOW⚡	src/Middleware/ResponseCompression/sample/LoremIpsum.cs	8	internal const string Text = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed non risus. Suspendisse le	CODE
LOW⚡	src/Middleware/ResponseCompression/sample/LoremIpsum.cs	8	internal const string Text = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed non risus. Suspendisse le	CODE
LOW⚡	src/Middleware/ResponseCompression/sample/LoremIpsum.cs	9	"Ut velit mauris, egestas sed, gravida nec, ornare ut, mi. Aenean ut orci vel massa suscipit pulvinar.Nulla soll	CODE
LOW⚡	src/Middleware/ResponseCompression/sample/LoremIpsum.cs	9	"Ut velit mauris, egestas sed, gravida nec, ornare ut, mi. Aenean ut orci vel massa suscipit pulvinar.Nulla soll	CODE
LOW	…y/test/Identity.Test/UserClaimsPrincipalFactoryTest.cs	45	var user = new PocoUser { UserName = "Foo", Email = "foo@bar.com" };	CODE
LOW	…dentity.Test/Passkeys/PasskeyHandlerAttestationTest.cs	1104	public string? UserDisplayName { get; set; } = "John Doe";	STRING
LOW	…y/test/Identity.FunctionalTests/MapIdentityApiTests.cs	1141	var registeredEmail = "user@example.com";	CODE
LOW	…y/test/Identity.FunctionalTests/MapIdentityApiTests.cs	1654	var registeredEmail = "user@example.com";	CODE
LOW	…kCore/test/EF.Test/UserStoreEncryptPersonalDataTest.cs	207	user.Email = "test@test.com";	CODE
LOW	…ecification.Tests/src/UserManagerSpecificationTests.cs	1821	IdentityResultAssert.IsSuccess(await manager.SetEmailAsync(user, "test@test.com"));	CODE
LOW	…rsWebSite/TagHelpers/TagCloudViewComponentTagHelper.cs	19	("Lorem ipsum dolor sit amet consectetur adipisicing elit sed do eiusmod tempor incididunt ut labore et dolore m	CODE
LOW	…rsWebSite/TagHelpers/TagCloudViewComponentTagHelper.cs	19	("Lorem ipsum dolor sit amet consectetur adipisicing elit sed do eiusmod tempor incididunt ut labore et dolore m	CODE
LOW	…es/RazorWebSite/Controllers/UrlResolutionController.cs	14	Name = "John Doe"	CODE
LOW	….ViewFeatures/test/Rendering/HtmlHelperTextAreaTest.cs	162	[Display(Prompt = "placeholder")]	CODE
LOW	….ViewFeatures/test/Rendering/HtmlHelperPasswordTest.cs	537	[Display(Prompt = "placeholder")]	CODE
LOW	…c.ViewFeatures/test/Rendering/HtmlHelperTextBoxTest.cs	180	[Display(Prompt = "placeholder")]	CODE
LOW	src/Mvc/Mvc.ViewFeatures/src/DefaultHtmlGenerator.cs	1316	tagBuilder.MergeAttribute("placeholder", placeholder);	CODE
LOW	…c.JsonTranscoding.Tests/X509CertificateHelpersTests.cs	30	(1, "user@example.com"),	CODE
LOW	src/Security/Authentication/test/CertificateTests.cs	571	const string Expected = "John Doe";	CODE
LOW	src/Security/Authentication/test/CertificateTests.cs	646	const string Expected = "John Doe";	CODE
LOW	src/Security/Authentication/test/CertificateTests.cs	696	const string Expected = "John Doe";	CODE
LOW	…ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs	18	var model = new ObjectWithJObject { CustomData = (JsonObject)JsonSerializer.SerializeToNode(new { Emails = new[]	CODE
LOW	…ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs	34	var model = new ObjectWithJObject { CustomData = (JsonObject)JsonSerializer.SerializeToNode(new { Email = "foo@b	CODE
LOW	…ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs	48	var model = new ObjectWithJObject { CustomData = new JsonObject([new("Email", "foo@bar.com"), new("Name", "Bar")	CODE
LOW	…ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs	51	patch.Operations.Add(new Operation<ObjectWithJObject>("test", "/CustomData/Email", null, "foo@bar.com"));	CODE
LOW	…ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs	65	var model = new ObjectWithJObject { CustomData = new JsonObject([new("Email", "foo@bar.com")]) };	CODE
LOW	…ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs	74	Assert.Equal("foo@bar.com", model.CustomData["UserName"].GetValue<string>());	CODE
LOW	…ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs	147	var model = new ObjectWithJObject { CustomData = new JsonObject([new("Email", "foo@bar.com"), new("Name", "Bar")	CODE
LOW	…ch.SystemTextJson/test/JsonPatchDocumentJObjectTest.cs	163	var model = new ObjectWithJObject { CustomData = new JsonObject([new("Email", "foo@bar.com"), new("Name", "Bar")	CODE
LOW	…eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs	20	var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Emails = new[] { "foo@bar.com" } }) };	CODE
LOW	…eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs	36	var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com", Name = "Bar" })	CODE
LOW	…eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs	50	var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com", Name = "Bar" })	CODE
LOW	…eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs	53	patch.Operations.Add(new Operation<ObjectWithJObject>("test", "/CustomData/Email", null, "foo@bar.com"));	CODE
LOW	…eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs	67	var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com" }) };	CODE
LOW	…eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs	76	Assert.Equal("foo@bar.com", model.CustomData["UserName"].Value<string>());	CODE
LOW	…eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs	148	var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com", Name = "Bar" })	CODE
LOW	…eatures/JsonPatch/test/JsonPatchDocumentJObjectTest.cs	164	var model = new ObjectWithJObject { CustomData = JObject.FromObject(new { Email = "foo@bar.com", Name = "Bar" })	CODE
LOW	…i.SourceGenerators.Tests/OperationTests.MinimalApis.cs	327	/// <example>"user@example.com"</example>	COMMENT
35 more matches not shown…

Decorative Section Separators19 hits · 66 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	eng/common/core-templates/stages/renovate.yml	1	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/stages/renovate.yml	3	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/stages/renovate.yml	9	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/job/renovate.yml	1	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/job/renovate.yml	3	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/job/renovate.yml	17	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/validate-pat-pool.yml	33	# -----------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/validate-pat-pool.yml	37	# -----------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/validate-pat-pool.yml	139	# -----------------------------------------------------------	COMMENT
MEDIUM	.github/workflows/validate-pat-pool.yml	141	# -----------------------------------------------------------	COMMENT
MEDIUM	…omponents/Testing/test/GenerateE2EManifestTaskTests.cs	31	// ── build mode + Build scenario (local dev) ──────────────────────	COMMENT
MEDIUM	…omponents/Testing/test/GenerateE2EManifestTaskTests.cs	56	// ── build mode + Publish scenario ────────────────────────────────	COMMENT
MEDIUM	…omponents/Testing/test/GenerateE2EManifestTaskTests.cs	94	// ── publish mode + Publish scenario (exe found) ──────────────────	COMMENT
MEDIUM	…omponents/Testing/test/GenerateE2EManifestTaskTests.cs	122	// ── publish mode + Publish scenario (dll only) ───────────────────	COMMENT
MEDIUM	…omponents/Testing/test/GenerateE2EManifestTaskTests.cs	163	// ── all mode + Publish scenario ──────────────────────────────────	COMMENT
MEDIUM	…omponents/Testing/test/GenerateE2EManifestTaskTests.cs	201	// ── Custom E2EAppsRelativeDir ────────────────────────────────────	COMMENT
MEDIUM	…omponents/Testing/test/GenerateE2EManifestTaskTests.cs	223	// ── Multiple apps ────────────────────────────────────────────────	COMMENT
MEDIUM	…omponents/Testing/test/GenerateE2EManifestTaskTests.cs	245	// ── PublicUrl metadata flows through ─────────────────────────────	COMMENT
MEDIUM	…omponents/Testing/test/GenerateE2EManifestTaskTests.cs	386	// ── Helpers ──────────────────────────────────────────────────────	COMMENT

Modern AI Meta-Vocabulary22 hits · 60 pts

Severity	File	Line	Snippet	Context
MEDIUM	docs/CrossCuttingGuidance.md	71	### Options, configuration, and dependency injection	COMMENT
MEDIUM	.github/dependabot.yml	416	# Actions pinned in the generated agentic .lock.yml files, managed by gh aw	COMMENT
MEDIUM	.github/workflows/pr-docs-check.md	58	# Run agentic jobs in an isolated `copilot-pat-pool` environment.	COMMENT
MEDIUM	…kflows/agentics-maintenance-dotnet-AspNetCore.Docs.yml	24	# This file is the agentic maintenance workflow for the SideRepoOps target	COMMENT
MEDIUM	.github/workflows/cswin32-update.md	43	# Run agentic jobs in an isolated `copilot-pat-pool` environment.	COMMENT
MEDIUM	.github/workflows/community-pr-issue-check.md	33	# Run agentic jobs in an isolated `copilot-pat-pool` environment.	COMMENT
MEDIUM	.github/workflows/issue-triage-agent.md	129	# Run agentic jobs in an isolated `copilot-pat-pool` environment.	COMMENT
MEDIUM	.github/workflows/test-quarantine.md	2131	# Run agentic jobs in an isolated `copilot-pat-pool` environment.	COMMENT
MEDIUM	.github/workflows/browsertesting-deps-update.md	49	# Run agentic jobs in an isolated `copilot-pat-pool` environment.	COMMENT
MEDIUM	.github/workflows/shared/pat_pool.README.md	82	# Run agentic jobs in an isolated `copilot-pat-pool` environment.	COMMENT
MEDIUM	.github/workflows/shared/pat_pool.README.md	214	[configure-repo]: https://github.github.com/gh-aw/guides/agentic-authoring/#configuring-your-repository	CODE
MEDIUM	.github/agents/agentic-workflows.md	46	- Configuration: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agentic-workflows.md`	CODE
MEDIUM⚡	.github/agents/agentic-workflows.md	71	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-agentic-workflow.md`	CODE
MEDIUM⚡	.github/agents/agentic-workflows.md	81	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/update-agentic-workflow.md`	CODE
MEDIUM⚡	.github/agents/agentic-workflows.md	91	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/debug-agentic-workflow.md`	CODE
MEDIUM	.github/agents/agentic-workflows.md	104	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/upgrade-agentic-workflows.md`	CODE
MEDIUM	.github/agents/agentic-workflows.md	124	Prompt file: `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/create-shared-agentic-workflow.md`	CODE
MEDIUM	.github/agents/agentic-workflows.md	207	# Initialize repository for agentic workflows	COMMENT
MEDIUM	.github/agents/agentic-workflows.md	213	# Only where permitted and human-validated under debug-agentic-workflow.md:	COMMENT
MEDIUM	.github/agents/agentic-workflows.md	239	- Always reference the instructions file at `https://raw.githubusercontent.com/github/gh-aw/main/.github/aw/github-agent	CODE
MEDIUM	src/Analyzers/Analyzers/src/UseAuthorizationAnalyzer.cs	87	// We'll avoid doing any analysis in this event and rely on the runtime guardrails.	COMMENT
MEDIUM	src/Components/AGENTS.md	78	If WebDriver cannot perform or observe one operation, keep the permanent C# Selenium scenario, name the exact WebDriver	CODE

Deep Nesting55 hits · 45 pts

Severity	File	Line	Context
LOW	eng/common/cross/install-debs.py	20	CODE
LOW	eng/common/cross/install-debs.py	198	CODE
LOW	eng/common/cross/install-debs.py	223	CODE
LOW	eng/common/cross/install-debs.py	261	CODE
LOW	eng/common/cross/install-debs.py	295	CODE
LOW	eng/common/cross/install-debs.py	350	CODE
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	368	CODE
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	499	CODE
LOW	…/test-quarantine/test_validate_pull_request_outputs.py	598	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	99	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	168	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	202	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	300	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	427	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	538	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	560	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	664	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	718	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	834	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1406	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1707	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1834	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	1958	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2417	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2780	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2876	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	3218	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	3526	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	2446	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	337	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	2452	CODE
LOW	…pts/test-quarantine/test_collect_case_a_eligibility.py	4056	CODE
LOW	…ripts/test-quarantine/validate_pull_request_outputs.py	122	CODE
LOW	…ripts/test-quarantine/validate_pull_request_outputs.py	483	CODE
LOW	…ripts/test-quarantine/validate_pull_request_outputs.py	602	CODE
LOW	…ts/test-quarantine/collect_unquarantine_eligibility.py	64	CODE
LOW	…ts/test-quarantine/collect_unquarantine_eligibility.py	160	CODE
LOW	…ts/test-quarantine/collect_unquarantine_eligibility.py	252	CODE
LOW	…st-quarantine/test_collect_unquarantine_eligibility.py	236	CODE
LOW	.github/workflows/pr-docs-check/find_existing_draft.py	14	CODE
LOW	.github/workflows/pr-docs-check/test_runtime_wiring.py	114	CODE
LOW	.github/workflows/pr-docs-check/test_runtime_wiring.py	183	CODE
LOW	.github/workflows/pr-docs-check/test_runtime_wiring.py	126	CODE
LOW	…ithub/workflows/pr-docs-check/test_validate_outcome.py	148	CODE
LOW	.github/workflows/pr-docs-check/test_rerun.py	89	CODE
LOW	.github/workflows/pr-docs-check/test_rerun.py	176	CODE
LOW	.github/workflows/pr-docs-check/test_rerun.py	191	CODE
LOW	.github/workflows/pr-docs-check/test_rerun.py	231	CODE
LOW	.github/workflows/pr-docs-check/prepare_run.py	41	CODE
LOW	.github/workflows/pr-docs-check/prepare_context.py	64	CODE
LOW	.github/workflows/pr-docs-check/prepare_context.py	85	CODE
LOW	.github/workflows/pr-docs-check/prepare_context.py	114	CODE
LOW	.github/workflows/pr-docs-check/test_branch_identity.py	56	CODE
LOW	.github/workflows/pr-docs-check/validate_outcome.py	208	CODE
LOW	.github/workflows/pr-docs-check/validate_outcome.py	424	CODE

AI Slop Vocabulary14 hits · 40 pts

Severity	File	Line	Snippet	Context
MEDIUM	eng/common/cross/install-debs.py	128	# keyboxd, which makes it robust on hosts running GnuPG 2.4+ (e.g. Azure	COMMENT
LOW	…ommon/core-templates/steps/enable-internal-sources.yml	34	# If running on dnceng (internal project), just use the default behavior for NuGetAuthenticate.	COMMENT
MEDIUM	eng/skill-evals/pr-attention-queue/eval.vally.yaml	32	# An active mutation-refusal test needs a runtime harness first: a token scoped	COMMENT
MEDIUM	.devcontainer/scripts/container-creation.sh	14	# Add .NET Dev Certs to environment to facilitate debugging.	COMMENT
MEDIUM	src/Mvc/Mvc.TagHelpers/src/FormTagHelper.cs	260	// A <form> tag that doesn't utilize asp-* attributes. Let it flow to the output.	COMMENT
MEDIUM	src/SignalR/server/Core/src/Internal/Utf8HashLookup.cs	14	/// This type is not robust against hash collision attacks. DO NOT add arbitrary adversary-influenced keys to the collec	COMMENT
MEDIUM	…ts/Web.JS/src/Services/ComponentDescriptorDiscovery.ts	278	// comment invalid. We could unencode them in .NET Code, but that would be slower to do and we can leverage the fact t	COMMENT
MEDIUM	src/Components/Web.JS/src/Validation/DomUtils.ts	62	// Use getComputedStyle for robust visibility detection covering CSS classes, stylesheets,	COMMENT
MEDIUM	src/Components/Web/src/WebRenderer.cs	119	// parameters, we utilize the source-generated WebRendererSerializerContext	COMMENT
MEDIUM	src/Components/Components/src/ChangeDetection.cs	33	if (oldValueType != newValueType // Definitely different	CODE
MEDIUM	…nents/Components/src/Reflection/ComponentProperties.cs	320	// SupplyParameterFromQuery feature that did not utilize cascading values, and thus did not have this li	COMMENT
MEDIUM	src/Http/Headers/src/SetCookieHeaderValue.cs	161	/// "SameSite" cookies offer a robust defense against CSRF attack when	COMMENT
MEDIUM	src/Http/Http.Extensions/src/RequestDelegateFactory.cs	792	// For complex types, leverage the shared form binding infrastructure. For example,	COMMENT
MEDIUM	src/Http/Http.Extensions/src/RequestDelegateFactory.cs	2689	// leverage the STJ polymorphism support.	COMMENT

Excessive Try-Catch Wrapping14 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	eng/common/cross/install-debs.py	44	print(f"Error downloading {url}: {type(e).__name__} - {e}. Retrying...")	CODE
MEDIUM	eng/common/cross/install-debs.py	208	print(f"Error: Package '{current}' was not found in the available packages.")	CODE
LOW	.github/workflows/test-quarantine.lock.yml	4064	except Exception as e:	CODE
LOW	.github/workflows/test-quarantine.lock.yml	4135	except Exception:	CODE
LOW	.github/workflows/test-quarantine.lock.yml	4293	except Exception as e:	CODE
LOW	.github/workflows/test-quarantine.lock.yml	4477	except Exception as ex:	CODE
LOW	.github/workflows/test-quarantine.lock.yml	4734	except Exception as ex:	CODE
LOW	.github/workflows/test-quarantine.md	415	except Exception as e:	CODE
LOW	.github/workflows/test-quarantine.md	486	except Exception:	CODE
LOW	.github/workflows/test-quarantine.md	645	except Exception as e:	CODE
LOW	.github/workflows/test-quarantine.md	829	except Exception as ex:	CODE
LOW	.github/workflows/test-quarantine.md	1086	except Exception as ex:	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	3814	except Exception:	CODE
LOW	…/scripts/test-quarantine/collect_case_a_eligibility.py	3845	except Exception:	CODE

AI Response Leakage2 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	…S/src/Rendering/RenderBatch/SharedMemoryRenderBatch.ts	11	// In this implementation, all the DTO types are really heap pointers at runtime, hence all	COMMENT
HIGH	…ebAssembly/src/Hosting/WebAssemblyHostConfiguration.cs	38	// In this implementation, this largely exists as a way to satisfy the	COMMENT

Redundant / Tautological Comments9 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	eng/common/tools.sh	333	# Check if the script is older than 30 days using timestamp file	COMMENT
LOW	eng/common/tools.sh	442	# Check if the toolset has already been extracted	COMMENT
LOW	eng/common/SetupNugetSources.sh	66	# Check if disabledPackageSources section exists	COMMENT
LOW	eng/common/SetupNugetSources.sh	72	# Check if this source name is disabled	COMMENT
LOW	eng/common/SetupNugetSources.sh	92	# Check if source already exists	COMMENT
LOW	eng/common/SetupNugetSources.sh	122	# Check if disabledPackageSources section exists	COMMENT
LOW	eng/common/SetupNugetSources.sh	192	# Check if there is no existing credential for this FeedName	COMMENT
LOW	eng/common/core-templates/steps/source-build.yml	31	# Check if AzDO substitutes in a build config from a variable, and use it if so.	COMMENT
LOW	eng/common/core-templates/steps/install-microbuild.yml	64	# Check if ESRP is disabled while SignType is real	COMMENT

Self-Referential Comments4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	eng/build.sh	376	# Initialize global variables need to be set before the import of Arcade is imported	COMMENT
MEDIUM	eng/common/cross/build-rootfs.sh	693	# Create the symlink in the same directory	COMMENT
MEDIUM	eng/common/core-templates/job/helix-job-monitor.yml	214	# Create a minimal NuGet.config that only references the local nupkg directory.	COMMENT
MEDIUM	…kflows/agentics-maintenance-dotnet-AspNetCore.Docs.yml	24	# This file is the agentic maintenance workflow for the SideRepoOps target	COMMENT

Example Usage Blocks4 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	eng/common/native/install-dependencies.sh	7	# Usage:	COMMENT
LOW	…common/templates-official/variables/pool-providers.yml	12	# How to use:	COMMENT
LOW	eng/common/templates/variables/pool-providers.yml	12	# How to use:	COMMENT
LOW⚡	eng/common/core-templates/job/renovate.yml	11	# Usage:	COMMENT

Magic Placeholder Names1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	…jectTemplates/content/McpServer-CSharp/local/README.md	69	2. Publish to NuGet.org with `dotnet nuget push bin/Release/*.nupkg --api-key <your-api-key> --source https://api.nuget.	CODE

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	…ent/McpServer-CSharp/common/Tools/RandomNumberTools.cs	5	/// Sample MCP tools for demonstration purposes.	COMMENT

Cross-Language Confusion1 hit · 2 pts

Severity	File	Line	Snippet	Context
HIGH	.github/workflows/pr-docs-check/test_runtime_wiring.py	266	self.assertIn("github.event.pull_request.number \|\| inputs.pr_number", workflow)	STRING

TODO Padding1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	…y/EntityFrameworkCore/test/EF.Test/SqlStoreTestBase.cs	17	// TODO: Add test variation with non IdentityDbContext	COMMENT

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	eng/common/cross/install-debs.py	18		CODE

dotnet/aspnetcore

Open-Source Code Quality, Security and Technical Debt Review