The Deterministic Foundation for your SDLC
This report summarizes scanner evidence for flox/flox, a Rust project with 4,171 GitHub stars. SynthScan examined 193,253 lines of code across 643 source files, recording 1038 pattern matches distributed across 12 syntactic categories. The legacy adjusted pattern signal is 6.3 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 934 finding(s).
Are imports declared and package/API names verified? 1 finding(s).
Are wrappers, guards, and repeated structures necessary? 103 finding(s).
Which changes need focused human review? 1038 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1038 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …st_data/manually_generated/v1_curl_hello/manifest.toml | 1 | ## Flox Environment Manifest ----------------------------------------- | COMMENT |
| LOW | …st_data/manually_generated/v1_curl_hello/manifest.toml | 21 | # gum.version = "^0.14.5" | COMMENT |
| LOW | …st_data/manually_generated/v1_curl_hello/manifest.toml | 41 | # # - FLOX_ENV=/home/user/example/.flox/run | COMMENT |
| LOW | …st_data/manually_generated/v1_curl_hello/manifest.toml | 61 | COMMENT | |
| LOW | …st_data/manually_generated/v1_curl_hello/manifest.toml | 81 | ## $ flox build | COMMENT |
| LOW | …st_data/manually_generated/v1_curl_hello/manifest.toml | 101 | # "x86_64-darwin", | COMMENT |
| LOW | …/investigating-merge-queue-failures/scripts/collect.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | package-builder/closure.c | 21 | #include <stddef.h> | COMMENT |
| LOW | package-builder/sandbox.c | 21 | #include <fcntl.h> | COMMENT |
| LOW | package-builder/sandbox.c | 41 | // /proc). | COMMENT |
| LOW | package-builder/sandbox.c | 61 | static pthread_once_t init_once = PTHREAD_ONCE_INIT; | COMMENT |
| LOW | package-builder/sandbox.c | 81 | COMMENT | |
| LOW | package-builder/sandbox.c | 201 | // calls this before consulting sandbox_level or the original function | COMMENT |
| LOW | package-builder/sandbox.c | 221 | // TODO: find way to detect changes in /proc/self/exe rather than | COMMENT |
| LOW | package-builder/sandbox.c | 261 | // be more than enough for most cases. | COMMENT |
| LOW | package-builder/sandbox.c | 501 | return false; | COMMENT |
| LOW | package-builder/sandbox.c | 561 | // fatal on its own: it is context, not the access itself. Whether to abort is | COMMENT |
| LOW | package-builder/sandbox.c | 621 | // on another machine. Any path within the environment's closure is fine, | COMMENT |
| LOW | package-builder/glibc-bindings.h | 1 | #ifndef GLIBC_BINDINGS_H | COMMENT |
| LOW | package-builder/tests/run-tests.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 41 | /// | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 121 | /// ```json | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 141 | /// "title": "Page", | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 201 | /// | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 221 | /// "properties": { | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 241 | /// "format": "date-time" | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 261 | /// }, | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 281 | /// ] | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 321 | /// | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 341 | /// "systems": { | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 361 | } | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 381 | /// ], | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 401 | /// "type": "integer" | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 421 | fn from(value: &BuildStatusCounts) -> Self { | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 441 | /// { | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 481 | } | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 541 | /// | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 581 | /**JSON body returned for all error responses on the builds and | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 601 | /// ``` | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 681 | { | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 701 | /// "system" | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 721 | pub completed_seconds: i64, | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 821 | COMMENT | |
| LOW | cli/factory-api-v1/src/client.rs | 921 | on BuildResponse.status. The task sub-object reports the stored | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 941 | /// "completed_at": { | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 961 | /// { | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 981 | /// "format": "date-time" | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 1041 | /// "description": "Valid status values for tasks.\n\nMirrors the CHECK constraint as of migration 1.8.0:\nstatus I | COMMENT |
| LOW | cli/factory-api-v1/src/client.rs | 1141 | /// | COMMENT |
| LOW | cli/factory-api-v1/src/hooks.rs | 1 | use std::sync::Arc; | COMMENT |
| LOW | cli/factory-api-v1/src/status.rs | 1 | //! Hand-written, tolerant replacement for the generated `BuildResponse.status` | COMMENT |
| LOW | cli/floxhub-client/src/factory.rs | 41 | /// Deliberately carries no detail: the calling verb knows what it asked | COMMENT |
| LOW | cli/floxhub-client/src/factory.rs | 61 | /// The cancel endpoint reported HTTP 409, 422, or 5xx. | COMMENT |
| LOW | cli/floxhub-client/src/factory.rs | 161 | /// a missing build, an auth rejection, a server-side fault, and a 200 whose body | COMMENT |
| LOW | cli/floxhub-client/src/factory.rs | 181 | Some(409 | 422 | 500..=599) => FactoryClientError::Server(api), | COMMENT |
| LOW | cli/floxhub-client/src/factory.rs | 241 | /// filter": a default `BuildFilters` requests every build, and the emitted | COMMENT |
| LOW | cli/floxhub-client/src/factory.rs | 261 | COMMENT | |
| LOW | cli/floxhub-client/src/client.rs | 181 | Ok(()) | COMMENT |
| LOW | cli/floxhub-client/src/client.rs | 1501 | mock.assert(); | COMMENT |
| LOW | cli/floxhub-client/src/error.rs | 121 | /// Common error type for catalog API operations. | COMMENT |
| 818 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …st_data/manually_generated/v1_curl_hello/manifest.toml | 7 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM | …st_data/manually_generated/v1_curl_hello/manifest.toml | 16 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM | …st_data/manually_generated/v1_curl_hello/manifest.toml | 27 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM | …st_data/manually_generated/v1_curl_hello/manifest.toml | 34 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM | …st_data/manually_generated/v1_curl_hello/manifest.toml | 48 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …st_data/manually_generated/v1_curl_hello/manifest.toml | 66 | ## ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | …st_data/manually_generated/v1_curl_hello/manifest.toml | 73 | ## ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | …st_data/manually_generated/v1_curl_hello/manifest.toml | 83 | ## ------------------------------------------------------------------ | COMMENT |
| MEDIUM | …/investigating-merge-queue-failures/scripts/collect.sh | 52 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/investigating-merge-queue-failures/scripts/collect.sh | 55 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/investigating-merge-queue-failures/scripts/collect.sh | 66 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/investigating-merge-queue-failures/scripts/collect.sh | 70 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/investigating-merge-queue-failures/scripts/collect.sh | 89 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/investigating-merge-queue-failures/scripts/collect.sh | 91 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/investigating-merge-queue-failures/scripts/collect.sh | 123 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …/investigating-merge-queue-failures/scripts/collect.sh | 126 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | package-builder/tests/run-tests.sh | 26 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | package-builder/tests/run-tests.sh | 30 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | package-builder/tests/run-tests.sh | 67 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | package-builder/tests/run-tests.sh | 76 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | package-builder/tests/run-tests.sh | 122 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | package-builder/tests/run-tests.sh | 124 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | package-builder/tests/run-tests.sh | 132 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | package-builder/tests/run-tests.sh | 134 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | package-builder/tests/run-tests.sh | 332 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | package-builder/tests/run-tests.sh | 337 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | package-builder/tests/run-tests.sh | 345 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | package-builder/tests/run-tests.sh | 347 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | cli/tests/setup_suite.bash | 272 | # ------------------------ | COMMENT |
| MEDIUM | cli/tests/setup_suite.bash | 370 | # ---------------------------- | COMMENT |
| MEDIUM | cli/tests/test_support.bash | 143 | # ---------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-manifest/src/lib.rs | 2 | //! ┌───────────────────────────────────────┐ | COMMENT |
| MEDIUM⚡ | cli/flox-manifest/src/lib.rs | 11 | //! via serde will have a different │ ┌──Validated───────►TypedOnly │ | COMMENT |
| MEDIUM⚡ | cli/flox-manifest/src/lib.rs | 13 | //! comments, and won't have a │ │ │ ┌──────────┘ │ │ | COMMENT |
| MEDIUM⚡ | cli/flox-manifest/src/lib.rs | 15 | //! dealbreaker. │ │ Migrated───────► MigratedTypedOnly │ | COMMENT |
| MEDIUM⚡ | cli/flox-manifest/src/lib.rs | 19 | //! └───────────────────────────────────────┘ | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 479 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 488 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 497 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 504 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 536 | ## ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 543 | ## ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 553 | ## ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 603 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 612 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 621 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 628 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 660 | ## ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 667 | ## ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 677 | ## ------------------------------------------------------------------ | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 730 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 739 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 748 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 755 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 854 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 863 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 872 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 879 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 967 | ## ------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | cli/flox-rust-sdk/src/providers/manifest_init.rs | 976 | ## ------------------------------------------------------------------- | COMMENT |
| 43 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/adding-metrics-events/SKILL.md | 27 | ## Step 0: decide the shape before writing code | COMMENT |
| LOW | …nts/skills/investigating-merge-queue-failures/SKILL.md | 66 | ## Step 1: Collect failed runs | COMMENT |
| LOW | …nts/skills/investigating-merge-queue-failures/SKILL.md | 102 | ## Step 2: Collect failed jobs and their logs | COMMENT |
| LOW | …nts/skills/investigating-merge-queue-failures/SKILL.md | 130 | ## Step 3: Extract a signature | COMMENT |
| LOW | …nts/skills/investigating-merge-queue-failures/SKILL.md | 151 | ## Step 4: Classify — in this order | COMMENT |
| LOW | …nts/skills/investigating-merge-queue-failures/SKILL.md | 183 | ## Step 5: Report and update the catalog | COMMENT |
| LOW | …nts/skills/investigating-merge-queue-failures/SKILL.md | 210 | ## Step 6: Write an HTML report | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 95 | // Step 3: Setup root span with PID, so that logs contain PID. | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 102 | // Step 4: Setup Sentry, so that we get exception reports. | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 107 | // Step 5: Catch errors from sub-reaper and setsid. | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 117 | // Step 6: Set up signal handlers (among other watchers). | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 124 | // Step 7: Signal SIGUSR1 when all setup and possible errors have passed. | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 128 | // Step 8: Spawn non-essential GC threads | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 132 | // Step 9: Enter the monitoring loop | COMMENT |
| LOW | cli/flox-activations/src/cli/executive/mod.rs | 70 | // Step 1: Extract context which we need to do anything. | COMMENT |
| LOW | cli/flox-activations/src/cli/executive/mod.rs | 83 | // Step 2: Setup logger, so that we can record errors. | COMMENT |
| LOW | cli/flox/src/commands/run.rs | 458 | // Step 1: scan flags until we see `--` or the first positional. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cli/floxhub-client/src/mock.rs | 289 | /// shape ever drifted. Stripping wherever the keys appear is the more robust | COMMENT |
| MEDIUM | cli/tests/shell-state-restoration/dump.zsh | 12 | # Only true shell internals and host/harness noise are filtered here; | COMMENT |
| MEDIUM | cli/tests/shell-state-restoration/dump.bash | 17 | # Only true shell internals and host/harness noise are filtered here; | COMMENT |
| LOW | …lox-rust-sdk/src/providers/services/process_compose.rs | 69 | #[error("{0}")] // just pass through whatever the message is | COMMENT |
| MEDIUM | cli/flox-rust-sdk/src/models/environment/generations.rs | 92 | /// Essentially the branches in a Floxmeta repository. | COMMENT |
| MEDIUM | cli/flox/src/commands/install.rs | 508 | // Essentially we're going to convert the `PackageNotFound` variants into | COMMENT |
| MEDIUM | cli/flox/src/commands/containerize/mod.rs | 352 | /// Essentially spawns a `docker load` or `podman load` process | COMMENT |
| MEDIUM | .github/workflows/claude-review.yml | 11 | # effort, harness and prompt, with no inline-comment tooling. Use it for | COMMENT |
| MEDIUM | .github/scripts/classify-ci-scope.sh | 43 | # that would widen the allowlist. There is no shell-test harness anywhere in | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/flox-rust-sdk/src/models/environment/uninstall.rs | 274 | /// The purpose of this function is to determine the _new_ list of outputs | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 95 | // Step 3: Setup root span with PID, so that logs contain PID. | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 102 | // Step 4: Setup Sentry, so that we get exception reports. | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 107 | // Step 5: Catch errors from sub-reaper and setsid. | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 117 | // Step 6: Set up signal handlers (among other watchers). | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 124 | // Step 7: Signal SIGUSR1 when all setup and possible errors have passed. | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 128 | // Step 8: Spawn non-essential GC threads | COMMENT |
| LOW⚡ | cli/flox-activations/src/cli/executive/mod.rs | 132 | // Step 9: Enter the monitoring loop | COMMENT |
| LOW | cli/flox-activations/src/cli/executive/mod.rs | 70 | // Step 1: Extract context which we need to do anything. | COMMENT |
| LOW | cli/flox-activations/src/cli/executive/mod.rs | 83 | // Step 2: Setup logger, so that we can record errors. | COMMENT |
| LOW | cli/flox/src/commands/run.rs | 458 | // Step 1: scan flags until we see `--` or the first positional. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | cli/tests/setup_suite.bash | 229 | # Create a GPG key to test commit signing. | COMMENT |
| MEDIUM | cli/tests/setup_suite.bash | 252 | # Create a temporary `gitconfig' suitable for this test suite. | COMMENT |
| MEDIUM | cli/tests/setup_suite.bash | 260 | # Create a temporary `ssh' key for use by `git'. | COMMENT |
| MEDIUM | cli/tests/test_support.bash | 194 | # Create a set of dotfiles to simulate the sorts of things users can do that | COMMENT |
| MEDIUM | cli/flox-rust-sdk/src/providers/build.rs | 4064 | # Create a valid executable in $out/bin for a clean build. | COMMENT |
| MEDIUM | buildenv/builder.pl | 416 | # Create the symlinks. | COMMENT |
| MEDIUM | buildenv/builder.pl | 880 | # Create the symlinks. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 42 | **Flox is a software environment platform for engineering teams** that delivers cryptographically pinned, reproducible e | CODE |
| MEDIUM | README.md | 145 | | **AI-ready** | Works with Claude Code, Cursor, Copilot, and Codex | Give AI coding agents a deterministic, reproducibl | CODE |
| MEDIUM | cli/flox-rust-sdk/src/utils/invocation_sources.rs | 31 | // Other agentic tools | COMMENT |
| MEDIUM | cli/flox-rust-sdk/src/utils/invocation_sources.rs | 69 | /// 2. Inference heuristics for CI, containerd, agentic tooling, and other contexts | COMMENT |
| MEDIUM | cli/flox-rust-sdk/src/utils/invocation_sources.rs | 87 | // Apply all inference heuristics (CI, containerd, agentic tools, etc.) | COMMENT |
| MEDIUM | cli/flox-rust-sdk/src/utils/invocation_sources.rs | 271 | // CI + containerd + agentic — all preserved | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | cli/flox-manifest/src/raw/mod.rs | 941 | self.inner.migrated_parsed.options.systems.as_ref(), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | cli/flox-manifest/src/lockfile/flake.rs | 57 | /// List of output names to install as requested by the user | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/tests/shell-state-restoration/dump.zsh | 16 | # Usage: | COMMENT |
| LOW | cli/tests/shell-state-restoration/dump.bash | 12 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/flox-rust-sdk/src/models/environment/mod.rs | 72 | // don't forget to update the man page | COMMENT |
| LOW | cli/flox-rust-sdk/src/models/environment/mod.rs | 74 | // don't forget to update the man page | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | buildenv/builder.pl | 922 | # Close the file | COMMENT |