2.8

Adjusted Signal

2.8

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

5.3K

Stars

Rust

Language

1.3M

Lines of Code

2.6K

Files

3.4K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 3150 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.3/100 · LOW

Are imports declared and package/API names verified? 23 finding(s).

Agent Over-Engineering Ratio 2.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 254 finding(s).

PR Review Velocity Impact 13.8/100 · LOW

Which changes need focused human review? 3392 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 5HIGH 6MEDIUM 262LOW 3119

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 3392 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block2948 hits · 2680 pts

Severity	File	Line	Snippet	Context
LOW	_typos.toml	41	unsed = "unsed"	COMMENT
LOW	Cargo.toml	41	# exact because it has no stable release line and pre-release semver matching is	COMMENT
LOW	socket.yml	1	# Socket GitHub App configuration. Socket checks each pull request that	COMMENT
LOW	.clippy.toml	21		COMMENT
LOW	mise.toml	1	# Optional pinned set of local development tools. Run `mise install` to get it.	COMMENT
LOW	crates/types/Cargo.toml	21		COMMENT
LOW	crates/types/src/cache_rejection.rs	1	//! Why a persisted cache was not reused.	COMMENT
LOW	crates/types/src/cache_rejection.rs	21	#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]	COMMENT
LOW	crates/types/src/cache_rejection.rs	41	Undecodable,	COMMENT
LOW	crates/types/src/cache_rejection.rs	101	Self::ConfigHashMismatch => "extraction config changed".to_string(),	COMMENT
LOW	crates/types/src/mcp_manifest.rs	1	//! Machine-readable manifest of the tools exposed by the fallow MCP server.	COMMENT
LOW	crates/types/src/mcp_manifest.rs	41	/// Wire tool name (matches the rmcp `#[tool]` method name).	COMMENT
LOW	crates/types/src/mcp_manifest.rs	61	/// source files. `analyze`, `check_changed`, `find_dupes` and	COMMENT
LOW	crates/types/src/mcp_manifest.rs	681	/// list and read with no subprocess and no analysis run, cacheable by URI	COMMENT
LOW	crates/types/src/mcp_manifest.rs	821	/// One row of the cross-surface capability parity table: how a single fallow	COMMENT
LOW	crates/types/src/mcp_manifest.rs	841	/// the maintainer endorses.	COMMENT
LOW	crates/types/src/task_matrix.rs	1	//! Single source of truth for the agent-discoverability task-to-command matrix	COMMENT
LOW	crates/types/src/task_matrix.rs	21	/// `command` MAY contain `<placeholder>` or glob tokens because it renders	COMMENT
LOW	crates/types/src/output_dead_code.rs	1	//! Typed envelope wrappers for the simple 1:1 dead-code findings whose	COMMENT
LOW	crates/types/src/output_dead_code.rs	101	///	COMMENT
LOW	crates/types/src/output_dead_code.rs	121	#[cfg_attr(feature = "schema", derive(schemars::JsonSchema))]	COMMENT
LOW	crates/types/src/output_dead_code.rs	141	///	COMMENT
LOW	crates/types/src/output_dead_code.rs	161	/// the run.	COMMENT
LOW	crates/types/src/output_dead_code.rs	241	#[must_use]	COMMENT
LOW	crates/types/src/output_dead_code.rs	301	#[must_use]	COMMENT
LOW	crates/types/src/output_dead_code.rs	321	/// every time: `fallow fix`, the LSP quick fix, and the `auto_fixable` flag an	COMMENT
LOW	crates/types/src/output_dead_code.rs	341	}	COMMENT
LOW	crates/types/src/output_dead_code.rs	401	/// flattens in via `#[serde(flatten)]`, with a typed `actions` array	COMMENT
LOW	crates/types/src/output_dead_code.rs	421	/// the merge-base. `None` when serialized directly from Rust.	COMMENT
LOW	crates/types/src/output_dead_code.rs	481	/// [`UnusedFileFinding`]: flattens the bare finding and carries a typed	COMMENT
LOW	crates/types/src/output_dead_code.rs	541	actions,	COMMENT
LOW	crates/types/src/output_dead_code.rs	561	/// new id. Absent in output from older versions.	COMMENT
LOW	crates/types/src/output_dead_code.rs	621	/// Wire-shape envelope for an [`UnresolvedImport`] finding. Mirrors	COMMENT
LOW	crates/types/src/output_dead_code.rs	701	}	COMMENT
LOW	crates/types/src/output_dead_code.rs	781	/// diagnostic is anchored at line 1 col 0 of each member).	COMMENT
LOW	crates/types/src/output_dead_code.rs	801	pub introduced: Option<AuditIntroduced>,	COMMENT
LOW	crates/types/src/output_dead_code.rs	881	/// The underlying dead-code entry.	COMMENT
LOW	crates/types/src/output_dead_code.rs	941	actions,	COMMENT
LOW	crates/types/src/output_dead_code.rs	961	/// reformats and reorders. A rename of the file or the symbol gives a	COMMENT
LOW	crates/types/src/output_dead_code.rs	1021	/// unmatched.	COMMENT
LOW	crates/types/src/output_dead_code.rs	1101		COMMENT
LOW	crates/types/src/output_dead_code.rs	1181	/// replacing the banned call, import, or effect, or suppressing it with a scoped	COMMENT
LOW	crates/types/src/output_dead_code.rs	1261	}	COMMENT
LOW	crates/types/src/output_dead_code.rs	1281	/// forward-compat).	COMMENT
LOW	crates/types/src/output_dead_code.rs	1361	/// declarations, with the same `is_re_export`-aware note swap.	COMMENT
LOW	crates/types/src/output_dead_code.rs	1381	/// Set by the audit pass when this finding is introduced relative to	COMMENT
LOW	crates/types/src/output_dead_code.rs	1481		COMMENT
LOW	crates/types/src/output_dead_code.rs	1561	/// line-level suppress.	COMMENT
LOW	crates/types/src/output_dead_code.rs	1641	#[serde(flatten)]	COMMENT
LOW	crates/types/src/output_dead_code.rs	1701	introduced: None,	COMMENT
LOW	crates/types/src/output_dead_code.rs	1721	/// new id. Absent in output from older versions.	COMMENT
LOW	crates/types/src/output_dead_code.rs	1761	effective_severity: None,	COMMENT
LOW	crates/types/src/output_dead_code.rs	1781	#[serde(default, skip_serializing_if = "Option::is_none")]	COMMENT
LOW	crates/types/src/output_dead_code.rs	1821	}	COMMENT
LOW	crates/types/src/output_dead_code.rs	1881	}	COMMENT
LOW	crates/types/src/output_dead_code.rs	1941	}	COMMENT
LOW	crates/types/src/output_dead_code.rs	2001		COMMENT
LOW	crates/types/src/output_dead_code.rs	2061	/// Wire-shape envelope for an [`UnusedComponentEmit`] finding. There is no safe	COMMENT
LOW	crates/types/src/output_dead_code.rs	2081	/// Set by the audit pass when this finding is introduced relative to	COMMENT
LOW	crates/types/src/output_dead_code.rs	2121	/// auto-fix: removing a dispatched event is judgement-bearing (the event may be	COMMENT
2888 more matches not shown…

Decorative Section Separators212 hits · 599 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/types/src/output_dead_code.rs	3620	// ── Catalog / dep-override family ───────────────────────────────	COMMENT
MEDIUM	crates/types/src/output_dead_code.rs	4249	// ── The mutation gate, registered once ──────────────────────────	COMMENT
MEDIUM	crates/types/src/output_dead_code.rs	4405	// ── Position-0 invariant golden tests ───────────────────────────	COMMENT
MEDIUM	crates/types/src/results.rs	4773	// ── total_issues counts each category independently ─────────	COMMENT
MEDIUM	crates/types/src/results.rs	4804	// ── sort: unused_files by path ──────────────────────────────	COMMENT
MEDIUM	crates/types/src/results.rs	4830	// ── sort: unused_exports by path, line, name ────────────────	COMMENT
MEDIUM	crates/types/src/results.rs	4876	// ── sort: unused_types (same sort as unused_exports) ────────	COMMENT
MEDIUM	crates/types/src/results.rs	4901	// ── sort: unused_dependencies by path, line, name ───────────	COMMENT
MEDIUM	crates/types/src/results.rs	4928	// ── sort: unused_dev_dependencies ───────────────────────────	COMMENT
MEDIUM	crates/types/src/results.rs	4956	// ── sort: unused_optional_dependencies ──────────────────────	COMMENT
MEDIUM	crates/types/src/results.rs	5063	// ── sort: unlisted_dependencies + inner imported_from ───────	COMMENT
MEDIUM	crates/types/src/results.rs	5113	// ── sort: duplicate_exports + inner locations ───────────────	COMMENT
MEDIUM	crates/types/src/results.rs	5159	// ── sort: type_only_dependencies ────────────────────────────	COMMENT
MEDIUM	crates/types/src/results.rs	5185	// ── sort: test_only_dependencies ────────────────────────────	COMMENT
MEDIUM	crates/types/src/results.rs	5211	// ── sort: circular_dependencies by files, then length ───────	COMMENT
MEDIUM	crates/types/src/results.rs	5284	// ── sort: export_usages + inner reference_locations ─────────	COMMENT
MEDIUM	crates/types/src/results.rs	5335	// ── serialization ──────────────────────────────────────────	COMMENT
MEDIUM	crates/types/src/results.rs	5597	// ── clone produces independent copies ───────────────────────	COMMENT
MEDIUM	crates/types/src/results.rs	5938	// ── export_usages not counted in total_issues ───────────────	COMMENT
MEDIUM	crates/types/src/results.rs	5956	// ── entry_point_summary not counted in total_issues ─────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	109	// ── command-injection (CWE-78), provenance-gated to node:child_process ───────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	137	// ── code-injection (CWE-94): eval (ungated) + vm (node:vm) ───────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	166	// ── dynamic-regex (CWE-1333), ungated non-literal pattern construction ──────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	375	// ── sql-injection (CWE-89), ungated (broad tier) ─────────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	442	// ── ssrf (CWE-918), ungated (broad tier) ─────────────────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	596	// ── path-traversal (CWE-22), provenance-gated to node:path ───────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	700	// ── open-redirect (CWE-601), ungated (broad tier) ────────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	786	// ── weak-crypto (CWE-327), provenance-gated to node:crypto ───────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	803	// ── unsafe-deserialization (CWE-502): js-yaml + node-serialize ───────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	826	// ── prototype-pollution (CWE-1321), ungated (broad tier) ─────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	871	// ── zip-slip / tar path traversal (CWE-22), ungated (broad tier) ─────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	888	// ── nosql-injection (CWE-943), ungated (broad tier) ──────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	911	// ── ssti (CWE-1336), ungated (broad tier) ────────────────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	928	// ── xxe (CWE-611), ungated (broad tier) ──────────────────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	945	// ── issue #882 catalogue-only sinks ─────────────────────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	945	// ── issue #882 catalogue-only sinks ─────────────────────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	999	// ── secret-pii-log (CWE-532), source-backed logging only ────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	1029	// ── issue #897 catalogue-only sinks (batch 2) ───────────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	1029	// ── issue #897 catalogue-only sinks (batch 2) ───────────────────────────────	COMMENT
MEDIUM	…ests/integration_test/security_catalogue_categories.rs	1244	// ── llm-call-injection (CWE-1427), taint-gated (E11) ─────────────────────────	COMMENT
MEDIUM	crates/core/data/config_value_credits.toml	34	# ── test-environment-optional-peer ────────────────────────────────────────	COMMENT
MEDIUM	crates/core/data/config_value_credits.toml	50	# ── vitest-builtin-environment ────────────────────────────────────────────	STRING
MEDIUM	crates/core/data/config_value_credits.toml	67	# ── vite-css-implementation ───────────────────────────────────────────────	STRING
MEDIUM	crates/core/data/tooling.toml	40	# ── Prefixes: package families where every member is tooling ──────────────	COMMENT
MEDIUM	crates/core/data/tooling.toml	125	# ── Exact package names ───────────────────────────────────────────────────	COMMENT
MEDIUM	crates/core/data/tooling.toml	484	# ── Ambient global type packages ──────────────────────────────────────────	COMMENT
MEDIUM	crates/core/data/cli_flag_credits.toml	44	# ── eslint ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	crates/core/data/cli_flag_credits.toml	68	# ── jest ──────────────────────────────────────────────────────────────────	STRING
MEDIUM	crates/core/data/cli_flag_credits.toml	110	# ── node module preloading (node, tsx, ts-node) ───────────────────────────	STRING
MEDIUM	crates/core/data/cli_flag_credits.toml	123	# ── mocha ─────────────────────────────────────────────────────────────────	STRING
MEDIUM	crates/core/data/cli_flag_credits.toml	160	# ── prettier ──────────────────────────────────────────────────────────────	STRING
MEDIUM	crates/core/data/cli_flag_credits.toml	171	# ── stylelint ─────────────────────────────────────────────────────────────	STRING
MEDIUM	crates/core/data/cli_flag_credits.toml	182	# ── postcss ───────────────────────────────────────────────────────────────	STRING
MEDIUM	crates/core/src/analyze/effect.rs	432	// ── unused-effect-layer ─────────────────────────────────────────────	COMMENT
MEDIUM	crates/core/src/analyze/effect.rs	551	// ── unused-tagged-error ─────────────────────────────────────────────	COMMENT
MEDIUM	crates/core/src/analyze/effect.rs	649	// ── unproduced-catch-tag ────────────────────────────────────────────	COMMENT
MEDIUM⚡	crates/security/data/security_matchers.toml	1018	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	crates/security/data/security_matchers.toml	1028	# ════════════════════════════════════════════════════════════════════════════	COMMENT
MEDIUM⚡	crates/security/data/security_matchers.toml	1030	# ── Angular: DomSanitizer.bypassSecurityTrust* (CWE-79) ─────────────────────	COMMENT
MEDIUM	crates/security/data/security_matchers.toml	68	# ── CWE-79: Dangerous HTML (the proven seed; no provenance needed) ──────────	COMMENT
152 more matches not shown…

Structural Annotation Overuse96 hits · 165 pts

Severity	File	Line	Snippet	Context
LOW⚡	.agents/skills/fallow/references/patterns.md	31	### Step 1: Run full analysis	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	37	### Step 2: Review issue counts	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	41	### Step 3: Find duplication	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	47	### Step 4: Preview auto-fix	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	53	### Step 5: Apply fixes (after user confirmation)	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	59	### Step 6: Verify	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	318	### Step 1: Save current state as baseline	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	324	### Step 2: Commit the baseline	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	331	### Step 3: CI only fails on NEW issues	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	337	### Step 4: Gradually fix and prune the baseline	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	397	### Step 1: Measure current duplication	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	405	### Step 2: Set threshold slightly above current	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	415	### Step 3: Tighten over time	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	455	### Step 3: Compare results	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	465	### Step 4: Remove knip config	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	473	### Step 1: Preview migration	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	481	### Step 2: Apply migration	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	512	### Step 1: Dry-run first	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	518	### Step 2: Review each proposed change	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	526	### Step 3: Confirm with user before applying	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	530	### Step 4: Apply	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	536	### Step 5: Verify	COMMENT
LOW⚡	.agents/skills/fallow/references/patterns.md	542	### Step 6: Run project tests	COMMENT
LOW	.agents/skills/fallow/references/patterns.md	71	### Step 1: Analyze changed files	COMMENT
LOW	.agents/skills/fallow/references/patterns.md	79	### Step 2: If issues found, show specifics	COMMENT
LOW	.agents/skills/fallow/references/patterns.md	431	### Step 1: Preview migration	COMMENT
LOW	.agents/skills/fallow/references/patterns.md	439	### Step 2: Apply migration	COMMENT
LOW	.agents/skills/fallow/references/patterns.md	493	### Step 3: Compare results	COMMENT
LOW	.agents/skills/fallow/references/patterns.md	632	### Step 1: Run combined analysis	COMMENT
LOW	.agents/skills/fallow/references/patterns.md	640	### Step 2: Prioritize cleanup	COMMENT
LOW	.agents/skills/fallow/references/patterns.md	701	### Step 1: Generate SARIF output	COMMENT
LOW	.agents/skills/fallow/references/patterns.md	707	### Step 2: Upload via GitHub Action	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	31	### Step 1: Run full analysis	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	37	### Step 2: Review issue counts	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	41	### Step 3: Find duplication	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	47	### Step 4: Preview auto-fix	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	53	### Step 5: Apply fixes (after user confirmation)	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	59	### Step 6: Verify	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	318	### Step 1: Save current state as baseline	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	324	### Step 2: Commit the baseline	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	331	### Step 3: CI only fails on NEW issues	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	337	### Step 4: Gradually fix and prune the baseline	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	397	### Step 1: Measure current duplication	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	405	### Step 2: Set threshold slightly above current	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	415	### Step 3: Tighten over time	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	455	### Step 3: Compare results	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	465	### Step 4: Remove knip config	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	473	### Step 1: Preview migration	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	481	### Step 2: Apply migration	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	512	### Step 1: Dry-run first	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	518	### Step 2: Review each proposed change	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	526	### Step 3: Confirm with user before applying	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	530	### Step 4: Apply	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	536	### Step 5: Verify	COMMENT
LOW⚡	.claude/skills/fallow/references/patterns.md	542	### Step 6: Run project tests	COMMENT
LOW	.claude/skills/fallow/references/patterns.md	71	### Step 1: Analyze changed files	COMMENT
LOW	.claude/skills/fallow/references/patterns.md	79	### Step 2: If issues found, show specifics	COMMENT
LOW	.claude/skills/fallow/references/patterns.md	431	### Step 1: Preview migration	COMMENT
LOW	.claude/skills/fallow/references/patterns.md	439	### Step 2: Apply migration	COMMENT
LOW	.claude/skills/fallow/references/patterns.md	493	### Step 3: Compare results	COMMENT
36 more matches not shown…

Modern AI Meta-Vocabulary24 hits · 76 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/types/src/output_health.rs	342	/// untested-file item: an `add-tests` primary action (scaffold tests for	COMMENT
MEDIUM	crates/core/src/plugins/adonis.rs	293	/// (replacing v5's rc-level `aliases`). The default scaffold ships a	COMMENT
MEDIUM	crates/core/src/analyze/unused_deps.rs	2040	// to skip it, so a scaffold that keeps its framework in devDependencies	COMMENT
MEDIUM	…/core/src/analyze/unused_deps_tests/dev_dep_in_prod.rs	307	/// scaffold that keeps its framework in devDependencies (which is what the	COMMENT
MEDIUM	…/core/src/analyze/unused_deps_tests/dev_dep_in_prod.rs	308	/// SvelteKit scaffold generates) was told to promote the framework itself.	COMMENT
MEDIUM	crates/cli/tests/integration/audit_tests.rs	2535	/// modules (the issue #2164 refactor). The surviving scaffolding clone group	COMMENT
MEDIUM	crates/cli/src/audit_weakening.rs	3	//! The brief reports the guardrails that a change weakens: tests removed,	COMMENT
MEDIUM	crates/cli/src/init.rs	88	/// first-match value but the AGENTS.md scaffold leaves `- Test:` blank	COMMENT
MEDIUM	crates/cli/src/init.rs	302	/// Used by `fallow init` (where this is the canonical scaffold) and by	COMMENT
MEDIUM	crates/cli/src/init.rs	313	// recommend can never drift on it. init layers its human-oriented scaffold	COMMENT
MEDIUM	crates/cli/src/init.rs	533	/// scaffold. The values are globs with no `"`/`\` characters, so a simple quote	COMMENT
MEDIUM	crates/cli/src/init.rs	534	/// wrap is sufficient (matching the JSON scaffold's rendering of the same data).	COMMENT
MEDIUM	crates/cli/src/init.rs	548	/// so the TOML scaffold can never drift from the JSON scaffold or from	COMMENT
MEDIUM	crates/cli/src/init.rs	1616	// back to "npm", which must NOT leak into the scaffold.	COMMENT
MEDIUM	crates/cli/src/init.rs	2384	/// The generated JSON scaffold (also the `fallow fix` missing-config seed via	COMMENT
MEDIUM	crates/cli/src/init.rs	2417	/// The generated TOML scaffold must LOAD through the real config loader with	COMMENT
MEDIUM	crates/cli/src/init.rs	2420	/// That sibling test pins the exact key the scaffold writes (`patterns`);	COMMENT
MEDIUM	crates/cli/src/agent_install/mod.rs	85	/// `AGENTS.md` scaffold or task-map block, plus the `CLAUDE.md` import for Claude Code.	COMMENT
MEDIUM	crates/api/src/decision_surface.rs	13	//! Per the verdict (`.plans/agentic-review-e0-verdict.md`) the decision	COMMENT
MEDIUM	crates/api/src/decision_surface.rs	32	//! ## The trust mechanism (anti-hallucination)	COMMENT
MEDIUM⚡	crates/extract/src/html.rs	81	/// interpolation has leaked into a checked-in HTML scaffold.	COMMENT
MEDIUM⚡	crates/extract/src/html.rs	82	/// - `###...###` covers ember-cli blueprint scaffold placeholders	COMMENT
MEDIUM⚡	crates/extract/src/html.rs	82	/// - `###...###` covers ember-cli blueprint scaffold placeholders	COMMENT
MEDIUM	.cargo/config.toml	11	# orchestration). POSIX hosts default to 8 MiB so the overflow only	COMMENT

Hallucination Indicators5 hits · 65 pts

Severity	File	Line	Snippet	Context
CRITICAL	…ests/integration_test/issue_1785_typed_property_hop.rs	111	// `TypeB { a: TypeA }`). A consumer access `this.opts.b.a.leaf.deepM()`	COMMENT
CRITICAL	crates/extract/src/visitor/tests.rs	4312	// repeated self-hops (`this.opts.self.self.leaf.deep()`) must terminate	COMMENT
CRITICAL	crates/extract/src/visitor/tests.rs	4323	this.opts.self.self.leaf.deep();	CODE
CRITICAL	crates/extract/src/visitor/tests.rs	4346	// (`this.opts.b.a.b.a.leaf.deep()`) must terminate and credit the	COMMENT
CRITICAL	crates/extract/src/visitor/tests.rs	4356	this.opts.b.a.b.a.leaf.deep();	CODE

AI Slop Vocabulary16 hits · 52 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/core/src/plugins/supabase.rs	54	/// `supabase/functions/` directory are the robust activation signals.	COMMENT
MEDIUM	crates/core/src/plugins/registry/mod.rs	1482	// and emitting only when an owner is NOT built-in is robust even if a	COMMENT
MEDIUM	crates/cli/tests/common/mod.rs	1	#![allow(dead_code, reason = "shared harness included by multiple test crates")]	COMMENT
MEDIUM	crates/cli/src/ci.rs	2198	/// CI scripts so the binary is no less robust than the bash glue around it	COMMENT
MEDIUM	crates/engine/tests/integration/dupes_profile.rs	134	#[ignore = "profiling harness, run manually with -- --ignored"]	COMMENT
MEDIUM	action/tests/run.sh	2916	# Shared mock harness: fallow renders the typed envelope; gh fails on the	COMMENT
MEDIUM	benchmarks/cli-instructions.sh	5	# The CodSpeed exec harness runs the release binary under CPU simulation, so	COMMENT
MEDIUM	benchmarks/cli-instructions.sh	17	# exit 0, because the exec harness rejects a non-zero exit.	COMMENT
MEDIUM	benchmarks/cli-instructions.sh	127	# harness rejects a non-zero exit. The bench config keeps every default and	COMMENT
MEDIUM	.github/workflows/ci.yml	588	# harness reads committed producer maps, so it installs nothing and	COMMENT
MEDIUM	.github/workflows/ci.yml	724	# The harness drives the MCP server as a separate binary and fails when	COMMENT
MEDIUM⚡	.github/workflows/ci.yml	808	# The drift harness runs in its own Windows job, in parallel with the job	COMMENT
MEDIUM⚡	.github/workflows/ci.yml	810	# runs the harness on Windows.	COMMENT
MEDIUM⚡	.github/workflows/ci.yml	814	# Release Validation runs the drift harness on Linux only, so this job is	COMMENT
MEDIUM	.github/workflows/ci.yml	833	# The drift harness builds git fixtures, spawns the CLI and the MCP	COMMENT
MEDIUM	.github/workflows/ci.yml	834	# server, and compares root-relative paths. A harness change must pass	COMMENT

Hyper-Verbose Identifiers35 hits · 36 pts

Severity	File	Line	Snippet	Context
LOW	crates/cli/tests/integration/audit_test_reach_tests.rs	231	"export function anExportWithAVeryLongNameForTheWidthCheck(): number {\n return 1;\n}\n",	CODE
LOW	crates/cli/tests/integration/audit_test_reach_tests.rs	240	"export function anExportWithAVeryLongNameForTheWidthCheck(): number {\n return 2;\n}\n",	CODE
LOW	crates/napi/types/index.d.ts	757	export function detectCircularDependencies(options?: DeadCodeOptions): Promise<DeadCodeReport>;	CODE
LOW	tests/benchmark-corpus/results/dupes-mild.json	11	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	tests/benchmark-corpus/results/dupes-mild.json	19	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	tests/benchmark-corpus/results/dupes-strict.json	11	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	tests/benchmark-corpus/results/dupes-strict.json	19	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	tests/benchmark-corpus/results/dupes-semantic.json	33	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	tests/benchmark-corpus/results/dupes-semantic.json	41	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	tests/benchmark-corpus/results/dupes-defaults.json	11	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	tests/benchmark-corpus/results/dupes-defaults.json	19	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	tests/benchmark-corpus/results/dupes-weak.json	11	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	tests/benchmark-corpus/results/dupes-weak.json	19	"fragment": "import { EventEmitter } from 'events';\n\ninterface DataRecord {\n id: string;\n timestamp: num	CODE
LOW	…s/benchmark-corpus/src/type1-exact/data-processor-b.ts	22	export class DataProcessor extends EventEmitter {	CODE
LOW	…s/benchmark-corpus/src/type1-exact/data-processor-a.ts	22	export class DataProcessor extends EventEmitter {	CODE
LOW	.claude/hooks/pre-bash-guard.py	155	def uses_unbounded_workspace_cargo(command: str, commands: list[list[str]]) -> bool:	CODE
LOW	scripts/signing_migration_test.py	18	def test_preserves_exact_secret_bytes(self):	CODE
LOW⚡	scripts/signing_migration_test.py	41	def test_context_rejects_untrusted_runs(self):	CODE
LOW⚡	scripts/signing_migration_test.py	48	def test_unreviewed_library_is_not_loaded(self):	CODE
LOW⚡	scripts/signing_migration_test.py	55	def test_signature_proof_rejects_wrong_key(self):	CODE
LOW	scripts/check_telemetry_doc_sync.py	79	def parse_canonical_allowlist(text: str) -> list[str]:	CODE
LOW	scripts/check-benchmark-harness.py	142	def fast_targets_from_generator() -> list[BenchTarget]:	CODE
LOW	scripts/check-benchmark-harness.py	192	def assert_codspeed_action_modes(text: str, type_aware_text: str) -> list[str]:	CODE
LOW	scripts/check-benchmark-harness.py	226	def validate_type_aware_benchmark(text: str) -> list[str]:	CODE
LOW	scripts/check-benchmark-harness.py	300	def validate_required_targets(targets: list[BenchTarget]) -> list[str]:	CODE
LOW	scripts/check-benchmark-harness.py	349	def validate_thread_determinism(text: str) -> list[str]:	CODE
LOW	scripts/public-config-corpus.py	510	def strip_toml_inline_comment(line: str) -> str:	CODE
LOW	scripts/public-config-corpus.py	530	def parse_toml_value_fallback(value: str) -> Any:	CODE
LOW	scripts/public-config-corpus.py	624	def strip_jsonc_trailing_commas(content: str) -> str:	CODE
LOW	npm/fallow/scripts/verify-binary.js	316	function currentPlatformPackageName() {	CODE
LOW	npm/fallow/scripts/verify-binary.js	357	function resolvePlatformPackageForVerify(opts) {	CODE
LOW	npm/fallow/scripts/run-binary.js	20	function resolvePlatformPackageName() {	CODE
LOW	npm/fallow/scripts/run-binary.js	109	function writeVerifiedLineIfVersionQuery(verifyResult, version) {	CODE
LOW	npm/fallow/scripts/run-binary.js	137	function resolveTypeAwareCompanion(	CODE
LOW	npm/fallow/scripts/verify-binary.test.js	32	function makeMismatchedDigestProvider() {	CODE

Synthetic Comment Markers3 hits · 22 pts

Severity	File	Line	Snippet	Context
HIGH	crates/mcp/src/server/mod.rs	340	/// Audit changed files for dead code, complexity, duplication, styling, and diff risk. Purpose-built for reviewing	COMMENT
HIGH	crates/cli/src/cli_args.rs	1804	/// Purpose-built for reviewing AI-generated code and PR quality gates.	COMMENT
HIGH	crates/cli/src/report/request_outcome_text.rs	7	//! whether the report is scoped as requested, so the surfaces that state a	COMMENT

Self-Referential Comments5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	crates/core/data/config_value_credits.toml	10	# This file is the single source of truth for those rules: it is embedded into	COMMENT
MEDIUM	crates/core/data/tooling.toml	9	# This file is the single source of truth: it is embedded into the binary via	COMMENT
MEDIUM	crates/core/data/cli_flag_credits.toml	9	# This file is the single source of truth for those rules: it is embedded into	COMMENT
MEDIUM	crates/security/data/security_matchers.toml	11	# This file is the single source of truth: embedded via include_str! and parsed	COMMENT
MEDIUM	action/tests/run.sh	3161	# Create a pre-computed changed files list (what analyze.sh produces)	COMMENT

Deep Nesting13 hits · 13 pts

Severity	File	Line	Context
LOW	tests/benchmark-corpus/evaluate-results.py	128	CODE
LOW	tests/conformance/compare.py	113	CODE
LOW	scripts/scan-hidden-unicode.py	102	CODE
LOW	scripts/scan-hidden-unicode.py	172	CODE
LOW	scripts/scan-hidden-unicode.py	212	CODE
LOW	scripts/scan-hidden-unicode.py	251	CODE
LOW	scripts/public-config-corpus.py	443	CODE
LOW	scripts/public-config-corpus.py	487	CODE
LOW	scripts/public-config-corpus.py	510	CODE
LOW	scripts/public-config-corpus.py	543	CODE
LOW	scripts/public-config-corpus.py	567	CODE
LOW	scripts/public-config-corpus.py	624	CODE
LOW	scripts/public-config-corpus.py	659	CODE

Example Usage Blocks8 hits · 13 pts

Severity	File	Line	Snippet	Context
LOW⚡	tests/ecosystem/run.sh	9	# Usage:	COMMENT
LOW	tests/benchmark-corpus/evaluate.sh	10	# Usage:	COMMENT
LOW	tests/conformance/verify-fixtures.sh	7	# Usage:	COMMENT
LOW	tests/conformance/run.sh	6	# Usage:	COMMENT
LOW	tests/conformance/run-all.sh	9	# Usage:	COMMENT
LOW	benchmarks/compare-audit-runtime.sh	9	# Usage:	COMMENT
LOW	benchmarks/cli-instructions.sh	21	# Usage:	COMMENT
LOW	scripts/pgo-train.sh	6	# Usage:	COMMENT

Fake / Example Data12 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	crates/core/src/analyze/security/hardcoded_secret.rs	428	\|\| lower.contains("placeholder")	CODE
LOW	crates/cli/tests/integration/dupes_tests.rs	1968	.env("GIT_AUTHOR_EMAIL", "test@test.com")	CODE
LOW	crates/cli/tests/integration/dupes_tests.rs	1970	.env("GIT_COMMITTER_EMAIL", "test@test.com")	CODE
LOW	crates/cli/tests/common/mod.rs	302	const GIT_TEST_EMAIL: &str = "test@test.com";	CODE
LOW	crates/cli/src/audit_tests.rs	121	.env("GIT_AUTHOR_EMAIL", "test@test.com")	CODE
LOW	crates/cli/src/audit_tests.rs	123	.env("GIT_COMMITTER_EMAIL", "test@test.com")	CODE
LOW	crates/cli/src/lib.rs	1882	for word in ["stub", "placeholder"] {	CODE
LOW	crates/api/src/audit_run/tests.rs	21	.env("GIT_AUTHOR_EMAIL", "test@test.com")	CODE
LOW	crates/api/src/audit_run/tests.rs	23	.env("GIT_COMMITTER_EMAIL", "test@test.com")	CODE
LOW	crates/extract/src/sfc_template/angular.rs	411	"empty" \| "default" \| "placeholder" \| "loading" \| "error" => {	CODE
LOW	crates/extract/src/template_complexity/mod.rs	170	"default" \| "placeholder" \| "loading" \| "error" \| "empty" => Ok(Some(after_keyword)),	CODE
LOW	crates/engine/src/codeowners.rs	925	assert_eq!(co.owner_of(Path::new("index.js")), Some("user@example.com"));	CODE

Excessive Try-Catch Wrapping6 hits · 11 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/benchmark-corpus/evaluate-results.py	258	print(f"Error: accuracy floor not found: {path}", file=sys.stderr)	CODE
MEDIUM	tests/conformance/aggregate.py	41	print(f"Error: adjudication register not found: {path}", file=sys.stderr)	CODE
MEDIUM	tests/conformance/aggregate.py	80	print(f"Error: duplicate adjudication for {key}", file=sys.stderr)	CODE
MEDIUM	tests/conformance/aggregate.py	112	print("Error: --adjudications needs a path", file=sys.stderr)	CODE
MEDIUM	tests/conformance/aggregate.py	132	print("Error: no report files found", file=sys.stderr)	CODE
LOW	scripts/signing_migration.py	161	except Exception:	CODE

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	tests/conformance/compare.py	41	except ValueError:	CODE

Cross-Language Confusion2 hits · 5 pts

Severity	File	Line	Snippet	Context
HIGH	.claude/hooks/pre-bash-guard.py	7	(`cargo fmt && git commit`, `A=1 git commit`, `cat x \| fallow`) still are.	STRING
HIGH	.claude/hooks/pre-bash-guard.py	105	shlex is quote-aware, so `echo "a && fallow b"` yields a single data token	STRING

Unused Imports4 hits · 4 pts

Severity	File	Line	Context
LOW	scripts/check_telemetry_doc_sync.py	39	CODE
LOW	scripts/check-benchmark-harness.py	10	CODE
LOW	scripts/scan-hidden-unicode.py	26	CODE
LOW	scripts/public-config-corpus.py	4	CODE

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	tests/benchmark-corpus/evaluate-results.py	217	# Check if this is a cross-category detection (potential FP)	COMMENT
LOW	benchmarks/cli-instructions.sh	87	# Set BENCH_ARGS to the argument list for one benchmark.	COMMENT

fallow-rs/fallow

Open-Source Code Quality, Security and Technical Debt Review