2.0

Adjusted Signal

2.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

9.2K

Stars

Elixir

Language

205.9K

Lines of Code

1.2K

Files

344

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 7.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 291 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.8/100 · LOW

Are imports declared and package/API names verified? 31 finding(s).

Agent Over-Engineering Ratio 1.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 22 finding(s).

PR Review Velocity Impact 9.4/100 · LOW

Which changes need focused human review? 344 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 30LOW 313

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 344 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block270 hits · 270 pts

Severity	File	Line	Snippet	Context
LOW	mise-tasks/x509/gen-certificate.sh	1	#!/usr/bin/env bash	COMMENT
LOW	elixir/priv/static/robots.txt	1	# See http://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file	COMMENT
LOW	elixir/assets/js/popover.js	1	// A standalone popover/tooltip controller.	COMMENT
LOW	rust/Cargo.toml	341	# merge. Measured on `firezone-gateway` and `firezone-headless-client`, raising this	COMMENT
LOW	rust/deny.toml	1	# This template contains all of the possible sections and their default values	COMMENT
LOW	rust/deny.toml	41		COMMENT
LOW	rust/deny.toml	61	# If true, metadata will be collected with `--all-features`. Note that this can't	COMMENT
LOW	rust/deny.toml	81	# This section is considered when running `cargo deny check advisories`	COMMENT
LOW	rust/deny.toml	141	"Unicode-3.0",	COMMENT
LOW	rust/deny.toml	181	# when running the license check, otherwise the clarification will be ignored	COMMENT
LOW	rust/deny.toml	201	multiple-versions = "deny"	COMMENT
LOW	rust/deny.toml	221	#{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is allowed" },	COMMENT
LOW	rust/deny.toml	241	# "rustls",	COMMENT
LOW	rust/deny.toml	301	"winnow",	COMMENT
LOW	rust/gui-client/src-package-identity/src/lib.rs	1	//! Identity of the Firezone sparse MSIX package.	COMMENT
LOW	rust/gui-client/src-ipc/src/lib.rs	41	pub struct WrongUser;	COMMENT
LOW	rust/gui-client/src-ipc/src/lib.rs	61	/// UDS support, so in a year or two we might be better off making it UDS	COMMENT
LOW	rust/gui-client/src-ipc/src/windows.rs	21	},	COMMENT
LOW	rust/gui-client/src-ipc/src/windows.rs	41	/// because the GUI is a full-trust packaged app: it runs as the	COMMENT
LOW	rust/gui-client/src-ipc/src/windows.rs	81	/// run` / `cargo test` process has no MSIX identity, so opening	COMMENT
LOW	rust/gui-client/src-ipc/src/windows.rs	301	/// Public because the GUI Client reuses this for deep links. Eventually that code	COMMENT
LOW	rust/gui-client/src-ipc/src/unix/peer_check.rs	1	//! Verify that the peer of a connected Unix Domain Socket is a Firezone	COMMENT
LOW	rust/gui-client/src-ipc/src/unix/peer_check/linux.rs	41		COMMENT
LOW	rust/gui-client/src-tauri/build.rs	1	use anyhow::{Context as _, Result};	COMMENT
LOW	rust/gui-client/src-tauri/build.rs	21	// MSIX identity claim makes the kernel fail `CreateProcess` with	COMMENT
LOW	rust/gui-client/src-tauri/src/launch_lock.rs	1	//! Advisory file lock used to coordinate first-instance detection.	COMMENT
LOW	rust/gui-client/src-tauri/src/launch_lock.rs	81	#[cfg(test)]	COMMENT
LOW	rust/gui-client/src-tauri/src/lib.rs	21	pub mod gui;	COMMENT
LOW	rust/gui-client/src-tauri/src/gui.rs	581	/// We acquired the launch lock and now own the GUI IPC pipe	COMMENT
LOW	rust/gui-client/src-tauri/src/package_identity.rs	1	//! Ensures the GUI process carries the Firezone sparse-MSIX package	COMMENT
LOW	rust/gui-client/src-tauri/src/package_identity.rs	21	#[error("Registered package identity for the current user; a restart is required")]	COMMENT
LOW	rust/gui-client/src-tauri/src/package_identity.rs	41	/// package for the current user (no admin needed once provisioned).	COMMENT
LOW	rust/gui-client/src-tauri/src/package_identity.rs	81	/// [`InstallationCorrupt`].	COMMENT
LOW	rust/gui-client/src-tauri/src/settings.rs	21		COMMENT
LOW	rust/gui-client/src-tauri/src/mdm_migration.rs	1	//! One-shot migration of MDM policy values from the per-user	COMMENT
LOW	…gui-client/src-tauri/src/bin/firezone-client-tunnel.rs	61	#[arg(short, long, env = "LOG_DIR")]	COMMENT
LOW	…st/gui-client/src-tauri/src/bin/firezone-gui-client.rs	281	/// from an admin terminal, or with "Run as administrator" in the right-click menu.	COMMENT
LOW	…st/gui-client/src-tauri/src/bin/firezone-gui-client.rs	301		COMMENT
LOW	…st/gui-client/src-tauri/src/bin/firezone-gui-client.rs	381	OpenDeepLink(DeepLink),	COMMENT
LOW	rust/gui-client/src-tauri/src/bin/register-sparse.rs	1	//! WiX deferred custom actions that register / deregister the	COMMENT
LOW	rust/gui-client/src-tauri/src/bin/register-sparse.rs	21	//! handle it as defence-in-depth (e.g. someone bypasses the	COMMENT
LOW	rust/gui-client/src-tauri/src/bin/register-sparse.rs	201	use windows::{	COMMENT
LOW	rust/gui-client/src-tauri/src/bin/register-sparse.rs	401	/// otherwise piped in via `CustomActionData`.	COMMENT
LOW	rust/gui-client/src-tauri/src/gui/os_windows.rs	41	/// The AppUserModelID Windows attributes our notifications to	COMMENT
LOW	rust/gui-client/src-tauri/src/gui/system_tray.rs	21		COMMENT
LOW	…gui-client/src-tauri/src/gui/system_tray/compositor.rs	21		COMMENT
LOW	…st/gui-client/src-tauri/src/gui/system_tray/builder.rs	21	Separator,	COMMENT
LOW	…st/gui-client/src-tauri/src/gui/system_tray/builder.rs	61	AddFavorite(ResourceId),	COMMENT
LOW	rust/tools/tidy-dependabot-pr/src/main.rs	1	//! Tidies Dependabot pull requests so that squash-merged commit messages on	COMMENT
LOW	rust/tools/tidy-dependabot-pr/src/main.rs	81	/// line; a single-dependency update has none, so the filter naturally yields an	COMMENT
LOW	rust/tests/seeded-rng/lib.rs	1	//! Seeds the random number generators a process draws from.	COMMENT
LOW	rust/tests/loadtest/loadtest.example.toml	1	# Loadtest Configuration	COMMENT
LOW	rust/tests/loadtest/loadtest.example.toml	41	# WebSocket connection testing	COMMENT
LOW	rust/tests/loadtest/loadtest.example.toml	61	# address = "127.0.0.1:3478"	COMMENT
LOW	rust/tests/loadtest/tests/echo_integration.rs	1	// #![allow(clippy::unwrap_used)]	COMMENT
LOW	rust/tests/loadtest/tests/echo_integration.rs	21	// self.0.kill().ok();	COMMENT
LOW	rust/tests/loadtest/tests/echo_integration.rs	41	// .port()	COMMENT
LOW	rust/tests/loadtest/tests/echo_integration.rs	61	// .env("RUST_LOG", "warn")	COMMENT
LOW	rust/tests/loadtest/tests/echo_integration.rs	81	// .spawn()	COMMENT
LOW	rust/tests/loadtest/tests/echo_integration.rs	101	// panic!(	COMMENT
210 more matches not shown…

Decorative Section Separators22 hits · 64 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	elixir/README.md	26	# --------------------	COMMENT
MEDIUM⚡	elixir/README.md	30	# ---------------------------------------------------------	COMMENT
MEDIUM⚡	elixir/README.md	35	# ---------------------	COMMENT
MEDIUM⚡	elixir/README.md	39	# ------------------	COMMENT
MEDIUM	rust/mise.toml	40	# =============================================================================	COMMENT
MEDIUM	rust/mise.toml	42	# =============================================================================	COMMENT
MEDIUM	rust/mise.toml	102	# =============================================================================	STRING
MEDIUM	rust/mise.toml	104	# =============================================================================	STRING
MEDIUM	rust/mise.toml	182	# =============================================================================	STRING
MEDIUM	rust/mise.toml	184	# =============================================================================	STRING
MEDIUM	rust/relay/server/src/main.rs	639	// ┌──┼──┼──────────────────────────┐	COMMENT
MEDIUM	rust/relay/server/src/main.rs	641	// └──┴──┴──────────────────────────┘	COMMENT
MEDIUM	swift/apple/.swiftlint.yml	9	# ============================================================================	COMMENT
MEDIUM	swift/apple/.swiftlint.yml	11	# ============================================================================	COMMENT
MEDIUM	swift/apple/.swiftlint.yml	35	# ============================================================================	COMMENT
MEDIUM	swift/apple/.swiftlint.yml	37	# ============================================================================	COMMENT
MEDIUM	swift/apple/.swiftlint.yml	87	# ============================================================================	COMMENT
MEDIUM	swift/apple/.swiftlint.yml	89	# ============================================================================	COMMENT
MEDIUM	swift/apple/.swiftlint.yml	142	# ============================================================================	COMMENT
MEDIUM	swift/apple/.swiftlint.yml	144	# ============================================================================	COMMENT
MEDIUM	swift/apple/mise.toml	22	# =============================================================================	COMMENT
MEDIUM	swift/apple/mise.toml	24	# =============================================================================	COMMENT

Fake / Example Data31 hits · 31 pts

Severity	File	Line	Snippet	Context
LOW	…ir/priv/static/downloads/firezone-sentinel-sample.json	24	"email": "admin@example.com",	CODE
LOW	…ir/priv/static/downloads/firezone-sentinel-sample.json	43	"email": "admin@example.com",	CODE
LOW	…ir/priv/static/downloads/firezone-sentinel-sample.json	87	"actor_email": "admin@example.com",	CODE
LOW	…ir/priv/static/downloads/firezone-sentinel-sample.json	124	"actor_email": "admin@example.com",	CODE
LOW	rust/gui-client/src-cli/src/main.rs	417	actor_name: Some("Jane Doe".to_owned()),	CODE
LOW	rust/gui-client/src-tauri/src/mock_tunnel.rs	89	actor_name: "Jane Doe".to_owned(),	CODE
LOW	rust/gui-client/src-tauri/src/gui/system_tray.rs	468	actor_name: "Jane Doe".into(),	CODE
LOW	rust/gui-client/src-frontend/screenshots.test.tsx	146	SignedIn: { account_slug: "example-corp", actor_name: "Jane Doe" },	CODE
LOW	rust/libs/connlib/tunnel-proto/src/messages/client.rs	451	"actor_name": "Jane Doe",	CODE
LOW	rust/libs/connlib/tunnel-proto/src/messages/client.rs	472	"actor_name": "Jane Doe",	CODE
LOW	rust/libs/connlib/tunnel-proto/src/messages/client.rs	489	"actor_name": "Jane Doe",	CODE
LOW	rust/libs/connlib/tunnel-proto/src/messages/client.rs	505	"actor_name": "Jane Doe",	CODE
LOW	rust/libs/connlib/tunnel-proto/src/messages/client.rs	515	assert_eq!(init.actor_name, "Jane Doe");	CODE
LOW	rust/libs/connlib/tunnel-proto/src/messages/client.rs	538	"actor_name": "Jane Doe"	CODE
LOW	rust/libs/connlib/tunnel-proto/src/messages/client.rs	751	"actor_name": "Jane Doe",	CODE
LOW	rust/libs/connlib/tunnel-proto/src/messages/client.rs	813	"actor_name": "Jane Doe",	CODE
LOW	rust/libs/client-shared/src/lib.rs	336	actor_name: "Jane Doe".to_owned(),	CODE
LOW	rust/libs/client-shared/src/lib.rs	351	assert_eq!(connected.actor_name, "Jane Doe");	CODE
LOW	…/android/features/session/ui/compose/ScreenshotTest.kt	151	actorName = "Jane Doe",	CODE
LOW	…debug/java/dev/firezone/android/tunnel/MockFixtures.kt	16	const val MOCK_ACTOR_NAME = "Jane Doe"	CODE
LOW	…irezoneKit/Tests/FirezoneKitTests/IPCClientTests.swift	117	let answer = TunnelStatus.connected(accountSlug: "acme", actorName: "Jane Doe")	CODE
LOW	…zoneKit/Tests/FirezoneKitTests/StoreSessionTests.swift	90	app.tunnel.actorName = "Jane Doe"	CODE
LOW	…zoneKit/Tests/FirezoneKitTests/StoreSessionTests.swift	96	try await waitUntil { app.store.actorName == "Jane Doe" }	CODE
LOW	…Kit/Sources/FirezoneKit/Mocks/Scenarios/connected.json	7	"actorName": "Jane Doe",	CODE
LOW	…/Sources/FirezoneKit/Mocks/Scenarios/x509-expired.json	7	"actorName": "Jane Doe",	CODE
LOW	…ces/FirezoneKit/Mocks/Scenarios/empty-device-pool.json	7	"actorName": "Jane Doe",	CODE
LOW	…/FirezoneKit/Mocks/Scenarios/custom-control-plane.json	7	"actorName": "Jane Doe",	CODE
LOW	…/FirezoneKit/Mocks/Scenarios/connected-large-logs.json	7	"actorName": "Jane Doe",	CODE
LOW	…rces/FirezoneKit/Mocks/Scenarios/managed-settings.json	7	"actorName": "Jane Doe",	CODE
LOW	…t/Sources/FirezoneKit/Mocks/Scenarios/x509-filled.json	7	"actorName": "Jane Doe",	CODE
LOW	…irezoneKit/Mocks/Scenarios/x509-unknown-attribute.json	7	"actorName": "Jane Doe",	CODE

AI Slop Vocabulary5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	rust/gui-client/mise.toml	32	# Windows cannot elevate a running process, so it goes through Sudo for Windows.	COMMENT
MEDIUM	rust/tools/tidy-dependabot-pr/src/main.rs	83	/// keeps it robust to anything Dependabot prepends, such as its "is rebasing"	COMMENT
MEDIUM	rust/libs/connlib/ip-packet/src/lib.rs	998	/// Essentially, the only time we need to update the ECN flags is:	COMMENT
MEDIUM	.github/workflows/fuzz-cmin.yml	8	# branch pushes the result back to that branch instead, e.g. after a harness	COMMENT
MEDIUM	.github/workflows/fuzz-nightly.yml	8	# harness. A dispatch can also narrow the run to a single target. Pull-request	COMMENT

Verbosity Indicators4 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW⚡	swift/apple/FirezoneNetworkExtension/Adapter.swift	663	// Step 1: Get system default resolvers	COMMENT
LOW⚡	swift/apple/FirezoneNetworkExtension/Adapter.swift	669	// Step 2: Validate addresses and filter out sentinel ranges and non-routable addresses	COMMENT
LOW⚡	swift/apple/FirezoneNetworkExtension/Adapter.swift	710	// Step 3: Fall back to Cloudflare DNS if no usable resolvers remain	COMMENT
LOW⚡	swift/apple/FirezoneNetworkExtension/Adapter.swift	718	// Step 4: Send to connlib	COMMENT

Structural Annotation Overuse4 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW⚡	swift/apple/FirezoneNetworkExtension/Adapter.swift	663	// Step 1: Get system default resolvers	COMMENT
LOW⚡	swift/apple/FirezoneNetworkExtension/Adapter.swift	669	// Step 2: Validate addresses and filter out sentinel ranges and non-routable addresses	COMMENT
LOW⚡	swift/apple/FirezoneNetworkExtension/Adapter.swift	710	// Step 3: Fall back to Cloudflare DNS if no usable resolvers remain	COMMENT
LOW⚡	swift/apple/FirezoneNetworkExtension/Adapter.swift	718	// Step 4: Send to connlib	COMMENT

Self-Referential Comments3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	scripts/gateway-systemd-install.sh	194	# Define the target directory and binary path	COMMENT
MEDIUM	scripts/gateway-systemd-install.sh	225	# Create the directory if it doesn’t exist	COMMENT
MEDIUM	.github/workflows/publish-release.yml	241	# Create the PR	COMMENT

Synthetic Comment Markers1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	…firezone/android/features/splash/ui/SplashViewModel.kt	184	// If already granted, mark as requested and don't show the screen	COMMENT

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	rust/tests/loadtest/loadtest.example.toml	6	# Usage:	COMMENT
LOW	swift/apple/FirezoneNetworkExtension/Channel.swift	53	/// Example usage:	COMMENT

Slop Phrases1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	rust/libs/telemetry/src/feature_flags.rs	79	// Exhaustive destruction so we don't forget to update this when we add a flag.	COMMENT

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	scripts/firezone-client-gui-install.sh	20	# Check if the user is already in the group	COMMENT

firezone/firezone

Open-Source Code Quality, Security and Technical Debt Review