AI Slop Code Risk Monitor

facebook/flow

SlopCodeMonitor badge for facebook/flow Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Adds static typing to JavaScript to improve developer productivity and code quality.

0.6 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for facebook/flow, a Rust project with 22,304 GitHub stars. SynthScan examined 1,633,621 lines of code across 15104 source files, recording 815 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 0.6 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

0.6
Adjusted Signal
0.6
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
22.3K
Stars
Rust
Language
1.6M
Lines of Code
15.1K
Files
815
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 791 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 10 finding(s).

Agent Over-Engineering Ratio 1.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 273 finding(s).

PR Review Velocity Impact 2.7/100 · LOW

Which changes need focused human review? 815 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 9MEDIUM 13LOW 792

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 815 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block505 hits · 504 pts
SeverityFileLineSnippetContext
LOWruntests.sh1#!/bin/bashCOMMENT
LOWevals/run_swebench.py261 remaining = deadline - time.monotonic()COMMENT
LOWevals/graders/no_any.sh1#!/bin/bashCOMMENT
LOWevals/graders/flow_check.sh1#!/bin/bashCOMMENT
LOWevals/graders/no_tsc.sh1#!/bin/bashCOMMENT
LOWevals/graders/file_modified.sh1#!/bin/bashCOMMENT
LOWevals/graders/no_commonjs.sh1#!/bin/bashCOMMENT
LOWevals/graders/ast_query.sh1#!/bin/bashCOMMENT
LOWevals/graders/no_flowfixme.sh1#!/bin/bashCOMMENT
LOWevals/graders/file_contains.sh1#!/bin/bashCOMMENT
LOWevals/graders/contains_ast_node_type.sh1#!/bin/bashCOMMENT
LOWevals/graders/no_extra_flow_errors.sh1#!/bin/bashCOMMENT
LOWevals/graders/no_extra_flow_errors.sh21# `./flow check . | head` reports success even when Flow found errors.COMMENT
LOWevals/graders/file_not_modified.sh1#!/bin/bashCOMMENT
LOWtslib/lib.es2018.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es2016.d.ts21/// <reference lib="es2016.array.include" />COMMENT
LOWtslib/lib.es2020.d.ts21/// <reference lib="es2020.bigint" />COMMENT
LOWtslib/lib.es2020.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es2021.d.ts21/// <reference lib="es2021.promise" />COMMENT
LOWtslib/lib.es2017.d.ts21/// <reference lib="es2017.arraybuffer" />COMMENT
LOWtslib/lib.es2019.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es2021.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es6.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.esnext.d.ts21/// <reference lib="esnext.intl" />COMMENT
LOWtslib/lib.es2024.d.ts21/// <reference lib="es2024.arraybuffer" />COMMENT
LOWtslib/lib.es2022.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es2017.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es2024.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es2018.d.ts21/// <reference lib="es2018.asynciterable" />COMMENT
LOWtslib/lib.esnext.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es2023.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es2022.d.ts21/// <reference lib="es2022.array" />COMMENT
LOWtslib/lib.es2016.full.d.ts21/// <reference lib="dom" />COMMENT
LOWtslib/lib.es2023.d.ts21/// <reference lib="es2023.array" />COMMENT
LOWtslib/lib.es2019.d.ts21/// <reference lib="es2019.array" />COMMENT
LOWtslib/lib.es2015.d.ts21/// <reference lib="es2015.core" />COMMENT
LOWtests/fs.sh1#!/bin/bashCOMMENT
LOWtests/type_at_pos_types/recursive.js41// The following exhibits a use of the RemoveTopLevelTvarVisitorCOMMENT
LOWtests/suppress_unused_lazy_3/test.sh1#!/bin/bashCOMMENT
LOWtests/recheck_commit_deadlock/test.sh1#!/bin/bashCOMMENT
LOWtests/import_typeof/import_typeof.js81(() => {}) as functionFoo4T; // Error: return types are not compatibleCOMMENT
LOWtests/rust_port_flowset_clear/test.js1// Regression test for FlowSet::clear() destroying speculation levels.COMMENT
LOWtests/jsx_pragma/invalid_jsx_unsupported.js1// @jsx (x)=>xCOMMENT
LOWtests/jsx_pragma/invalid_no_expr.js1// @jsxCOMMENT
LOWtests/lint_severity_vim/test.sh1#!/bin/bashCOMMENT
LOWtests/hook_syntax_compatibility/rules_of_hooks.js1041/* [classError('use')] */COMMENT
LOWtests/hook_syntax_compatibility/rules_of_hooks.js1061// },COMMENT
LOWtests/type_spread/inline.js21// Ensuring we still error in these cases when the RHS is a spreadCOMMENT
LOWtests/type_at_pos_statement/test.sh1#!/bin/bashCOMMENT
LOWtests/type_at_pos_match_pattern/test.sh1#!/bin/bashCOMMENT
LOWtests/lint_flag_redundant/test.sh1#!/bin/bashCOMMENT
LOW…sts/saved_state_reinit_libdef_change_mergebase/test.sh1#!/bin/bashCOMMENT
LOWtests/suppress_unused_lazy_2/test.sh1#!/bin/bashCOMMENT
LOWtests/recheck_cancel_optional_chain/test.sh1#!/bin/bashCOMMENT
LOWtests/recheck_cancel_optional_chain/test.sh21# Generate a file whose check spends many seconds inside a SINGLE optional-chainCOMMENT
LOWtests/spread_performance/type_spread.js1//@flowCOMMENT
LOWtests/type_at_pos_template_literal/test.sh1#!/bin/bashCOMMENT
LOWtests/cli_renderer_not_all/test.sh1#!/bin/bashCOMMENT
LOWtests/type_at_pos_namespace/test.sh1#!/bin/bashCOMMENT
445 more matches not shown…
Hyper-Verbose Identifiers259 hits · 287 pts
SeverityFileLineSnippetContext
LOWevals/run_swebench.py226def _registered_process_group(proc):CODE
LOWevals/compile_swebench.py407def compile_project_pattern_evals(project_dir, flow_version):CODE
LOW…01_error_fixing/error_008_indexer_access/input/main.js18function getOrDefault(dict: Map<string, number>, key: string, defaultVal: number): number {CODE
LOW…01_error_fixing/error_008_indexer_access/ideal/main.js21function getOrDefault(dict: Map<string, number>, key: string, defaultVal: number): number {CODE
LOWwebsite/docusaurus.config.js39 function polyfillNodeBuiltinsForFlowJS(context, options) {CODE
LOWwebsite/docusaurus.config.js66 function enableSomeEnvVarsAsBuildTimeConstants() {CODE
LOWwebsite/libs/lz-string.js11 declare export function decompressFromEncodedURIComponent(s: string): string;CODE
LOWwebsite/libs/lz-string.js12 declare export function compressToEncodedURIComponent(s: string): string;CODE
LOWwebsite/src/try-flow/TryFlow.js94function getRecoverableStateFromStorage(): ?InitialStateFromHash {CODE
LOWwebsite/src/try-flow/flow-loader.js251function normalizeFlowReleaseVersion(version: string): string {CODE
LOWwebsite/src/try-flow/tokens-theme-provider.js52function generateTokensCSSForColorMap(colorMap) {CODE
LOWwebsite/src/theme/Navbar/MobileSidebar/Header/index.js38export default function NavbarMobileSidebarHeader(): React.Node {CODE
LOW⚡tests/hook_syntax_compatibility/syntax_compatibility.js5export function useHooklikeAnnotatedFunction(): void { }CODE
LOW⚡tests/hook_syntax_compatibility/syntax_compatibility.js7function useHooklikeInferredFunction() { return 42; }CODE
LOW⚡tests/hook_syntax_compatibility/syntax_compatibility.js9declare export function useDeclaredHooklikeFunction(): number;CODE
LOW⚡tests/hook_syntax_compatibility/rules_of_hooks.js51function normalFunctionWithNormalFunction() {CODE
LOW⚡tests/hook_syntax_compatibility/rules_of_hooks.js56function normalFunctionWithConditionalFunction() {CODE
LOW⚡tests/hook_syntax_compatibility/rules_of_hooks.js64function functionThatStartsWithUseButIsntAHook() {CODE
LOWtests/hook_syntax_compatibility/rules_of_hooks.js746function normalFunctionWithConditionalHook() {CODE
LOWtests/assertion_functions_lib/test.js29function refinesDiscriminantAgainstLocalConst(): boolean {CODE
LOWtests/assertion_functions_lib/test.js37function refinesDiscriminantAgainstImportedConst(): boolean {CODE
LOWtests/assertion_functions_lib/test.js108function reproSequentialMemberNull(field: {a: ?string, b: ?string, c: ?string}): string {CODE
LOWtests/invariant/arg_order.js4function laterArgReassignsRefinedBinding(y: unknown, z: number): void {CODE
LOW⚡tests/invariant/arg_order.js16function laterArgReadUsesRefinedEnv(x: unknown): void {CODE
LOW⚡tests/invariant/arg_order.js26function laterArgWritesValueReadEarlier(value: ?number): void {CODE
LOW⚡tests/invariant/arg_order.js33function laterArgAssignsValueReadEarlier(): void {CODE
LOWtests/refinements/computed_string_literal.js29function testSwitchLiteralProperty(b: B) {CODE
LOWtests/refinements/typeof.js59function testInvalidTemplateLiteral(x: string | number) {CODE
LOWtests/refinements/typeof.js101function testAnyWithNumberPostConditional(x: any) {CODE
LOWtests/refinements/typeof.js132function testPolyClassCtorWithFunction() {CODE
LOW⚡tests/assertion_functions_jest/test.js21function reproNeverReturnsInReturn(): empty {CODE
LOW⚡tests/assertion_functions_jest/test.js27function reproNeverReturnsInReturnWithMessage(): string {CODE
LOW⚡tests/assertion_functions_jest/test.js33function reproNeverReturnsInNestedTernary(level: string): string {CODE
LOW⚡tests/assertion_functions_jest/test.js39function sequenceExpressionAsserts(value: ?number): number {CODE
LOWtests/assertion_functions_jest/test.js51function expressionPositionHavocsRefinements(object: {property: ?string}) {CODE
LOWtests/assertion_functions/consistency.js56function switchWithThrowingDefault(value: 'a' | 'b' | 'c'): asserts value is 'a' | 'b' {CODE
LOWtests/assertion_functions/local.js64function inferredAliasesAreAssertions(CODE
LOW⚡tests/assertion_functions/local.js93function bareFalseStillChecksArgumentTypes(): void {CODE
LOW⚡tests/assertion_functions/local.js97function bareFalseStillChecksArity(): void {CODE
LOW⚡tests/assertion_functions/local.js101function bareMissingArgumentIsReachable(): number {CODE
LOW⚡tests/assertion_functions/local.js106function bareDefaultedMissingArgumentIsReachable(): number {CODE
LOW⚡tests/assertion_functions/local.js111function bareDefaultedMissingArgumentDoesNotEndSequence(): void {CODE
LOWtests/assertion_functions/local.js128function bareFalseClosesBranchInLoop(values: Array<?string>): void {CODE
LOWtests/assertion_functions/local.js143function expressionPositionDoesNotAssert(value: unknown) {CODE
LOWtests/assertion_functions/local.js191function unannotatedBodyLocalSilent(value: unknown) {CODE
LOWtests/assertion_functions/local.js206function assertionInLoopPreservesPreLoopNarrowing(input: unknown, c: boolean) {CODE
LOWtests/assertion_functions/local.js290function unannotatedParameterSilent(cb, value: unknown) { // error: missing annotation on cbCODE
LOWtests/assertion_functions/local.js319function bareFalseWithTargsIsAbrupt(): number {CODE
LOW⚡tests/assertion_functions/imports.js84function importedAgreedUnionSilent(value: unknown) {CODE
LOW⚡tests/assertion_functions/imports.js90function importedGenericApplication(value: unknown) {CODE
LOW⚡tests/assertion_functions/imports.js96function inferredExportsAreAssertions(CODE
LOWtests/assertion_functions/arg_order.js10function laterArgReassignsAssertedBinding(x: unknown, y: number) {CODE
LOWtests/assertion_functions/arg_order.js27function laterArgHavocsAssertedBinding(): void {CODE
LOW⚡tests/assertion_functions/arg_order.js39function earlierArgWriteStillRefines(x: unknown, w: unknown) {CODE
LOW⚡tests/assertion_functions/arg_order.js45function laterArgReadUsesUnrefinedEnv(x: unknown) {CODE
LOW⚡tests/assertion_functions/arg_order.js53function laterArgMemberReadUsesUnrefinedEnv(x: {name: unknown}) {CODE
LOW⚡tests/assertion_functions/arg_order.js58function laterArgReadUsesUnrefinedEnvBare(x: string | null) {CODE
LOW⚡tests/assertion_functions/arg_order.js63function laterArgWritesOtherBindingFromAsserted(y: unknown, x: unknown) {CODE
LOW⚡tests/assertion_functions/arg_order.js73function laterMessageReadsNullableValue(value: ?{name: string}): string {CODE
LOWtests/assertion_functions/arg_order.js87function laterMessageReadsUnrefinedDiscriminatedUnion(prop: JSXProp): boolean {CODE
199 more matches not shown…
Empty Error Handlers5 hits · 25 pts
SeverityFileLineSnippetContext
HIGHevals/run_swebench.py208except subprocess.TimeoutExpired:CODE
HIGHevals/run_swebench.py433except Exception:CODE
HIGHevals/run_swebench.py257except subprocess.TimeoutExpired:CODE
HIGHevals/run_swebench.py304except (ProcessLookupError, PermissionError):CODE
HIGHevals/test_dry_run.py49except Exception:CODE
Cross-Language Confusion (JS/TS)3 hits · 15 pts
SeverityFileLineSnippetContext
HIGHtests/union_new/issue-1462-i.js21 print(val.foo); // <--- foo could be an arrayCODE
HIGHtests/union_new/issue-1462-ii.js23 print(val.foo);CODE
HIGHpackages/flow-transform/src/transform/print.js79 print(CODE
AI Slop Vocabulary4 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUM…_port/crates/flow_typing_flow_common/src/flow_cache.rs63 // corresponding typing rules are already sufficiently robust.COMMENT
MEDIUM…/crates/flow_env_builder_resolver/src/name_resolver.rs3710 // possibly undefined variable. Essentially, we are treating var redeclaration as aCOMMENT
MEDIUMpackages/flow-parser/__tests__/runContractTests.sh39# same `$WASM_OUT` (the JS test harness `require()`s a hard-codedCOMMENT
MEDIUMnewtests/lsp/diagnostics/test.js29 // To be robust against races: we'll wait up to 9s to get theCOMMENT
Excessive Try-Catch Wrapping7 hits · 10 pts
SeverityFileLineSnippetContext
LOWevals/run_swebench.py433 except Exception:CODE
MEDIUMevals/run_swebench.py756 print(f"Error: Flow binary not found at {args.flow_bin}", file=sys.stderr)CODE
LOWevals/run_swebench.py852 except Exception as e:CODE
MEDIUMevals/run_swebench.py87def _register_proc(proc):CODE
LOWevals/test_dry_run.py49 except Exception:CODE
LOWevals/test_dry_run.py85except Exception as exc:CODE
MEDIUMevals/compile_swebench.py624 print(f"Error: {evals_dir} is not a directory", file=sys.stderr)CODE
Hallucination Indicators1 hit · 10 pts
SeverityFileLineSnippetContext
CRITICALrust_port/crates/flow_env_builder/src/name_def.rs1688 Def::TypeParam(data) => DefinitionReferenceKind::Name(data.tparam.1.name.name.dupe()),CODE
Self-Referential Comments3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMevals/run_swebench.py176 # Create a wrapper script so `./flow` works in the temp dirCOMMENT
MEDIUMtests/assertion_call_analysis_saved_state/test.sh7# Create a saved state without test.js, then restore the file without reportingCOMMENT
MEDIUMpackages/scripts/build.sh81 # Create a new file with .js.flow extensionCOMMENT
AI Response Leakage1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHwebsite/blog/2015-02-18-Import-Types.md67### Wait, but what happens at runtime after I've added an `import type` declaration?COMMENT
Deep Nesting7 hits · 7 pts
SeverityFileLineSnippetContext
LOWevals/run_swebench.py322CODE
LOWevals/run_swebench.py482CODE
LOWevals/run_swebench.py649CODE
LOWevals/run_swebench.py814CODE
LOWevals/compile_swebench.py98CODE
LOWevals/compile_swebench.py152CODE
LOWevals/compile_swebench.py407CODE
Decorative Section Separators2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMevals/compile_swebench.py36# ---------------------------------------------------------------------------COMMENT
MEDIUMevals/compile_swebench.py48# ---------------------------------------------------------------------------COMMENT
Fake / Example Data6 hits · 6 pts
SeverityFileLineSnippetContext
LOW…01_error_fixing/error_005_array_variance/input/main.js40 addPlaceholder(videos, {id: 'placeholder', url: '/placeholder.png'});CODE
LOW…01_error_fixing/error_005_array_variance/ideal/main.js41 addPlaceholder(videos, {id: 'placeholder', url: '/placeholder.png'});CODE
LOWtests/custom_errors/imported.js21const emailTest1: Email = "user@example.com"; // OKCODE
LOWtests/custom_errors/imported.js164 email: "user@example.com",CODE
LOWrust_port/crates/flow_common_ty/src/ty_printer.rs529 AnyKind::Placeholder => "placeholder",CODE
LOWrust_port/crates/flow_type_sig/src/type_sig_parse.rs3543 def: tbls.lazy(Box::new(|_, _, _| unreachable!("placeholder"))),CODE
Verbosity Indicators3 hits · 4 pts
SeverityFileLineSnippetContext
LOWrust_port/crates/flow_parser_wasm/src/position.rs76 // Step 1: Build line-start byte offset table and parallel UTF-16 offset table.COMMENT
LOWrust_port/crates/flow_parser_wasm/src/position.rs137 // Step 2: Compute byte_offset for each position and sort.COMMENT
LOWrust_port/crates/flow_parser_wasm/src/position.rs162 // Step 3: Single-pass through source text computing UTF-16 offsets.COMMENT
Structural Annotation Overuse3 hits · 4 pts
SeverityFileLineSnippetContext
LOWrust_port/crates/flow_parser_wasm/src/position.rs76 // Step 1: Build line-start byte offset table and parallel UTF-16 offset table.COMMENT
LOWrust_port/crates/flow_parser_wasm/src/position.rs137 // Step 2: Compute byte_offset for each position and sort.COMMENT
LOWrust_port/crates/flow_parser_wasm/src/position.rs162 // Step 3: Single-pass through source text computing UTF-16 offsets.COMMENT
Slop Phrases2 hits · 4 pts
SeverityFileLineSnippetContext
LOW…t_port/crates/flow_parser_utils/src/flow_ast_differ.rs2534 // We keep this so that we don't forget to create handlers above when we add new AST nodes.COMMENT
MEDIUMnewtests/tool_test_example/test.js31 // And here is how you can assert that a step introduces new flow errors. ICOMMENT
Overly Generic Function Names2 hits · 2 pts
SeverityFileLineSnippetContext
LOWtests/hook_syntax_compatibility/rules_of_hooks.js12declare function doSomething(): voidCODE
LOWtests/hook_syntax/rules_of_hooks.js12declare function doSomething(): voidCODE
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOWpackages/scripts/build.sh79 # Check if file contains flow annotationCOMMENT
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippetContext
LOWpackages/scripts/runOxidizedJestTests.sh11# Usage:COMMENT