1.1

Adjusted Signal

1.1

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

6.9K

Stars

Language

331.7K

Lines of Code

1.5K

Files

294

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 250 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.5/100 · LOW

Are imports declared and package/API names verified? 31 finding(s).

Agent Over-Engineering Ratio 0.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 13 finding(s).

PR Review Velocity Impact 5.0/100 · LOW

Which changes need focused human review? 294 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 19LOW 274

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 294 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block216 hits · 216 pts

Severity	File	Line	Snippet	Context
LOW	…xternalsecrets/v1/secretstore_onepassword_sdk_types.go	41	// CacheConfig configures client-side caching for read operations.	COMMENT
LOW	…xternalsecrets/v1/secretstore_onepassword_sdk_types.go	61	// Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically.	COMMENT
LOW	…v1/secretstore_beyondtrustworkloadcredentials_types.go	21	)	COMMENT
LOW	…v1/secretstore_beyondtrustworkloadcredentials_types.go	41	}	COMMENT
LOW	…v1/secretstore_beyondtrustworkloadcredentials_types.go	61		COMMENT
LOW	…v1/secretstore_beyondtrustworkloadcredentials_types.go	81	// Example: "production/database" or "dev/api-keys"	COMMENT
LOW	apis/externalsecrets/v1/secretstore_conjur_types.go	21	// ConjurProvider provides access to a Conjur provider.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_conjur_types.go	41		COMMENT
LOW	apis/externalsecrets/v1/secretstore_conjur_types.go	61		COMMENT
LOW	apis/externalsecrets/v1/secretstore_conjur_types.go	121	// The conjur authn cert webservice id	COMMENT
LOW	apis/externalsecrets/v1/secretstore_conjur_types.go	141	// It uses the AWS STS GetCallerIdentity endpoint to authenticate.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_conjur_types.go	181	}	COMMENT
LOW	apis/externalsecrets/v1/secretstore_conjur_types.go	201	// managed identities; omit for system-assigned identities.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_conjur_types.go	221	// ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").	COMMENT
LOW	apis/externalsecrets/v1/secretstore_ovh_types.go	21	// OvhProvider holds the configuration to synchronize secrets with OVHcloud's Secret Manager.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_kubernetes_types.go	41	// configures the Kubernetes server Address.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_gcpsm_types.go	81	// SecretVersionSelectionPolicy specifies how the provider selects a secret version	COMMENT
LOW	apis/externalsecrets/v1/secretstore_gcpsm_types.go	101	// +kubebuilder:validation:Optional	COMMENT
LOW	apis/externalsecrets/v1/secretstore_gcpsm_types.go	121	// GCPServiceAccountEmail is the email of the Google Cloud service account to impersonate	COMMENT
LOW	apis/externalsecrets/v1/secretstore_gcpsm_types.go	141	Name string `json:"name"`	COMMENT
LOW	apis/externalsecrets/v1/secretstore_gcpsm_types.go	161	// +kubebuilder:validation:MinLength:=1	COMMENT
LOW	apis/externalsecrets/v1/secretstore_gcpsm_types.go	181	// +kubebuilder:validation:MaxLength:=253	COMMENT
LOW	apis/externalsecrets/v1/secretstore_crd_types.go	21	)	COMMENT
LOW	apis/externalsecrets/v1/secretstore_crd_types.go	41	// +kubebuilder:validation:MinLength=1	COMMENT
LOW	apis/externalsecrets/v1/secretstore_crd_types.go	61	// +optional	COMMENT
LOW	apis/externalsecrets/v1/secretstore_crd_types.go	81	//	COMMENT
LOW	apis/externalsecrets/v1/secretstore_crd_types.go	101	// Server configures the Kubernetes API address and TLS trust, same as the	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	41	// "secret". The v2 KV secret engine version specific "/data" path suffix	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	61	// if the Server URL is using HTTPS protocol. This parameter is ignored for	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	81	// More information about eventual consistency in Vault can be found here	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	101	CheckAndSet *VaultCheckAndSet `json:"checkAndSet,omitempty"`	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	121	// Only one of `tokenSecretRef`, `appRole`, `kubernetes`, `ldap`, `userPass`, `jwt`, `cert`, `iam` or `gcp`	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	141	// Kubernetes authenticates with Vault by passing the ServiceAccount	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	161	// Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	181	// +kubebuilder:default=approle	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	201	}	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	221	// the controller will be used.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	241		COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	281	}	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	301	// Deprecated: this will be removed in the future.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	321	// Optional SecretRef that refers to a key in a Secret resource containing JWT token to	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	341	// VaultRole specifies the Vault role to use for TLS certificate authentication.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	361	// Path where the AWS auth method is enabled in Vault, e.g: "aws"	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	381	// +optional	COMMENT
LOW	apis/externalsecrets/v1/secretstore_vault_types.go	401	SecretRef esmeta.SecretKeySelector `json:"secretRef,omitempty"`	COMMENT
LOW	apis/externalsecrets/v1/secretstore_doppler_types.go	61	// DopplerProvider configures a store to sync secrets using the Doppler provider.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_types.go	41		COMMENT
LOW	apis/externalsecrets/v1/secretstore_types.go	181	// CRD configures this store to sync secrets from arbitrary Kubernetes resources,	COMMENT
LOW	apis/externalsecrets/v1/secretstore_types.go	221	// Delinea DevOps Secrets Vault	COMMENT
LOW	apis/externalsecrets/v1/secretstore_types.go	301	// CAProvider provides a custom certificate authority for accessing the provider's store.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_types.go	381	SecretStoreReadWrite SecretStoreCapabilities = "ReadWrite"	COMMENT
LOW	apis/externalsecrets/v1/secretstore_oracle_types.go	41		COMMENT
LOW	apis/externalsecrets/v1/clusterexternalsecret_types.go	41	// The labels to select by to find the Namespaces to create the ExternalSecrets in.	COMMENT
LOW	apis/externalsecrets/v1/clusterexternalsecret_types.go	101	// ExternalSecretName is the name of the ExternalSecrets created by the ClusterExternalSecret	COMMENT
LOW	apis/externalsecrets/v1/secretstore_aws_types.go	61	AWSServiceSecretsManager AWSServiceType = "SecretsManager"	COMMENT
LOW	apis/externalsecrets/v1/secretstore_aws_types.go	141		COMMENT
LOW	apis/externalsecrets/v1/secretstore_dvls_types.go	21	)	COMMENT
LOW	apis/externalsecrets/v1/secretstore_openbao_types.go	41	//	COMMENT
LOW	apis/externalsecrets/v1/secretstore_openbao_types.go	61	// Server is the connection address for the OpenBao server, e.g: `https://openbao.example.com:8200`.	COMMENT
LOW	apis/externalsecrets/v1/secretstore_openbao_types.go	81	// OpenBaoAuth is the configuration used to authenticate with an OpenBao server.	COMMENT
156 more matches not shown…

Decorative Section Separators13 hits · 45 pts

Severity	File	Line	Snippet	Context
MEDIUM	providers/v1/crd/crd_test.go	38	// ── test doubles ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	providers/v1/crd/crd_test.go	55	// ── helpers ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	providers/v1/crd/crd_test.go	158	// ── tests ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	e2e/k8s/vault-config/configure-vault.sh	6	# ------------------	COMMENT
MEDIUM⚡	e2e/k8s/vault-config/configure-vault.sh	8	# ------------------	COMMENT
MEDIUM⚡	e2e/k8s/vault-config/configure-vault.sh	12	# ------------------	COMMENT
MEDIUM⚡	e2e/k8s/vault-config/configure-vault.sh	15	# ------------------	COMMENT
MEDIUM	e2e/k8s/vault-config/configure-vault.sh	38	# ------------------	COMMENT
MEDIUM	e2e/k8s/vault-config/configure-vault.sh	41	# ------------------	COMMENT
MEDIUM	e2e/k8s/vault-config/configure-vault.sh	53	# ------------------	COMMENT
MEDIUM	e2e/k8s/vault-config/configure-vault.sh	56	# ------------------	COMMENT
MEDIUM	e2e/k8s/vault-config/configure-vault.sh	87	# ------------------	COMMENT
MEDIUM	e2e/k8s/vault-config/configure-vault.sh	90	# ------------------	COMMENT

Fake / Example Data30 hits · 30 pts

Severity	File	Line	Snippet	Context
LOW	providers/v1/beyondtrust/provider_test.go	423	_, err := w.Write([]byte(`{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`))	CODE
LOW	providers/v1/beyondtrust/provider_test.go	462	_, err := w.Write([]byte(`{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`))	CODE
LOW	providers/v1/beyondtrust/provider_test.go	502	_, err := w.Write([]byte(`{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`))	CODE
LOW	providers/v1/beyondtrust/provider_test.go	541	_, err := w.Write([]byte(`{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`))	CODE
LOW	providers/v1/beyondtrust/provider_test.go	581	_, err := w.Write([]byte(`{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`))	CODE
LOW	providers/v1/beyondtrust/provider_test.go	622	_, err := w.Write([]byte(`{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`))	CODE
LOW	providers/v1/beyondtrust/provider_test.go	662	_, err := w.Write([]byte(`{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`))	CODE
LOW	providers/v1/beyondtrust/provider_test.go	789	_, err := w.Write([]byte(`{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`))	CODE
LOW	providers/v1/beyondtrust/provider_test.go	814	_, err := w.Write([]byte(`{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`))	CODE
LOW	providers/v1/beyondtrust/provider_test.go	914	writeBody(t, w, `{"access_token": "fake_token", "expires_in": 600, "token_type": "Bearer"}`)	CODE
LOW	providers/v1/gcp/secretmanager/client_test.go	511	ref := testingfake.PushSecretData{RemoteKey: "fake-key"}	CODE
LOW	providers/v1/ibm/provider_test.go	1408	Key: "fake-key",	CODE
LOW	providers/v1/ibm/provider_test.go	1427	"fake-key": []byte("ImAFakeApiKey"),	CODE
LOW	providers/v1/aws/secretsmanager/secretsmanager_test.go	74	fakeKey = "fake-key"	CODE
LOW	providers/v1/aws/parameterstore/parameterstore_test.go	290	const remoteKey = "fake-key"	CODE
LOW	providers/v1/aws/parameterstore/parameterstore_test.go	351	assert.Equal(t, "/external-secrets/parameters/fake-key", input.ResourceId)	CODE
LOW	providers/v1/aws/parameterstore/parameterstore_test.go	709	assert.Equal(t, "/test/this/thing/fake-key", *input.Name)	CODE
LOW	providers/v1/conjur/fake/fake.go	124	"value": "Lorem ipsum dolor sit amet",	CODE
LOW	providers/v1/conjur/fake/fake.go	124	"value": "Lorem ipsum dolor sit amet",	CODE
LOW	providers/v1/vault/client_push_test.go	35	fakeKey = "fake-key"	CODE
LOW	providers/v1/vault/client_push_test.go	868	val = []byte(`{"fake-key":"fake-value"}`)	CODE
LOW	runtime/template/v2/pem_test.go	415	want: []string{"example.com", "www.example.com", "192.168.1.10", "10.0.0.1", "admin@example.com", "https://example.co	CODE
LOW	runtime/esutils/utils_test.go	1467	if claims["name"] != "John Doe" {	CODE
LOW	runtime/esutils/utils_test.go	1468	t.Errorf("Expected name claim to be 'John Doe', got %v", claims["name"])	CODE
LOW	docs/snippets/generator-fake.yaml	4	name: fake-key	CODE
LOW	docs/snippets/generator-fake-example.yaml	14	name: "fake-key"	CODE
LOW	docs/snippets/generator-sshkey.yaml	7	comment: "user@example.com"	CODE
LOW	generators/v1/cloudsmith/cloudsmith_test.go	147	if claims["name"] != "John Doe" {	CODE
LOW	generators/v1/cloudsmith/cloudsmith_test.go	148	t.Errorf("Expected name claim to be 'John Doe', got %v", claims["name"])	CODE
LOW	e2e/framework/addon/infisical.go	51	infisicalAdminEmail = "admin@example.com"	CODE

Structural Annotation Overuse17 hits · 26 pts

Severity	File	Line	Snippet	Context
LOW	docs/snippets/cluster-external-secret-fanout.yaml	2	# Step 1: A single ExternalSecret pulls from the upstream provider.	COMMENT
LOW	docs/snippets/cluster-external-secret-fanout.yaml	19	# Step 2: ClusterSecretStore reads the source Secret via the Kubernetes provider.	COMMENT
LOW	docs/snippets/cluster-external-secret-fanout.yaml	39	# Step 3: ClusterExternalSecret fans the Secret out to matching namespaces.	COMMENT
LOW	docs/provider/conjur.md	36	#### Step 1: Define an external secret store	COMMENT
LOW	docs/provider/conjur.md	45	#### Step 2: Create Kubernetes secrets for Secrets Manager credentials	COMMENT
LOW	docs/provider/conjur.md	66	#### Step 3: Create the external secrets store	COMMENT
LOW	docs/provider/conjur.md	89	#### Step 1: Define an external secret store	COMMENT
LOW	docs/provider/conjur.md	123	#### Step 2: Create the external secrets store	COMMENT
LOW	docs/provider/conjur.md	142	#### Step 1: Define an external secret store	COMMENT
LOW	docs/provider/conjur.md	156	#### Step 2: Create Kubernetes secrets for the client certificate and key	COMMENT
LOW	docs/provider/conjur.md	172	#### Step 3: Create the external secrets store	COMMENT
LOW	docs/provider/conjur.md	210	#### Step 1: Define an external secret store	COMMENT
LOW	docs/provider/conjur.md	216	#### Step 2: Create the external secrets store	COMMENT
LOW	docs/provider/conjur.md	233	#### Step 1: Define an external secret store (ambient IMDS)	COMMENT
LOW	docs/provider/conjur.md	245	#### Step 2: Create the external secrets store	COMMENT
LOW	docs/provider/conjur.md	267	#### Step 1: Define an external secret store (ambient GCP Metadata Service)	COMMENT
LOW	docs/provider/conjur.md	279	#### Step 2: Create the external secrets store	COMMENT

Self-Referential Comments4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	terraform/aws/infrastructure/modules/cluster/irsa.tf	20	# Create the IAM policy document for SSM Parameter Store access	COMMENT
MEDIUM	terraform/aws/infrastructure/modules/cluster/irsa.tf	38	# Create the IAM policy document for ACM access	COMMENT
MEDIUM	hack/api-docs/add_eso_version.sh	41	# Create the new line to insert	COMMENT
MEDIUM	hack/api-docs/add_eso_version.sh	44	# Create a temporary file	COMMENT

Redundant / Tautological Comments4 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW⚡	hack/api-docs/add_eso_version.sh	6	# Set ROOT to the repository root (two levels up from this script)	COMMENT
LOW⚡	hack/api-docs/add_eso_version.sh	9	# Check if all required arguments are provided	COMMENT
LOW⚡	hack/api-docs/add_eso_version.sh	16	# Assign parameters to variables	COMMENT
LOW⚡	hack/api-docs/add_eso_version.sh	25	# Check if the file exists	COMMENT

Magic Placeholder Names1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	docs/provider/infisical.md	497	fingerprint: <your-api-key-fingerprint>	CODE

Verbosity Indicators3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	docs/snippets/cluster-external-secret-fanout.yaml	2	# Step 1: A single ExternalSecret pulls from the upstream provider.	COMMENT
LOW	docs/snippets/cluster-external-secret-fanout.yaml	19	# Step 2: ClusterSecretStore reads the source Secret via the Kubernetes provider.	COMMENT
LOW	docs/snippets/cluster-external-secret-fanout.yaml	39	# Step 3: ClusterExternalSecret fans the Secret out to matching namespaces.	COMMENT

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	terraform/gcp/infrastructure/main.tf	23	# e2e test runner which orchestrates the tests	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	providers/v1/yandex/common/sdk.go	65	// and will pass the endpoint to net.Dial as-is, which would utilize happy-eyeballs	COMMENT

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	hack/modfiles.sh	13	# Usage:	COMMENT
LOW	hack/generate-provenance.sh	11	# Usage:	COMMENT

Slop Phrases2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	.github/workflows/pull-request-label.yml	24	# If extended, don't forget to also include it in the verification step verify-labels.	COMMENT
LOW	.github/workflows/pull-request-label.yml	24	# If extended, don't forget to also include it in the verification step verify-labels.	COMMENT

external-secrets/external-secrets

Open-Source Code Quality, Security and Technical Debt Review