1.6

Adjusted Signal

1.6

Raw Pattern Score

100%

Time Factor

2026-08-09

Last Push

40.1K

Stars

Language

254.7K

Lines of Code

325

Files

366

Pattern Hits

2026-10-31

Scan Date

0.02

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 361 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.0/100 · LOW

Are imports declared and package/API names verified? 5 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 12 finding(s).

PR Review Velocity Impact 8.0/100 · LOW

Which changes need focused human review? 366 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 5HIGH 0MEDIUM 7LOW 354

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 366 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block293 hits · 258 pts

Severity	File	Line	Snippet	Context
LOW	CHANGELOG-2023.md	241	#fffb77 40.62%,	COMMENT
LOW	cmd/esbuild/service.go	721	build.OnEnd(func(result *api.BuildResult) (api.OnEndResult, error) {	COMMENT
LOW	cmd/esbuild/main.go	321	}	COMMENT
LOW	internal/js_lexer/js_lexer.go	1	package js_lexer	COMMENT
LOW	internal/js_lexer/js_lexer.go	221	// resolved to a symbol in the second pass. To avoid allocating extra memory	COMMENT
LOW	internal/js_lexer/js_lexer.go	1701	}	COMMENT
LOW	internal/sourcemap/sourcemap.go	641	return ChunkBuilder{	COMMENT
LOW	internal/logger/logger.go	401	base = base[:dot]	COMMENT
LOW	internal/logger/logger.go	441		COMMENT
LOW	internal/cache/cache.go	1	package cache	COMMENT
LOW	internal/cache/cache.go	21	// - The information in the cache must not depend at all on the contents of	COMMENT
LOW	internal/linker/linker.go	101	// This is the final path of this chunk relative to the output directory. It	COMMENT
LOW	internal/linker/linker.go	541		COMMENT
LOW	internal/linker/linker.go	1401	switch record.Kind {	COMMENT
LOW	internal/linker/linker.go	1901	// This is an external import. Check if it will be a "require()" call.	COMMENT
LOW	internal/linker/linker.go	1961	// by modifying the exports object itself because the same ES	COMMENT
LOW	internal/linker/linker.go	2221	// shaking by letting you only import part of a JSON file.	COMMENT
LOW	internal/linker/linker.go	2421	}	COMMENT
LOW	internal/linker/linker.go	2641	// Make sure we avoid infinite loops trying to resolve cycles:	COMMENT
LOW	internal/linker/linker.go	2721	symbol := c.graph.Symbols.Get(tracker.importRef)	COMMENT
LOW	internal/linker/linker.go	2741		COMMENT
LOW	internal/linker/linker.go	3301	part.IsLive = true	COMMENT
LOW	internal/linker/linker.go	3381		COMMENT
LOW	internal/linker/linker.go	3401	//	COMMENT
LOW	internal/linker/linker.go	3621	// The layer is anonymous if it's a "layer" token without any	COMMENT
LOW	internal/linker/linker.go	3641	}	COMMENT
LOW	internal/linker/linker.go	3701	for j := len(duplicates) - 1; j >= 0; j-- {	COMMENT
LOW	internal/linker/linker.go	3781	if !css_ast.TokensEqualIgnoringWhitespace(ai.Layers, bi.Layers) \|\|	COMMENT
LOW	internal/linker/linker.go	3801	// @import "lib.css" screen;	COMMENT
LOW	internal/linker/linker.go	3841	continue	COMMENT
LOW	internal/linker/linker.go	4741	// }	COMMENT
LOW	internal/linker/linker.go	5061	} else {	COMMENT
LOW	internal/linker/linker.go	5081	// when "file-from-esbuild.cjs" looks like this:	COMMENT
LOW	internal/linker/linker.go	5201	// Exports of imports need EImportIdentifier in case they need to be re-	COMMENT
LOW	internal/linker/linker.go	5221	//	COMMENT
LOW	internal/linker/linker.go	5261	// // esm-format.js	COMMENT
LOW	internal/linker/linker.go	5461	}	COMMENT
LOW	internal/linker/linker.go	5521	nestedScopes[sourceIndex] = []*js_ast.Scope{repr.AST.ModuleScope}	COMMENT
LOW	internal/linker/linker.go	6881	bytes := chunk.intermediateOutput.joiner.Done()	COMMENT
LOW	internal/linker/linker.go	7041	// better readability and to be independent of build directory.	COMMENT
LOW	internal/config/config.go	281	}	COMMENT
LOW	internal/config/config.go	301	// ... bundled code ...	COMMENT
LOW	internal/config/config.go	401	ModuleTypeData js_ast.ModuleTypeData	COMMENT
LOW	internal/config/config.go	521	TSImportsNotUsedAsValues_Preserve	COMMENT
LOW	internal/config/config.go	541	// "import { type unused } from 'foo'" => ""	COMMENT
LOW	internal/config/globals.go	21	// "if (a) console.log(b); else console.log(c)" to be reordered and transformed	COMMENT
LOW	internal/config/globals.go	421	{"SVGTransform"},	COMMENT
LOW	internal/config/globals.go	901	{"stop"},	COMMENT
LOW	internal/js_printer/js_printer.go	1661	// This function returns "nil" to indicate that the expression should be removed	COMMENT
LOW	internal/js_ast/js_ast.go	1	package js_ast	COMMENT
LOW	internal/js_ast/js_ast.go	261	)	COMMENT
LOW	internal/js_ast/js_ast.go	381	// decorators on it. Note that this flag is not necessarily set to true if	COMMENT
LOW	internal/js_ast/js_ast.go	501	IsParenthesized bool	COMMENT
LOW	internal/js_ast/js_ast.go	521	// Similarly the expression "delete (0, x)" must not become "delete x"	COMMENT
LOW	internal/js_ast/js_ast.go	721	// If we're inside a "with" statement, this identifier may be a property	COMMENT
LOW	internal/js_ast/js_ast.go	741	// Depending on how the code is linked, the file containing this EImportIdentifier	COMMENT
LOW	internal/js_ast/js_ast.go	781	type EJSXElement struct {	COMMENT
LOW	internal/js_ast/js_ast.go	1181	// import defaultItem, {item1, item2} from 'path'	COMMENT
LOW	internal/js_ast/js_ast.go	1341	}	COMMENT
LOW	internal/js_ast/js_ast.go	1361	//	COMMENT
233 more matches not shown…

Hallucination Indicators5 hits · 50 pts

Severity	File	Line	Snippet	Context
CRITICAL	internal/bundler/bundler.go	2434	sb.Write(helpers.QuoteForJSON(result.file.inputFile.Source.PrettyPaths.Select(s.options.MetafilePathStyle), s.options	CODE
CRITICAL	internal/bundler/bundler.go	2701	if attrs := result.file.inputFile.Source.KeyPath.ImportAttributes.DecodeIntoArray(); len(attrs) > 0 {	CODE
CRITICAL	internal/bundler/bundler.go	2786	helpers.QuoteForJSON(result.file.inputFile.Source.PrettyPaths.Select(s.options.MetafilePathStyle), s.options.ASCIIO	CODE
CRITICAL	internal/bundler/bundler.go	2793	helpers.QuoteForJSON(result.file.inputFile.Source.PrettyPaths.Select(s.options.MetafilePathStyle), s.options.ASCII	CODE
CRITICAL	internal/bundler/bundler.go	2925	parentResult.file.inputFile.Source.PrettyPaths.Select(s.options.LogPathStyle),	CODE

Structural Annotation Overuse22 hits · 38 pts

Severity	File	Line	Snippet	Context
LOW	internal/renamer/renamer.go	182	// NOTE: This function is run in parallel. Make sure to avoid data races.	COMMENT
LOW	internal/renamer/renamer.go	195	// NOTE: This function is run in parallel. Make sure to avoid data races.	COMMENT
LOW	internal/linker/linker.go	1298	// Step 1: Figure out what modules must be CommonJS	COMMENT
LOW	internal/linker/linker.go	1467	// Step 2: Propagate dynamic export status for export star statements that	COMMENT
LOW	internal/linker/linker.go	1504	// Step 3: Resolve "export * from" statements. This must be done after we	COMMENT
LOW	internal/linker/linker.go	1537	// Step 4: Match imports with exports. This must be done after we process all	COMMENT
LOW	internal/linker/linker.go	1570	// Step 5: Create namespace exports for every file. This is always necessary	COMMENT
LOW	internal/linker/linker.go	1762	// Step 6: Bind imports to exports. This adds non-local dependencies on the	COMMENT
LOW	internal/js_parser/js_parser_lower.go	504	// Step 1: Get an array of all expressions in the chain. We're traversing the	COMMENT
LOW	internal/js_parser/js_parser_lower.go	583	// Step 2: Figure out if we need to capture the value for "this" for the	COMMENT
LOW⚡	internal/js_parser/js_parser_lower.go	660	// Step 3: Figure out if we need to capture the starting value. We don't need	COMMENT
LOW⚡	internal/js_parser/js_parser_lower.go	668	// Step 4: Wrap the starting value by each expression in the chain. We	COMMENT
LOW	internal/js_parser/js_parser_lower.go	774	// Step 5: Wrap it all in a conditional that returns the chain or the default	COMMENT
LOW	scripts/test262.js	223	// Step 1: Try transforming the file normally	COMMENT
LOW⚡	scripts/test262.js	241	// Step 2: Try transforming the output again (this should always succeed)	COMMENT
LOW⚡	scripts/test262.js	250	// Step 3: The output should be the same the second time	COMMENT
LOW⚡	scripts/test262.js	261	// Step 4: Try minifying the output once	COMMENT
LOW⚡	scripts/test262.js	270	// Step 5: Try minifying the output again	COMMENT
LOW	scripts/test262.js	302	// Step 1: Try building the file normally	COMMENT
LOW	scripts/test262.js	350	// Step 3: Try evaluating the file using node	COMMENT
LOW	scripts/test262.js	365	// Step 3: Try evaluating the file we generated	COMMENT
LOW	scripts/test262.js	383	// Step 4: If evaluation worked and was supposed to work, check to see	COMMENT

Verbosity Indicators20 hits · 34 pts

Severity	File	Line	Snippet	Context
LOW	internal/linker/linker.go	1298	// Step 1: Figure out what modules must be CommonJS	COMMENT
LOW	internal/linker/linker.go	1467	// Step 2: Propagate dynamic export status for export star statements that	COMMENT
LOW	internal/linker/linker.go	1504	// Step 3: Resolve "export * from" statements. This must be done after we	COMMENT
LOW	internal/linker/linker.go	1537	// Step 4: Match imports with exports. This must be done after we process all	COMMENT
LOW	internal/linker/linker.go	1570	// Step 5: Create namespace exports for every file. This is always necessary	COMMENT
LOW	internal/linker/linker.go	1762	// Step 6: Bind imports to exports. This adds non-local dependencies on the	COMMENT
LOW	internal/js_parser/js_parser_lower.go	504	// Step 1: Get an array of all expressions in the chain. We're traversing the	COMMENT
LOW	internal/js_parser/js_parser_lower.go	583	// Step 2: Figure out if we need to capture the value for "this" for the	COMMENT
LOW⚡	internal/js_parser/js_parser_lower.go	660	// Step 3: Figure out if we need to capture the starting value. We don't need	COMMENT
LOW⚡	internal/js_parser/js_parser_lower.go	668	// Step 4: Wrap the starting value by each expression in the chain. We	COMMENT
LOW	internal/js_parser/js_parser_lower.go	774	// Step 5: Wrap it all in a conditional that returns the chain or the default	COMMENT
LOW	scripts/test262.js	223	// Step 1: Try transforming the file normally	COMMENT
LOW⚡	scripts/test262.js	241	// Step 2: Try transforming the output again (this should always succeed)	COMMENT
LOW⚡	scripts/test262.js	250	// Step 3: The output should be the same the second time	COMMENT
LOW⚡	scripts/test262.js	261	// Step 4: Try minifying the output once	COMMENT
LOW⚡	scripts/test262.js	270	// Step 5: Try minifying the output again	COMMENT
LOW	scripts/test262.js	302	// Step 1: Try building the file normally	COMMENT
LOW	scripts/test262.js	350	// Step 3: Try evaluating the file using node	COMMENT
LOW	scripts/test262.js	365	// Step 3: Try evaluating the file we generated	COMMENT
LOW	scripts/test262.js	383	// Step 4: If evaluation worked and was supposed to work, check to see	COMMENT

AI Slop Vocabulary7 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	internal/js_ast/js_ast_helpers.go	240	return PrimitiveMixed // Definitely some kind of primitive	CODE
MEDIUM	internal/js_ast/js_ast_helpers.go	325	return left // Definitely not null or undefined	CODE
MEDIUM	internal/js_ast/js_ast_helpers.go	328	return PrimitiveMixed // Definitely some kind of primitive	CODE
MEDIUM	internal/graph/meta.go	69	// using 'export type'." But we try to be robust to such code anyway.	COMMENT
MEDIUM	internal/js_parser/ts_parser.go	928	// expensive, and likely not as robust.	COMMENT
MEDIUM	internal/js_parser/js_parser.go	18659	// could therefore be processed by these buggy tools, it's more robust to put	COMMENT
MEDIUM	scripts/esbuild.js	281	// So we have to make our tests extra robust so they can still work with random	COMMENT

Hyper-Verbose Identifiers12 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	scripts/js-api-tests.js	7541	function registerClassPrivateTests(target) {	CODE
LOW	scripts/destructuring-fuzzer.js	182	function FunctionStatementArguments([pattern, value, ids]) {	CODE
LOW	scripts/destructuring-fuzzer.js	188	function FunctionExpressionArguments([pattern, value, ids]) {	CODE
LOW	scripts/destructuring-fuzzer.js	206	function ClassStatementMethodArguments([pattern, value, ids]) {	CODE
LOW	scripts/destructuring-fuzzer.js	212	function ClassExpressionMethodArguments([pattern, value, ids]) {	CODE
LOW	scripts/plugin-tests.js	36	function fetchUntilSuccessOrTimeout(host, port, path) {	CODE
LOW	scripts/browser/index.html	29	async function assertSameColorsWithNestingTransform(esbuild, { css, html }) {	CODE
LOW	lib/shared/common.ts	12	function validateAndJoinStringArray(values: string[], what: string): string {	CODE
LOW	lib/shared/common.ts	12	function validateAndJoinStringArray(values: string[], what: string): string {	CODE
LOW	lib/shared/common.ts	94	export function validateInitializeOptions(options: types.InitializeOptions): types.InitializeOptions {	CODE
LOW	lib/npm/node-platform.ts	57	export function pkgAndSubpathForCurrentPlatform(): { pkg: string, subpath: string, isWASM: boolean } {	CODE
LOW	lib/npm/node-install.ts	166	function applyManualBinaryPathOverride(overridePath: string): void {	CODE

Example Usage Blocks7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	internal/js_parser/js_parser.go	12014	// Example usage:	COMMENT
LOW	pkg/cli/cli.go	4	// Example usage:	COMMENT
LOW	pkg/cli/cli.go	44	// Example usage:	COMMENT
LOW	pkg/cli/cli.go	66	// Example usage:	COMMENT
LOW	pkg/cli/cli.go	89	// Example usage:	COMMENT
LOW	pkg/api/api.go	15	// Example usage:	COMMENT
LOW	pkg/api/api.go	46	// Example usage:	COMMENT

evanw/esbuild

Open-Source Code Quality, Security and Technical Debt Review