0.9

Adjusted Signal

0.9

Raw Pattern Score

100%

Time Factor

2026-10-29

Last Push

4.9K

Stars

Language

157.7K

Lines of Code

808

Files

111

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 2.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 65 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.8/100 · LOW

Are imports declared and package/API names verified? 46 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 6 finding(s).

PR Review Velocity Impact 3.6/100 · LOW

Which changes need focused human review? 111 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 2LOW 109

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 111 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Fake / Example Data46 hits · 56 pts

Severity	File	Line	Snippet	Context
LOW	internal/coss/webhook/testdata/gitlab/tag_push.json	10	"user_name": "Jane Doe",	CODE
LOW	internal/coss/webhook/testdata/gitlab/push.json	10	"user_name": "Jane Doe",	CODE
LOW	internal/coss/webhook/testdata/gitlab/push.json	31	"name": "Jane Doe",	CODE
LOW	internal/coss/webhook/testdata/azure/push.json	18	"name": "Jane Doe",	CODE
LOW	internal/coss/webhook/testdata/azure/push.json	46	"displayName": "Jane Doe",	CODE
LOW	internal/coss/webhook/testdata/gitea/push.json	12	"name": "Jane Doe",	CODE
LOW	internal/coss/webhook/testdata/gitea/push.json	17	"name": "Jane Doe",	CODE
LOW	internal/coss/webhook/testdata/github/push.json	19	"name": "Jane Doe",	CODE
LOW	…ss/webhook/testdata/bitbucket-server/refs_changed.json	8	"displayName": "Jane Doe",	CODE
LOW	…hook/testdata/bitbucket-cloud/pullrequest_created.json	24	"display_name": "Jane Doe",	CODE
LOW	…ternal/coss/webhook/testdata/bitbucket-cloud/push.json	71	"display_name": "Jane Doe",	CODE
LOW	internal/coss/secrets/azure/provider.go	83	return azcore.AccessToken{Token: "fake-token"}, nil	CODE
LOW	…s/storage/environments/git/bitbucket/bitbucket_test.go	202	"display_name": "John Doe",	CODE
LOW	…s/storage/environments/git/bitbucket/bitbucket_test.go	230	AuthorName: new("John Doe"),	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1721	"email": "user@example.com",	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1724	"name": "John Doe",	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1729	"io.flipt.auth.jwt.email": "user@example.com",	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1732	"io.flipt.auth.jwt.name": "John Doe",	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1734	method.StorageMetadataClaims: `{"user":{"email":"user@example.com","image":"https://example.com/avatar.jpg","name":"	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1734	method.StorageMetadataClaims: `{"user":{"email":"user@example.com","image":"https://example.com/avatar.jpg","name":"	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1888	"email": "user@example.com",	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1889	"name": "John Doe"	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1897	"io.flipt.auth.jwt.email": "user@example.com",	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1898	"io.flipt.auth.jwt.name": "John Doe",	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1899	method.StorageMetadataClaims: `{"user":{"email":"user@example.com","name":"John Doe"}}`,	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1899	method.StorageMetadataClaims: `{"user":{"email":"user@example.com","name":"John Doe"}}`,	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1943	"email": "admin@example.com"	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1951	"io.flipt.auth.jwt.email": "admin@example.com",	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1952	method.StorageMetadataClaims: `{"io.flipt.auth.role":"admin","user":{"email":"admin@example.com"}}`,	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1976	"email": "user@example.com",	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1977	"name": "John Doe"	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1985	"io.flipt.auth.jwt.email": "user@example.com", // From default path	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1987	method.StorageMetadataClaims: `{"name":"Custom Name","user":{"email":"user@example.com","name":"John Doe"}}`,	CODE
LOW⚡	…ternal/server/authn/middleware/grpc/middleware_test.go	1987	method.StorageMetadataClaims: `{"name":"Custom Name","user":{"email":"user@example.com","name":"John Doe"}}`,	CODE
LOW	internal/storage/environments/git/store_test.go	1320	Author: &object.Signature{Name: "test", Email: "test@test.com", When: time.Now()},	CODE
LOW	internal/storage/environments/git/store_test.go	1328	storagegit.WithSignature("test", "test@test.com"),	CODE
LOW	internal/storage/git/repository_test.go	393	Author: &object.Signature{Name: "test", Email: "test@test.com", When: time.Now()},	CODE
LOW	internal/storage/git/repository_test.go	1115	Author: &object.Signature{Name: "test", Email: "test@test.com", When: time.Now()},	CODE
LOW	internal/storage/git/repository_test.go	1131	WithSignature("test", "test@test.com"),	CODE
LOW	internal/storage/git/repository_test.go	1224	Author: &object.Signature{Name: "test", Email: "test@test.com", When: time.Now()},	CODE
LOW	internal/storage/git/repository_test.go	1240	WithSignature("test", "test@test.com"),	CODE
LOW	internal/storage/git/repository_test.go	1309	Author: &object.Signature{Name: "test", Email: "test@test.com", When: time.Now()},	CODE
LOW	internal/storage/git/repository_test.go	1367	WithSignature("test", "test@test.com"),	CODE
LOW	internal/storage/git/repository_test.go	1477	WithSignature("test", "test@test.com"),	CODE
LOW	internal/storage/git/repository_test.go	1557	WithSignature("test", "test@test.com"),	CODE
LOW	internal/storage/git/repository_test.go	1633	WithSignature("test", "test@test.com"),	CODE

Over-Commented Block39 hits · 39 pts

Severity	File	Line	Snippet	Context
LOW	install.sh	1	#!/bin/sh	COMMENT
LOW	ui/playwright.config.ts	61		COMMENT
LOW	ui/playwright.config.ts	81	// },	COMMENT
LOW	ui/jest.config.ts	21		COMMENT
LOW	ui/jest.config.ts	41	// "clover"	COMMENT
LOW	ui/jest.config.ts	61	// A path to a module which exports an async function that is triggered once before all test suites	COMMENT
LOW	ui/jest.config.ts	81	// "mjs",	COMMENT
LOW	ui/jest.config.ts	101	// An enum that specifies notification mode. Requires { notify: true }	COMMENT
LOW	ui/jest.config.ts	121		COMMENT
LOW	ui/jest.config.ts	141		COMMENT
LOW	ui/jest.config.ts	161	// ],	COMMENT
LOW	ui/jest.config.ts	181	// "\\.pnp\\.[^\\/]+$"	COMMENT
LOW	config/local.yml	1	# yaml-language-server: $schema=https://raw.githubusercontent.com/flipt-io/flipt/main/config/flipt.schema.json	COMMENT
LOW	config/local.yml	21	# These override the defaults but can still be overridden by	COMMENT
LOW	internal/cmd/http_test.go	461	}	COMMENT
LOW	internal/cmd/http.go	341	// evaluationCrossOriginExemptPattern exempts browser cross-origin POSTs to	COMMENT
LOW	internal/names/refslug.go	1	package names	COMMENT
LOW	internal/config/config.go	41	stringToEnumHookFunc(stringToAuthMethod),	COMMENT
LOW	internal/config/authentication.go	601	return nil	COMMENT
LOW	internal/config/authorization.go	21	Exclude AuthorizationExcludeConfig `json:"exclude,omitempty" mapstructure:"exclude" yaml:"exclude,omitempty"`	COMMENT
LOW	internal/config/testdata/default.yml	1	# log:	COMMENT
LOW	…nal/config/testdata/server/https_missing_cert_file.yml	1	# log:	COMMENT
LOW	…al/config/testdata/server/https_not_found_cert_key.yml	1	# log:	COMMENT
LOW	…rnal/config/testdata/server/https_missing_cert_key.yml	1	# log:	COMMENT
LOW	internal/config/testdata/server/grpc_keepalive.yml	1	# log:	COMMENT
LOW	internal/config/testdata/server/grpc_keepalive.yml	21	# host: 0.0.0.0	COMMENT
LOW	…l/config/testdata/server/https_not_found_cert_file.yml	1	# log:	COMMENT
LOW	internal/coss/webhook/webhook.go	81	// Name is the provider's raw event name (e.g. "push", "Push Hook",	COMMENT
LOW	internal/coss/webhook/webhook.go	141		COMMENT
LOW	internal/server/middleware/grpc/middleware.go	341	// ChainStreamServer creates a single interceptor out of a chain of many stream interceptors.	COMMENT
LOW	internal/server/authn/method/oidc/server.go	61	}	COMMENT
LOW	internal/otel/metrics/metrics.go	21	// MustInt64 returns an instrument provider based on the global Meter.	COMMENT
LOW	internal/otel/metrics/metrics.go	81	return mustFloat64Meter{}	COMMENT
LOW	internal/storage/authn/auth.go	21	// Store persists Authentication instances.	COMMENT
LOW	internal/storage/git/repository_test.go	1321	// advances. After the next depth=1 fetch both branch heads are shallow	COMMENT
LOW	internal/credentials/credentials.go	101	method.HostKeyCallback = ssh.InsecureIgnoreHostKey()	COMMENT
LOW	internal/credentials/sshurl.go	21	// The sshUser parameter is the user from SSH credentials configuration.	COMMENT
LOW	.github/workflows/pr-review.yml	1	name: PR Review	COMMENT
LOW	rpc/v2/environments/environments_grpc.pb.go	41	// EnvironmentsServiceClient is the client API for EnvironmentsService service.	COMMENT

Verbosity Indicators7 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	cmd/flipt/license.go	830	// Step 1: Welcome screen	COMMENT
LOW	cmd/flipt/license.go	843	// Step 2: Choose license type	COMMENT
LOW⚡	cmd/flipt/license.go	856	// Step 3: Get license key	COMMENT
LOW⚡	cmd/flipt/license.go	865	// Step 4: For annual license, optionally get offline license file path	COMMENT
LOW	cmd/flipt/license.go	880	// Step 5: Validate the license	COMMENT
LOW	cmd/flipt/license.go	948	// Step 6: Update configuration file	COMMENT
LOW	cmd/flipt/license.go	988	// Step 7: Show success screen	COMMENT

Structural Annotation Overuse7 hits · 12 pts

Severity	File	Line	Snippet	Context
LOW	cmd/flipt/license.go	830	// Step 1: Welcome screen	COMMENT
LOW	cmd/flipt/license.go	843	// Step 2: Choose license type	COMMENT
LOW⚡	cmd/flipt/license.go	856	// Step 3: Get license key	COMMENT
LOW⚡	cmd/flipt/license.go	865	// Step 4: For annual license, optionally get offline license file path	COMMENT
LOW	cmd/flipt/license.go	880	// Step 5: Validate the license	COMMENT
LOW	cmd/flipt/license.go	948	// Step 6: Update configuration file	COMMENT
LOW	cmd/flipt/license.go	988	// Step 7: Show success screen	COMMENT

Hyper-Verbose Identifiers6 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	ui/src/components/UnsavedChangesModal.tsx	57	export function UnsavedChangesModalWrapper(props: UnsavedChangesModalProps) {	CODE
LOW	…mponents/environments/EnvironmentNamespaceSwitcher.tsx	222	export function EnvironmentNamespaceSwitcher() {	CODE
LOW	ui/src/components/rules/MultiDistributionForm.tsx	11	export default function MultiDistributionFormInputs(	CODE
LOW	ui/src/components/rules/SingleDistributionForm.tsx	14	export default function SingleDistributionFormInput(	CODE
LOW	ui/src/components/segments/ConstraintForm.tsx	134	function ConstraintValueArrayInput(props: ConstraintArrayInputProps) {	CODE
LOW	ui/src/components/segments/ConstraintForm.tsx	160	function ConstraintValueDateTimeInput(props: ConstraintInputProps) {	CODE

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	internal/server/authn/method/kubernetes/server.go	44	// The method allows services deployed into the same Kubernetes cluster as Flipt to leverage	COMMENT
MEDIUM	internal/server/authn/method/kubernetes/validator.go	23	// It is configured to leverage the local systems own service account token and the clusters	COMMENT

Redundant / Tautological Comments3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	install.sh	25	# Check if tput is available, stdout is a terminal, and tput can actually work with the current TERM	COMMENT
LOW	install.sh	79	# Check if OS is supported	COMMENT
LOW	install.sh	92	# Check if architecture is supported	COMMENT

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	install.sh	13	# Usage:	COMMENT

flipt-io/flipt

Open-Source Code Quality, Security and Technical Debt Review