Home / dotnet / yarp
AI Slop Code Risk Monitor

dotnet/yarp

SlopCodeMonitor badge for dotnet/yarp Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

A toolkit for developing high-performance HTTP reverse proxy applications.

3.1 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for dotnet/yarp, a C# project with 9,646 GitHub stars. SynthScan examined 83,726 lines of code across 926 source files, recording 214 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 3.1 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

3.1
Adjusted Signal
3.1
Raw Pattern Score
100%
Time Factor
2026-10-29
Last Push
9.6K
Stars
C#
Language
83.7K
Lines of Code
926
Files
214
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 12.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 205 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 1 finding(s).

Agent Over-Engineering Ratio 2.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 11 finding(s).

PR Review Velocity Impact 13.2/100 · LOW

Which changes need focused human review? 214 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 11LOW 203

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 214 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block173 hits · 173 pts
SeverityFileLineSnippetContext
LOWeng/common/SetupNugetSources.sh1#!/usr/bin/env bashCOMMENT
LOWeng/common/vmr-sync.sh1#!/bin/bashCOMMENT
LOWeng/common/vmr-sync.sh21###COMMENT
LOWeng/common/native/init-distro-rid.sh1#!/bin/shCOMMENT
LOWeng/common/native/init-distro-rid.sh61COMMENT
LOW…common/templates-official/variables/pool-providers.yml1# Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc poolCOMMENT
LOWeng/common/templates/vmr-build-pr.yml1# This pipeline is used for running the VMR verification of the PR changes in repo-level PRs.COMMENT
LOWeng/common/templates/variables/pool-providers.yml1# Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc poolCOMMENT
LOWeng/common/core-templates/stages/renovate.yml1# --------------------------------------------------------------------------------------COMMENT
LOW…g/common/core-templates/steps/get-github-app-token.yml1# Mints a short-lived GitHub App installation access token by signing a JWTCOMMENT
LOWeng/common/core-templates/steps/install-microbuild.yml1parameters:COMMENT
LOWeng/common/core-templates/job/renovate.yml1# --------------------------------------------------------------------------------------COMMENT
LOWeng/common/core-templates/job/source-build.yml1parameters:COMMENT
LOWeng/common/core-templates/job/source-build.yml21 # published by source-build.COMMENT
LOWtest/Tests.Common/TestTimeProvider.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOWsamples/ReverseProxy.Direct.Sample/Program.cs81{COMMENT
LOWsrc/Kubernetes.Controller/NamespacedName.cs41COMMENT
LOWsrc/Kubernetes.Controller/NamespacedName.cs61 {COMMENT
LOWsrc/Kubernetes.Controller/Rate/Limit.cs21 /// <summary>COMMENT
LOWsrc/Kubernetes.Controller/Rate/Limit.cs61 /// https://github.com/golang/time/blob/master/rate/rate.go#L396.COMMENT
LOWsrc/Kubernetes.Controller/Rate/Limiter.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOWsrc/Kubernetes.Controller/Rate/Limiter.cs21/// The zero value is a valid Limiter, but it will reject all events.COMMENT
LOWsrc/Kubernetes.Controller/Rate/Limiter.cs81COMMENT
LOWsrc/Kubernetes.Controller/Rate/Limiter.cs101 }COMMENT
LOW…ment/KubernetesReverseProxyWebHostBuilderExtensions.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOW…t/KubernetesReverseProxyServiceCollectionExtensions.cs21COMMENT
LOWsrc/Kubernetes.Controller/Converters/YarpParser.cs301 if (annotations.TryGetValue("yarp.ingress.kubernetes.io/route-methods", out var routeMethods))COMMENT
LOW….Controller/Certificates/IServerCertificateSelector.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOW….Controller/Certificates/IServerCertificateSelector.cs21COMMENT
LOW…bernetes.Controller/Hosting/BackgroundHostedService.cs121 }COMMENT
LOW…ing/ServiceCollectionHostedServiceAdapterExtensions.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOWsrc/Kubernetes.Controller/Queues/IWorkQueue.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOWsrc/Kubernetes.Controller/Queues/IWorkQueue.cs21 /// Adds the specified item.COMMENT
LOWsrc/Kubernetes.Controller/Queues/IWorkQueue.cs41 /// processing is complete.COMMENT
LOWsrc/Kubernetes.Controller/Client/IResourceInformer.cs21/// <summary>COMMENT
LOWsrc/Kubernetes.Controller/Client/IResourceInformer.cs41 IResourceInformerRegistration Register(ResourceInformerCallback<TResource> callback);COMMENT
LOWsrc/Kubernetes.Controller/Client/IResourceInformer.cs61 /// Registers a callback for change notification. To ensure no events are missed the registrationCOMMENT
LOW…tes.Controller/Client/IResourceInformerRegistration.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOWsrc/ReverseProxy/Configuration/ClusterConfig.cs21COMMENT
LOWsrc/ReverseProxy/Configuration/SessionAffinityConfig.cs21 /// </summary>COMMENT
LOW…/ReverseProxy/Configuration/ActiveHealthCheckConfig.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOW…/ReverseProxy/Configuration/ActiveHealthCheckConfig.cs21 public TimeSpan? Interval { get; init; }COMMENT
LOWsrc/ReverseProxy/Configuration/RouteQueryParameter.cs21 /// <summary>COMMENT
LOWsrc/ReverseProxy/Configuration/IProxyConfigProvider.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOWsrc/ReverseProxy/Configuration/WebProxyConfig.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOWsrc/ReverseProxy/Configuration/RouteMatch.cs21 /// Only match requests with the given Host header.COMMENT
LOWsrc/ReverseProxy/Configuration/HttpClientConfig.cs21 /// <summary>COMMENT
LOWsrc/ReverseProxy/Configuration/HttpClientConfig.cs41COMMENT
LOWsrc/ReverseProxy/Configuration/HttpClientConfig.cs61 /// <remarks>COMMENT
LOWsrc/ReverseProxy/Configuration/IConfigChangeListener.cs21 /// <summary>COMMENT
LOW…erseProxy/Configuration/SessionAffinityCookieConfig.cs21 /// <summary>COMMENT
LOW…erseProxy/Configuration/SessionAffinityCookieConfig.cs41 /// <remarks>Defaults to <see cref="SameSiteMode.Unspecified"/>.</remarks>COMMENT
LOWsrc/ReverseProxy/Configuration/RouteHeader.cs21 /// <summary>COMMENT
LOW…/ReverseProxy/Configuration/QueryParameterMatchMode.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOW…/ReverseProxy/Configuration/QueryParameterMatchMode.cs21 /// Only single query parameter name supported. If there are multiple query parameters with the same name then the mCOMMENT
LOWsrc/ReverseProxy/Configuration/IProxyConfigFilter.cs21 /// <summary>COMMENT
LOWsrc/ReverseProxy/Configuration/HealthCheckConfig.cs1// Licensed to the .NET Foundation under one or more agreements.COMMENT
LOWsrc/ReverseProxy/Configuration/RouteConfig.cs21 /// </summary>COMMENT
LOWsrc/ReverseProxy/Configuration/RouteConfig.cs41 /// <summary>COMMENT
LOWsrc/ReverseProxy/Configuration/RouteConfig.cs61 public string? OutputCachePolicy { get; init; }COMMENT
113 more matches not shown…
Decorative Section Separators6 hits · 27 pts
SeverityFileLineSnippetContext
MEDIUM⚡eng/common/core-templates/stages/renovate.yml1# --------------------------------------------------------------------------------------COMMENT
MEDIUM⚡eng/common/core-templates/stages/renovate.yml3# --------------------------------------------------------------------------------------COMMENT
MEDIUM⚡eng/common/core-templates/stages/renovate.yml9# --------------------------------------------------------------------------------------COMMENT
MEDIUM⚡eng/common/core-templates/job/renovate.yml1# --------------------------------------------------------------------------------------COMMENT
MEDIUM⚡eng/common/core-templates/job/renovate.yml3# --------------------------------------------------------------------------------------COMMENT
MEDIUM⚡eng/common/core-templates/job/renovate.yml17# --------------------------------------------------------------------------------------COMMENT
Redundant / Tautological Comments9 hits · 14 pts
SeverityFileLineSnippetContext
LOWeng/common/tools.sh333 # Check if the script is older than 30 days using timestamp fileCOMMENT
LOWeng/common/tools.sh442 # Check if the toolset has already been extractedCOMMENT
LOWeng/common/SetupNugetSources.sh66 # Check if disabledPackageSources section existsCOMMENT
LOWeng/common/SetupNugetSources.sh72 # Check if this source name is disabledCOMMENT
LOWeng/common/SetupNugetSources.sh92 # Check if source already existsCOMMENT
LOWeng/common/SetupNugetSources.sh122 # Check if disabledPackageSources section existsCOMMENT
LOWeng/common/SetupNugetSources.sh192 # Check if there is no existing credential for this FeedNameCOMMENT
LOWeng/common/core-templates/steps/source-build.yml31 # Check if AzDO substitutes in a build config from a variable, and use it if so.COMMENT
LOWeng/common/core-templates/steps/install-microbuild.yml64 # Check if ESRP is disabled while SignType is realCOMMENT
Structural Annotation Overuse4 hits · 9 pts
SeverityFileLineSnippetContext
LOW⚡src/ReverseProxy/Management/ProxyConfigManager.cs844 // Step 1 - capture old tokenCOMMENT
LOW⚡src/ReverseProxy/Management/ProxyConfigManager.cs847 // Step 2 - update endpointsCOMMENT
LOW⚡src/ReverseProxy/Management/ProxyConfigManager.cs850 // Step 3 - create new change tokenCOMMENT
LOW⚡src/ReverseProxy/Management/ProxyConfigManager.cs854 // Step 4 - trigger old tokenCOMMENT
Example Usage Blocks5 hits · 8 pts
SeverityFileLineSnippetContext
LOWeng/common/native/install-dependencies.sh7# Usage:COMMENT
LOW…common/templates-official/variables/pool-providers.yml12# How to use:COMMENT
LOWeng/common/templates/variables/pool-providers.yml12# How to use:COMMENT
LOW⚡eng/common/core-templates/job/renovate.yml11# Usage:COMMENT
LOWsrc/Kubernetes.Controller/Rate/Limiter.cs107 /// Usage example:COMMENT
Deep Nesting6 hits · 6 pts
SeverityFileLineSnippetContext
LOWeng/common/cross/install-debs.py20CODE
LOWeng/common/cross/install-debs.py198CODE
LOWeng/common/cross/install-debs.py223CODE
LOWeng/common/cross/install-debs.py261CODE
LOWeng/common/cross/install-debs.py295CODE
LOWeng/common/cross/install-debs.py350CODE
Self-Referential Comments2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMeng/common/cross/build-rootfs.sh693 # Create the symlink in the same directoryCOMMENT
MEDIUMeng/common/core-templates/job/helix-job-monitor.yml214 # Create a minimal NuGet.config that only references the local nupkg directory.COMMENT
AI Slop Vocabulary2 hits · 4 pts
SeverityFileLineSnippetContext
MEDIUMeng/common/cross/install-debs.py128 # keyboxd, which makes it robust on hosts running GnuPG 2.4+ (e.g. AzureCOMMENT
LOW…ommon/core-templates/steps/enable-internal-sources.yml34 # If running on dnceng (internal project), just use the default behavior for NuGetAuthenticate.COMMENT
Excessive Try-Catch Wrapping2 hits · 4 pts
SeverityFileLineSnippetContext
MEDIUMeng/common/cross/install-debs.py44 print(f"Error downloading {url}: {type(e).__name__} - {e}. Retrying...")CODE
MEDIUMeng/common/cross/install-debs.py208 print(f"Error: Package '{current}' was not found in the available packages.")CODE
Hyper-Verbose Identifiers3 hits · 3 pts
SeverityFileLineSnippetContext
LOWeng/common/cross/install-debs.py51async def download_deb_files_parallel(mirror, packages, tmp_dir):CODE
LOWeng/common/cross/install-debs.py67async def download_package_index_parallel(mirror, arch, suites, check_sig, keyring):CODE
LOWeng/common/cross/install-debs.py339def _rootfs_extraction_filter(member, dest_path):CODE
Slop Phrases1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsamples/ReverseProxy.Code.Sample/Program.cs35 // Don't forget to include these two middleware when you make a custom proxy pipeline (if you need them).COMMENT
Unused Imports1 hit · 1 pts
SeverityFileLineSnippetContext
LOWeng/common/cross/install-debs.py18CODE