Codebase intelligence for TypeScript and JavaScript. Free static analysis of code and styles: unused code, duplication, circular deps, complexity hotspots, architecture boundaries, design-system drift. Optional paid runtime layer (Fallow Runtime): hot-path review and cold-path deletion evidence from real production traffic.
This report presents the forensic synthetic code analysis of fallow-rs/fallow, a Rust project with 4,101 GitHub stars. SynthScan v2.0 examined 747,212 lines of code across 1557 source files, recording 1776 pattern matches distributed across 16 syntactic categories. The overall adjusted score of 2.8 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1776 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/types/Cargo.toml | 21 | COMMENT | |
| LOW | crates/types/src/mcp_manifest.rs | 1 | //! Machine-readable manifest of the tools exposed by the fallow MCP server. | COMMENT |
| LOW | crates/types/src/mcp_manifest.rs | 41 | /// Wire tool name (matches the rmcp `#[tool]` method name). | COMMENT |
| LOW | crates/types/src/mcp_manifest.rs | 421 | /// - `api_runner`: the `fallow_api::run_*` entry point (the in-process Rust API | COMMENT |
| LOW | crates/types/src/mcp_manifest.rs | 441 | pub capability: &'static str, | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 1 | //! Typed envelope wrappers for the simple 1:1 dead-code findings whose | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 101 | pub struct UnusedFileFinding { | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 201 | #[derive(Debug, Clone, Serialize)] | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 261 | /// Wire-shape envelope for a [`CircularDependency`] finding. Mirrors | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 321 | #[cfg_attr(feature = "schema", derive(schemars::JsonSchema))] | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 441 | } | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 641 | #[derive(Debug, Clone, Serialize)] | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 761 | pub struct InvalidClientExportFinding { | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 861 | introduced: None, | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 921 | COMMENT | |
| LOW | crates/types/src/output_dead_code.rs | 961 | COMMENT | |
| LOW | crates/types/src/output_dead_code.rs | 1001 | COMMENT | |
| LOW | crates/types/src/output_dead_code.rs | 1041 | COMMENT | |
| LOW | crates/types/src/output_dead_code.rs | 1081 | COMMENT | |
| LOW | crates/types/src/output_dead_code.rs | 1121 | COMMENT | |
| LOW | crates/types/src/output_dead_code.rs | 1161 | COMMENT | |
| LOW | crates/types/src/output_dead_code.rs | 1201 | } | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 1241 | introduced: None, | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 1281 | wrapper, | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 1301 | /// Suggested next steps. Always emitted (possibly empty for | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 1601 | pub struct UnusedClassMemberFinding { | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 1641 | member, | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 1761 | } | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 1801 | /// `unused-dev-dependency`. | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 1861 | } | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 2041 | } | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 2061 | /// Radix / bits-ui namespace-barrel case where every `index.*` reexports | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 2241 | /// `remove-empty-catalog-group` primary. YAML-sourced findings also include a | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 2301 | COMMENT | |
| LOW | crates/types/src/output_dead_code.rs | 2421 | COMMENT | |
| LOW | crates/types/src/output_dead_code.rs | 2481 | pub struct MisconfiguredDependencyOverrideFinding { | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 2561 | // | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 2841 | assert_eq!( | COMMENT |
| LOW | crates/types/src/output_dead_code.rs | 2941 | ); | COMMENT |
| LOW | crates/types/src/discover.rs | 1 | //! File discovery types: discovered files, file IDs, and entry points. | COMMENT |
| LOW | crates/types/src/discover.rs | 21 | #[derive(Debug, Clone)] | COMMENT |
| LOW | crates/types/src/discover.rs | 41 | /// let id = FileId(42); | COMMENT |
| LOW | crates/types/src/source_fingerprint.rs | 1 | //! Shared source-file fingerprint inputs for cache invalidation. | COMMENT |
| LOW | crates/types/src/lib.rs | 21 | pub mod discover; | COMMENT |
| LOW | crates/types/src/lib.rs | 41 | pub mod mcp_manifest; | COMMENT |
| LOW | crates/types/src/lib.rs | 61 | /// Per-action types attached to health findings, hotspots, refactoring | COMMENT |
| LOW | crates/types/src/lib.rs | 81 | /// Symbol-level trace-chain output contracts. | COMMENT |
| LOW | crates/types/src/results.rs | 41 | /// Total number of entry points detected. | COMMENT |
| LOW | crates/types/src/results.rs | 61 | /// UNDERCOUNT is the documented safe direction: a child rendered via a JSX | COMMENT |
| LOW | crates/types/src/results.rs | 81 | /// `max(p95, 10)` threshold (the same floor coupling concentration uses). | COMMENT |
| LOW | crates/types/src/results.rs | 101 | /// (each capitalized / member JSX tag is one site). SECONDARY context ("incl. | COMMENT |
| LOW | crates/types/src/results.rs | 121 | pub effect: u16, | COMMENT |
| LOW | crates/types/src/results.rs | 141 | /// (source + intermediates + consumer), matching `PropDrillingChain.depth`. | COMMENT |
| LOW | crates/types/src/results.rs | 161 | /// Column of the prop declaration (byte-derived, matching the React | COMMENT |
| LOW | crates/types/src/results.rs | 181 | /// `AnalysisResults::react_component_intel` field (like | COMMENT |
| LOW | crates/types/src/results.rs | 201 | /// the child five times is five sites but one distinct parent. | COMMENT |
| LOW | crates/types/src/results.rs | 221 | /// use std::path::PathBuf; | COMMENT |
| LOW | crates/types/src/results.rs | 241 | pub unused_files: Vec<UnusedFileFinding>, | COMMENT |
| LOW | crates/types/src/results.rs | 261 | /// in [`UnusedDevDependencyFinding`]: same bare struct as | COMMENT |
| LOW | crates/types/src/results.rs | 281 | /// project-wide. Wrapped in [`UnusedStoreMemberFinding`]: same inner | COMMENT |
| 1376 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/types/src/output_dead_code.rs | 2045 | // ── Catalog / dep-override family ─────────────────────────────── | COMMENT |
| MEDIUM | crates/types/src/output_dead_code.rs | 2560 | // ── Position-0 invariant golden tests ─────────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 3837 | // ── total_issues / has_issues consistency ────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 3847 | // ── total_issues counts each category independently ───────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 3878 | // ── default is truly empty ────────────────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 3903 | // ── EntryPointSummary ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 3933 | // ── sort: unused_files by path ────────────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 3959 | // ── sort: unused_exports by path, line, name ──────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4003 | // ── sort: unused_types (same sort as unused_exports) ──────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4026 | // ── sort: unused_dependencies by path, line, name ─────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4052 | // ── sort: unused_dev_dependencies ─────────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4078 | // ── sort: unused_optional_dependencies ────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4183 | // ── sort: unlisted_dependencies + inner imported_from ─────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4233 | // ── sort: duplicate_exports + inner locations ─────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4279 | // ── sort: type_only_dependencies ──────────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4305 | // ── sort: test_only_dependencies ──────────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4331 | // ── sort: circular_dependencies by files, then length ─────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4403 | // ── sort: export_usages + inner reference_locations ───────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4454 | // ── sort: empty results does not panic ────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4463 | // ── sort: single-element lists remain stable ──────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4476 | // ── serialization ────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4732 | // ── clone produces independent copies ─────────────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4751 | // ── export_usages not counted in total_issues ─────────────── | COMMENT |
| MEDIUM | crates/types/src/results.rs | 4769 | // ── entry_point_summary not counted in total_issues ───────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 123 | // ── command-injection (CWE-78), provenance-gated to node:child_process ─────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 158 | // ── code-injection (CWE-94): eval (ungated) + vm (node:vm) ─────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 194 | // ── dynamic-regex (CWE-1333), ungated non-literal pattern construction ────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 424 | // ── sql-injection (CWE-89), ungated (broad tier) ───────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 498 | // ── ssrf (CWE-918), ungated (broad tier) ───────────────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 568 | // ── path-traversal (CWE-22), provenance-gated to node:path ─────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 619 | // ── open-redirect (CWE-601), ungated (broad tier) ──────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 712 | // ── weak-crypto (CWE-327), provenance-gated to node:crypto ─────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 736 | // ── unsafe-deserialization (CWE-502): js-yaml + node-serialize ─────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 766 | // ── prototype-pollution (CWE-1321), ungated (broad tier) ───────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 818 | // ── zip-slip / tar path traversal (CWE-22), ungated (broad tier) ───────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 840 | // ── nosql-injection (CWE-943), ungated (broad tier) ────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 870 | // ── ssti (CWE-1336), ungated (broad tier) ──────────────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 892 | // ── xxe (CWE-611), ungated (broad tier) ────────────────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 914 | // ── issue #882 catalogue-only sinks ───────────────────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 914 | // ── issue #882 catalogue-only sinks ───────────────────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 949 | // ── secret-pii-log (CWE-532), source-backed logging only ──────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 986 | // ── issue #897 catalogue-only sinks (batch 2) ─────────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 986 | // ── issue #897 catalogue-only sinks (batch 2) ─────────────────────────────── | COMMENT |
| MEDIUM | …ests/integration_test/security_catalogue_categories.rs | 1229 | // ── llm-call-injection (CWE-1427), taint-gated (E11) ───────────────────────── | COMMENT |
| MEDIUM | crates/core/data/tooling.toml | 27 | # ── Prefixes: package families where every member is tooling ────────────── | COMMENT |
| MEDIUM | crates/core/data/tooling.toml | 109 | # ── Exact package names ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/security/data/security_matchers.toml | 1013 | # ════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | crates/security/data/security_matchers.toml | 1023 | # ════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM⚡ | crates/security/data/security_matchers.toml | 1025 | # ── Angular: DomSanitizer.bypassSecurityTrust* (CWE-79) ───────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 64 | # ── CWE-79: Dangerous HTML (the proven seed; no provenance needed) ────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 95 | # ── CWE-79: Template escape bypass (issue #897) ───────────────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 113 | # ── CWE-78: OS command injection ──────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 136 | # ── CWE-94/95: Code injection ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 271 | # ── CWE-89: SQL injection ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 312 | # ── CWE-918: SSRF ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 357 | # ── CWE-201: Secret-to-network exfil ───────────────────────────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 388 | # ── CWE-22: Path traversal ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 422 | # ── CWE-113: HTTP response header injection ───────────────────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 443 | # ── CWE-601: Open redirect ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 474 | # ── CWE-346: Wildcard postMessage target origin ───────────────────────────── | COMMENT |
| 109 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | CHANGELOG.md | 2218 | - **Ember.js / Glimmer / Embroider plugin.** New built-in plugin activates on `ember-source`, `ember-cli`, `@embroider/c | CODE |
| MEDIUM | CHANGELOG.md | 2297 | - **Windows fallow binary now links with a 16 MiB main-thread stack (was 1 MiB, the Windows default).** The new push-to- | CODE |
| MEDIUM | CHANGELOG.md | 2402 | - **Synthetic Angular `<template>` complexity findings now carry component-inherited CRAP provenance.** When `fallow hea | CODE |
| MEDIUM | CHANGELOG.md | 2454 | - **Catalog and dependency-override findings now flow through typed `*Finding` envelope wrappers, retiring the legacy `i | CODE |
| MEDIUM | CHANGELOG.md | 2534 | - **Dependencies imported only from a config file in a hidden directory referenced by `package.json#scripts` are no long | CODE |
| MEDIUM | crates/types/src/output_health.rs | 329 | /// untested-file item: an `add-tests` primary action (scaffold tests for | COMMENT |
| MEDIUM | crates/core/src/plugins/adonis.rs | 293 | /// (replacing v5's rc-level `aliases`). The default scaffold ships a | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 80 | /// first-match value but the AGENTS.md scaffold leaves `- Test:` blank | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 278 | /// Used by `fallow init` (where this is the canonical scaffold) and by | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 289 | // recommend can never drift on it. init layers its human-oriented scaffold | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 509 | /// scaffold. The values are globs with no `"`/`\` characters, so a simple quote | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 510 | /// wrap is sufficient (matching the JSON scaffold's rendering of the same data). | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 524 | /// so the TOML scaffold can never drift from the JSON scaffold or from | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 1469 | // back to "npm", which must NOT leak into the scaffold. | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 2203 | /// The generated JSON scaffold (also the `fallow fix` missing-config seed via | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 2236 | /// The generated TOML scaffold must LOAD through the real config loader with | COMMENT |
| MEDIUM | crates/cli/src/init.rs | 2239 | /// That sibling test pins the exact key the scaffold writes (`patterns`); | COMMENT |
| MEDIUM | crates/api/src/decision_surface.rs | 13 | //! Per the verdict (`.plans/agentic-review-e0-verdict.md`) the decision | COMMENT |
| MEDIUM | crates/api/src/decision_surface.rs | 32 | //! ## The trust mechanism (anti-hallucination) | COMMENT |
| MEDIUM⚡ | crates/extract/src/html.rs | 72 | /// interpolation has leaked into a checked-in HTML scaffold. | COMMENT |
| MEDIUM⚡ | crates/extract/src/html.rs | 73 | /// - `###...###` covers ember-cli blueprint scaffold placeholders | COMMENT |
| MEDIUM⚡ | crates/extract/src/html.rs | 73 | /// - `###...###` covers ember-cli blueprint scaffold placeholders | COMMENT |
| MEDIUM | crates/extract/src/cache/types.rs | 566 | /// Bumped to 185 on merging the agentic-review branch into main: the LLM-call | COMMENT |
| MEDIUM | .claude/rules/cli-crate.md | 14 | - `health/`: complexity analysis. `print_health_result` owns the standalone `fallow health` exit-code gate (issue #786): | CODE |
| MEDIUM | .claude/rules/detection.md | 41 | - **Package scaffold template assets**: `package.json#files` entries that clearly name runtime-copied template or scaffo | CODE |
| MEDIUM | .claude/rules/detection.md | 185 | - **Script-referenced hidden directories**: the file walker's hidden-directory filter normally allows only `.storybook` | CODE |
| MEDIUM | docs/output-schema.json | 3837 | "description": "A suggested action attached to a finding in the JSON output. Each finding\ncarries an `actions` ar | CODE |
| MEDIUM | .cargo/config.toml | 11 | # orchestration). POSIX hosts default to 8 MiB so the overflow only | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …ests/integration_test/issue_1785_typed_property_hop.rs | 111 | // `TypeB { a: TypeA }`). A consumer access `this.opts.b.a.leaf.deepM()` | COMMENT |
| CRITICAL | crates/api/src/runtime/audit.rs | 531 | duplication_clone_groups: analyses.duplication.output.report.clone_groups.len(), | CODE |
| CRITICAL | crates/extract/src/visitor/tests.rs | 2441 | // repeated self-hops (`this.opts.self.self.leaf.deep()`) must terminate | COMMENT |
| CRITICAL | crates/extract/src/visitor/tests.rs | 2452 | this.opts.self.self.leaf.deep(); | CODE |
| CRITICAL | crates/extract/src/visitor/tests.rs | 2475 | // (`this.opts.b.a.b.a.leaf.deep()`) must terminate and credit the | COMMENT |
| CRITICAL | crates/extract/src/visitor/tests.rs | 2485 | this.opts.b.a.b.a.leaf.deep(); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 31 | ### Step 1: Run full analysis | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 37 | ### Step 2: Review issue counts | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 41 | ### Step 3: Find duplication | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 47 | ### Step 4: Preview auto-fix | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 53 | ### Step 5: Apply fixes (after user confirmation) | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 59 | ### Step 6: Verify | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 318 | ### Step 1: Save current state as baseline | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 324 | ### Step 2: Commit the baseline | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 331 | ### Step 3: CI only fails on NEW issues | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 337 | ### Step 4: Gradually fix and update baseline | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 395 | ### Step 1: Measure current duplication | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 403 | ### Step 2: Set threshold slightly above current | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 413 | ### Step 3: Tighten over time | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 450 | ### Step 3: Compare results | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 460 | ### Step 4: Remove knip config | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 468 | ### Step 1: Preview migration | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 476 | ### Step 2: Apply migration | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 507 | ### Step 1: Dry-run first | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 513 | ### Step 2: Review each proposed change | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 521 | ### Step 3: Confirm with user before applying | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 525 | ### Step 4: Apply | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 531 | ### Step 5: Verify | COMMENT |
| LOW⚡ | npm/fallow/skills/fallow/references/patterns.md | 537 | ### Step 6: Run project tests | COMMENT |
| LOW | npm/fallow/skills/fallow/references/patterns.md | 71 | ### Step 1: Analyze changed files | COMMENT |
| LOW | npm/fallow/skills/fallow/references/patterns.md | 79 | ### Step 2: If issues found, show specifics | COMMENT |
| LOW | npm/fallow/skills/fallow/references/patterns.md | 429 | ### Step 1: Preview migration | COMMENT |
| LOW | npm/fallow/skills/fallow/references/patterns.md | 437 | ### Step 2: Apply migration | COMMENT |
| LOW | npm/fallow/skills/fallow/references/patterns.md | 488 | ### Step 3: Compare results | COMMENT |
| LOW | npm/fallow/skills/fallow/references/patterns.md | 627 | ### Step 1: Run combined analysis | COMMENT |
| LOW | npm/fallow/skills/fallow/references/patterns.md | 635 | ### Step 2: Prioritize cleanup | COMMENT |
| LOW | npm/fallow/skills/fallow/references/patterns.md | 696 | ### Step 1: Generate SARIF output | COMMENT |
| LOW | npm/fallow/skills/fallow/references/patterns.md | 702 | ### Step 2: Upload via GitHub Action | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/core/src/analyze/security/hardcoded_secret.rs | 428 | || lower.contains("placeholder") | CODE |
| LOW | crates/cli/tests/telemetry_tests.rs | 25 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/telemetry_tests.rs | 27 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/monorepo_report_paths_tests.rs | 28 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/monorepo_report_paths_tests.rs | 30 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/dupes_workspace_tests.rs | 78 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/dupes_workspace_tests.rs | 80 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 25 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 27 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 85 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 87 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 940 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 942 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 1025 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 1027 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 1107 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 1109 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 1711 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 1713 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 2679 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 2681 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 2776 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_tests.rs | 2778 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/changed_workspaces_tests.rs | 75 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/changed_workspaces_tests.rs | 77 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/suppressions_tests.rs | 25 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/suppressions_tests.rs | 27 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/changed_since_added_files_tests.rs | 55 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/changed_since_added_files_tests.rs | 57 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_brief_runtime_focus_tests.rs | 57 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/tests/audit_brief_runtime_focus_tests.rs | 59 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/src/audit_tests.rs | 13 | .env("GIT_AUTHOR_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/src/audit_tests.rs | 15 | .env("GIT_COMMITTER_EMAIL", "test@test.com") | CODE |
| LOW | crates/cli/src/lib.rs | 5263 | for word in ["stub", "placeholder"] { | CODE |
| LOW | crates/extract/src/sfc_template/angular.rs | 408 | "empty" | "default" | "placeholder" | "loading" | "error" => { | CODE |
| LOW | crates/extract/src/template_complexity/mod.rs | 159 | "default" | "placeholder" | "loading" | "error" | "empty" => Ok(Some(after_keyword)), | CODE |
| LOW | crates/engine/src/codeowners.rs | 703 | assert_eq!(co.owner_of(Path::new("index.js")), Some("user@example.com")); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/napi/index.d.ts | 412 | export function detectCircularDependencies(options?: DeadCodeOptions): Promise<DeadCodeReport>; | CODE |
| LOW | crates/napi/types/index.d.ts | 412 | export function detectCircularDependencies(options?: DeadCodeOptions): Promise<DeadCodeReport>; | CODE |
| LOW | tests/benchmark-corpus/results/dupes-mild.json | 11 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | tests/benchmark-corpus/results/dupes-mild.json | 19 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | tests/benchmark-corpus/results/dupes-strict.json | 11 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | tests/benchmark-corpus/results/dupes-strict.json | 19 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | tests/benchmark-corpus/results/dupes-semantic.json | 33 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | tests/benchmark-corpus/results/dupes-semantic.json | 41 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | tests/benchmark-corpus/results/dupes-defaults.json | 11 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | tests/benchmark-corpus/results/dupes-defaults.json | 19 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | tests/benchmark-corpus/results/dupes-weak.json | 11 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | tests/benchmark-corpus/results/dupes-weak.json | 19 | "fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num | CODE |
| LOW | …s/benchmark-corpus/src/type1-exact/data-processor-b.ts | 22 | export class DataProcessor extends EventEmitter { | CODE |
| LOW | …s/benchmark-corpus/src/type1-exact/data-processor-a.ts | 22 | export class DataProcessor extends EventEmitter { | CODE |
| LOW | .claude/hooks/pre-bash-guard.py | 155 | def uses_unbounded_workspace_cargo(command: str, commands: list[list[str]]) -> bool: | CODE |
| LOW | scripts/check_telemetry_doc_sync.py | 48 | def parse_canonical_allowlist(text: str) -> list[str]: | CODE |
| LOW | scripts/check-benchmark-harness.py | 129 | def fast_targets_from_generator() -> list[BenchTarget]: | CODE |
| LOW | scripts/check-benchmark-harness.py | 179 | def assert_codspeed_action_modes(text: str) -> list[str]: | CODE |
| LOW | scripts/check-benchmark-harness.py | 244 | def validate_required_targets(targets: list[BenchTarget]) -> list[str]: | CODE |
| LOW | scripts/public-config-corpus.py | 510 | def strip_toml_inline_comment(line: str) -> str: | CODE |
| LOW | scripts/public-config-corpus.py | 530 | def parse_toml_value_fallback(value: str) -> Any: | CODE |
| LOW | scripts/public-config-corpus.py | 624 | def strip_jsonc_trailing_commas(content: str) -> str: | CODE |
| LOW | npm/fallow/scripts/verify-binary.js | 312 | function currentPlatformPackageName() { | CODE |
| LOW | npm/fallow/scripts/verify-binary.js | 353 | function resolvePlatformPackageForVerify(opts) { | CODE |
| LOW | npm/fallow/scripts/run-binary.js | 20 | function resolvePlatformPackageName() { | CODE |
| LOW | npm/fallow/scripts/run-binary.js | 105 | function writeVerifiedLineIfVersionQuery(verifyResult, version) { | CODE |
| LOW | npm/fallow/scripts/verify-binary.test.js | 32 | function makeMismatchedDigestProvider() { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/core/src/plugins/supabase.rs | 49 | /// `supabase/functions/` directory are the robust activation signals. | COMMENT |
| MEDIUM | crates/core/src/plugins/registry/mod.rs | 1112 | // and emitting only when an owner is NOT built-in is robust even if a | COMMENT |
| MEDIUM | crates/cli/tests/common/mod.rs | 1 | #![allow(dead_code, reason = "shared harness included by multiple test crates")] | COMMENT |
| MEDIUM | crates/cli/src/ci.rs | 1478 | /// CI scripts so the binary is no less robust than the bash glue around it | COMMENT |
| MEDIUM | crates/engine/tests/dupes_profile.rs | 132 | #[ignore = "profiling harness, run manually with -- --ignored"] | COMMENT |
| MEDIUM | action/tests/run.sh | 1818 | # Shared mock harness: fallow renders the typed envelope; gh fails on the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | crates/mcp/src/server/mod.rs | 228 | /// Audit changed files for dead code, complexity, duplication, and styling. Purpose-built for reviewing AI-generate | COMMENT |
| HIGH | crates/cli/src/lib.rs | 1164 | /// Purpose-built for reviewing AI-generated code and PR quality gates. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/benchmark-corpus/evaluate-results.py | 118 | CODE | |
| LOW | tests/conformance/compare.py | 113 | CODE | |
| LOW | scripts/scan-hidden-unicode.py | 99 | CODE | |
| LOW | scripts/scan-hidden-unicode.py | 191 | CODE | |
| LOW | scripts/scan-hidden-unicode.py | 230 | CODE | |
| LOW | scripts/public-config-corpus.py | 443 | CODE | |
| LOW | scripts/public-config-corpus.py | 487 | CODE | |
| LOW | scripts/public-config-corpus.py | 510 | CODE | |
| LOW | scripts/public-config-corpus.py | 543 | CODE | |
| LOW | scripts/public-config-corpus.py | 567 | CODE | |
| LOW | scripts/public-config-corpus.py | 624 | CODE | |
| LOW | scripts/public-config-corpus.py | 659 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/ecosystem/run.sh | 9 | # Usage: | COMMENT |
| LOW | tests/conformance/verify-fixtures.sh | 7 | # Usage: | COMMENT |
| LOW | tests/conformance/run.sh | 6 | # Usage: | COMMENT |
| LOW | tests/conformance/run-all.sh | 9 | # Usage: | COMMENT |
| LOW | benchmarks/bench-ci.sh | 9 | # Usage: | COMMENT |
| LOW | benchmarks/compare-audit-runtime.sh | 9 | # Usage: | COMMENT |
| LOW | scripts/alloc-check.sh | 5 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/core/data/tooling.toml | 8 | # This file is the single source of truth: it is embedded into the binary via | COMMENT |
| MEDIUM | crates/security/data/security_matchers.toml | 11 | # This file is the single source of truth: embedded via include_str! and parsed | COMMENT |
| MEDIUM | action/tests/run.sh | 2056 | # Create a pre-computed changed files list (what analyze.sh produces) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/benchmark-corpus/evaluate-results.py | 12 | CODE | |
| LOW | tests/benchmark-corpus/evaluate-results.py | 13 | CODE | |
| LOW | scripts/check_telemetry_doc_sync.py | 37 | CODE | |
| LOW | scripts/check-benchmark-harness.py | 10 | CODE | |
| LOW | scripts/scan-hidden-unicode.py | 26 | CODE | |
| LOW | scripts/public-config-corpus.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .claude/hooks/pre-bash-guard.py | 7 | (`cargo fmt && git commit`, `A=1 git commit`, `cat x | fallow`) still are. | STRING |
| HIGH | .claude/hooks/pre-bash-guard.py | 105 | shlex is quote-aware, so `echo "a && fallow b"` yields a single data token | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/benchmark-corpus/evaluate-results.py | 205 | # Check if this is a cross-category detection (potential FP) | COMMENT |
| LOW | .github/workflows/conformance.yml | 113 | # Check if report exists and contains valid JSON | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/conformance/aggregate.py | 27 | print("Error: no report files found", file=sys.stderr) | CODE |