ESP8266 core for Arduino
This report summarizes scanner evidence for esp8266/Arduino, a C++ project with 16,688 GitHub stars. SynthScan examined 193,854 lines of code across 779 source files, recording 777 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 4.2 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 725 finding(s).
Are imports declared and package/API names verified? 23 finding(s).
Are wrappers, guards, and repeated structures necessary? 40 finding(s).
Which changes need focused human review? 777 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 777 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | keywords.txt | 1 | ####################################### | COMMENT |
| LOW | tools/build.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/espota.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/boards.txt.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/boards.txt.py | 21 | # opts: specific entries dicts (overrides same entry in macros) | COMMENT |
| LOW | tools/elf2bin.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/sizes.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/mkbuildoptglobals.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/mkbuildoptglobals.py | 21 | # See the License for the specific language governing permissions and | COMMENT |
| LOW | tools/mkbuildoptglobals.py | 101 | -fanalyzer | COMMENT |
| LOW | tools/mkbuildoptglobals.py | 761 | # 3. When the timestamp matches the build copy of globals.h | COMMENT |
| LOW | tools/platformio-build.py | 1 | # Copyright (c) 2014-present PlatformIO <contact@platformio.org> | COMMENT |
| LOW | tools/makecorever.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/sdk/include/espconn.h | 41 | typedef void (* espconn_reconnect_callback)(void *arg, sint8 err); | COMMENT |
| LOW | tools/sdk/include/version.h | 1 | #ifndef ESP_SDK_VERSION_H | COMMENT |
| LOW | tools/sdk/include/user_interface.h | 21 | * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | COMMENT |
| LOW | tools/sdk/include/user_interface.h | 41 | #endif | COMMENT |
| LOW | tools/sdk/include/os_type.h | 21 | * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | COMMENT |
| LOW | tools/sdk/include/osapi.h | 21 | * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | COMMENT |
| LOW | tools/sdk/include/osapi.h | 41 | #define os_isr_attach ets_isr_attach | COMMENT |
| LOW | tools/sdk/include/osapi.h | 61 | #define os_timer_arm(a, b, c) ets_timer_arm_new(a, b, c, 1) | COMMENT |
| LOW | tools/sdk/include/c_types.h | 81 | #define REG_CLR_BIT(_r, _b) (*(volatile uint32_t*)(_r) &= ~(_b)) | COMMENT |
| LOW | tools/sdk/include/c_types.h | 101 | #ifndef __cplusplus | COMMENT |
| LOW | tools/sdk/include/uart_register.h | 1 | //Generated at 2012-07-03 18:44:06 | COMMENT |
| LOW | tools/sdk/include/uart_register.h | 21 | #define UART_RXFIFO_OVF_INT_RAW (BIT(4)) | COMMENT |
| LOW | tools/sdk/include/uart_register.h | 41 | #define UART_CTS_CHG_INT_ENA (BIT(6)) | COMMENT |
| LOW | tools/sdk/include/uart_register.h | 61 | #define UART_CLKDIV_CNT 0x000FFFFF | COMMENT |
| LOW | tools/sdk/include/uart_register.h | 81 | #define UART_CONF0( i ) (REG_UART_BASE( i ) + 0x20) | COMMENT |
| LOW | tools/sdk/include/uart_register.h | 101 | COMMENT | |
| LOW | tools/sdk/include/uart_register.h | 121 | COMMENT | |
| LOW | tools/sdk/include/eagle_soc.h | 21 | * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 41 | #define BIT19 0x00080000 | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 61 | //}} | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 81 | //}} | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 101 | #define GPIO_OUT_W1TS_ADDRESS 0x04 | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 121 | #define RTC_CALIB_VALUE_MASK 0xfffff | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 141 | #define GPIO_PIN_WAKEUP_ENABLE_LSB 10 | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 161 | #define SIGMA_AS_PIN_SOURCE (~GPIO_AS_PIN_SOURCE) | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 181 | COMMENT | |
| LOW | tools/sdk/include/eagle_soc.h | 201 | //RTC reg {{ | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 221 | #define PERIPHS_IO_MUX_SLEEP_PULLUP BIT3 | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 241 | #define FUNC_GPIO13 3 | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 261 | #define FUNC_I2SO_DATA 1 | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 281 | #define FUNC_GPIO7 3 | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 301 | #define FUNC_SDDATA3 0 | COMMENT |
| LOW | tools/sdk/include/eagle_soc.h | 321 | #define FUNC_U1TXD_BK 2 | COMMENT |
| LOW | tools/sdk/include/ipv4_addr.h | 21 | * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | COMMENT |
| LOW | tools/sdk/include/spi_flash_geometry.h | 1 | #ifndef SPI_FLASH_GEOMETRY_H | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 1 | //Generated at 2012-10-23 19:55:03 | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 21 | #define SLC_RX_AUTO_WRBACK (BIT(6)) | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 41 | #define SLC_RX_UDF_INT_RAW (BIT(10)) | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 61 | #define SLC_TX_DONE_INT_ST (BIT(14)) | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 81 | #define SLC_TOHOST_INT_ENA (BIT(18)) | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 101 | #define SLC_FRHOST_BIT_INT_ENA_ALL 0xff | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 121 | #define SLC_FRHOST_BIT4_INT_CLR (BIT(4)) | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 141 | #define SLC_TXFIFO_POP (BIT(16)) | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 161 | #define SLC_INTVEC_TOHOST (REG_SLC_BASE + 0x2C) | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 181 | #define SLC_TOKEN1_LOCAL_WDATA_S 0 | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 201 | #define SLC_TO_HOST_LAST_DESC SLC_RX_EOF_DES_ADDR | COMMENT |
| LOW | tools/sdk/include/slc_register.h | 221 | #define SLC_INFOR_NO_REPLACE (BIT(9)) | COMMENT |
| 632 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tools/signing.py | 83 | except Exception: | CODE |
| HIGH | tools/upload.py | 60 | except Exception: | CODE |
| HIGH | tools/cert.py | 107 | except: | CODE |
| HIGH | tools/cert.py | 111 | except: | CODE |
| HIGH | tools/mkdir.py | 17 | except FileExistsError: | CODE |
| HIGH | tools/mkbuildoptglobals.py | 643 | except: | CODE |
| HIGH | tools/mkbuildoptglobals.py | 651 | except: | CODE |
| HIGH | tools/makecorever.py | 50 | except IndexError: | CODE |
| HIGH | tools/makecorever.py | 52 | except FileNotFoundError: | CODE |
| HIGH | tools/makecorever.py | 93 | except ValueError: | CODE |
| HIGH | tests/device/test_BearSSL/make_data.py | 48 | except Exception: | CODE |
| HIGH | …6WiFi/examples/BearSSL_CertStore/certs-from-mozilla.py | 48 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/build.py | 23 | CODE | |
| LOW | tools/build.py | 27 | CODE | |
| LOW | tools/espota.py | 31 | CODE | |
| LOW | tools/boards.txt.py | 35 | CODE | |
| LOW | tools/elf2bin.py | 21 | CODE | |
| LOW | tools/format_tzdata.py | 14 | CODE | |
| LOW | tools/makecorever.py | 25 | CODE | |
| LOW | tests/restyle.py | 5 | CODE | |
| LOW | tests/device/test_ClientContext/test_ClientContext.py | 4 | CODE | |
| LOW | tests/device/test_ClientContext/test_ClientContext.py | 9 | CODE | |
| LOW | tests/device/libraries/BSTest/runner.py | 11 | CODE | |
| LOW | tests/device/libraries/BSTest/runner.py | 13 | CODE | |
| LOW | tests/device/libraries/BSTest/runner.py | 20 | CODE | |
| LOW | tests/device/libraries/BSTest/runner.py | 20 | CODE | |
| LOW | tests/device/test_BearSSL/make_data.py | 10 | CODE | |
| LOW | tests/device/test_http_server/test_http_server.py | 4 | CODE | |
| LOW | tests/device/test_http_server/test_http_server.py | 5 | CODE | |
| LOW | tests/device/test_http_server/test_http_server.py | 6 | CODE | |
| LOW | …6WiFi/examples/BearSSL_CertStore/certs-from-mozilla.py | 10 | CODE | |
| LOW | libraries/ESP8266WiFi/examples/WiFiEcho/echo-client.py | 3 | CODE | |
| LOW | doc/conf.py | 21 | CODE | |
| LOW | package/merge_packages.py | 7 | CODE | |
| LOW | package/drop_versions.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/signing.py | 83 | except Exception: | CODE |
| LOW | tools/signing.py | 100 | except Exception as e: | CODE |
| LOW | tools/espota.py | 80 | except Exception: | CODE |
| LOW | tools/espota.py | 107 | except Exception: | CODE |
| LOW | tools/espota.py | 126 | except Exception: | CODE |
| LOW | tools/espota.py | 150 | except Exception: | CODE |
| LOW | tools/espota.py | 176 | except Exception: | CODE |
| LOW | tools/espota.py | 210 | except Exception: | CODE |
| LOW | tools/upload.py | 60 | except Exception: | CODE |
| LOW | tools/upload.py | 118 | except Exception: | CODE |
| MEDIUM | tools/upload.py | 57 | def maybe_remove(path): | CODE |
| LOW | tests/device/test_ClientContext/test_ClientContext.py | 32 | except Exception: | CODE |
| LOW | tests/device/test_BearSSL/make_data.py | 48 | except Exception: | CODE |
| LOW | tests/device/test_http_server/test_http_server.py | 19 | except Exception as e: | CODE |
| LOW | …6WiFi/examples/BearSSL_CertStore/certs-from-mozilla.py | 48 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/signing.py | 54 | CODE | |
| LOW | tools/decoder.py | 100 | CODE | |
| LOW | tools/espota.py | 72 | CODE | |
| LOW | tools/boards.txt.py | 1718 | CODE | |
| LOW | tools/elf2bin.py | 145 | CODE | |
| LOW | tools/sizes.py | 38 | CODE | |
| LOW | tools/cert.py | 21 | CODE | |
| LOW | tools/mkbuildoptglobals.py | 321 | CODE | |
| LOW | tools/mkbuildoptglobals.py | 432 | CODE | |
| LOW | tools/mkbuildoptglobals.py | 491 | CODE | |
| LOW | tests/restyle.py | 141 | CODE | |
| LOW | tests/device/libraries/BSTest/runner.py | 51 | CODE | |
| LOW | tests/device/libraries/BSTest/runner.py | 81 | CODE | |
| LOW | tests/device/libraries/BSTest/runner.py | 138 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/mkbuildoptglobals.py | 321 | def extract_create_build_opt_file(globals_h_fqfn, file_name, build_opt_fqfn): | CODE |
| LOW | tools/format_tzdata.py | 55 | def tzdata_resource_from_name(name): | CODE |
| LOW | tools/platformio-build.py | 36 | def scons_patched_match_splitext(path, suffixes=None): | CODE |
| LOW⚡ | tests/device/test_http_server/test_http_server.py | 43 | def teardown_http_post_params(e): | CODE |
| LOW⚡ | tests/device/test_http_server/test_http_server.py | 47 | def setup_http_getpost_params(e): | CODE |
| LOW⚡ | tests/device/test_http_server/test_http_server.py | 53 | def teardown_http_getpost_params(e): | CODE |
| LOW | libraries/ESP8266WebServer/src/detail/RequestHandler.h | 11 | class RequestHandler { | CODE |
| LOW | …ries/ESP8266WebServer/src/detail/RequestHandlersImpl.h | 15 | class FunctionRequestHandler : public RequestHandler<ServerType> { | CODE |
| LOW | …ries/ESP8266WebServer/src/detail/RequestHandlersImpl.h | 88 | class StaticRequestHandler : public RequestHandler<ServerType> { | CODE |
| LOW | …ries/ESP8266WebServer/src/detail/RequestHandlersImpl.h | 119 | class StaticDirectoryRequestHandler : public StaticRequestHandler<ServerType> { | CODE |
| LOW | …ries/ESP8266WebServer/src/detail/RequestHandlersImpl.h | 223 | class StaticFileRequestHandler | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/espota.py | 73 | # Create a TCP/IP socket | COMMENT |
| MEDIUM | .github/workflows/tag-to-draft-release.yml | 39 | # Create a draft release and upload the ZIP and JSON files. | COMMENT |
| MEDIUM | doc/conf.py | 6 | # This file is execfile()d with the current directory set to its | COMMENT |
| MEDIUM | doc/reference_items.yml | 1 | # This file defines the order in which documents will appear in the menu | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | platform.txt | 3 | # ------------------------------ | COMMENT |
| MEDIUM | platform.txt | 169 | # ------------------------------ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/decoder.py | 58 | # instead, simply use an already short-format `info line` | COMMENT |
| LOW | tools/sdk/lwip2/include/lwip/sockets.h | 205 | #define SO_DONTROUTE 0x0010 /* Unimplemented: just use interface addresses */ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | libraries/ESP8266mDNS/src/LEAmDNS.h | 238 | // TODO: implement instancename different from hostname | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | package/merge_packages.py | 3 | # Usage: | COMMENT |