2.1

Adjusted Signal

2.1

Raw Pattern Score

100%

Time Factor

2026-11-01

Last Push

8.2K

Stars

TypeScript

Language

321.8K

Lines of Code

2.5K

Files

272

Pattern Hits

2026-10-31

Scan Date

0.03

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 120 finding(s).

Hallucinated Dependency & Supply Chain Risk 7.8/100 · LOW

Are imports declared and package/API names verified? 136 finding(s).

Agent Over-Engineering Ratio 1.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 90 finding(s).

PR Review Velocity Impact 10.2/100 · LOW

Which changes need focused human review? 272 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 12HIGH 62MEDIUM 3LOW 195

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 272 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Magic Placeholder Names40 hits · 228 pts

Severity	File	Line	Snippet	Context
HIGH	README.md	133	const apiKey = "your-api-key";	CODE
HIGH	config/agent.example.json	18	"apiKey": "your-api-key",	CODE
HIGH	config/agent.example.json	84	"x-api-key": "your-api-key"	CODE
HIGH	mods/mcp/README.md	72	"MCP_APIKEY_ACCESS_KEY_ID": "your-apikey-access-key-id",	CODE
HIGH	mods/mcp/README.md	73	"MCP_APIKEY_ACCESS_KEY_SECRET": "your-apikey-access-key-secret"	CODE
HIGH	mods/mcp/README.md	101	"MCP_APIKEY_ACCESS_KEY_ID": "your-apikey-access-key-id",	CODE
HIGH	mods/mcp/README.md	102	"MCP_APIKEY_ACCESS_KEY_SECRET": "your-apikey-access-key-secret"	CODE
HIGH	mods/mcp/README.md	123	MCP_APIKEY_ACCESS_KEY_ID="your-apikey-access-key-id" \	CODE
HIGH	mods/mcp/README.md	124	MCP_APIKEY_ACCESS_KEY_SECRET="your-apikey-access-key-secret" \	CODE
HIGH	mods/mcp/claude_desktop_config.example.json	11	"MCP_APIKEY_ACCESS_KEY_ID": "your-apikey-access-key-id",	CODE
HIGH	mods/mcp/claude_desktop_config.example.json	12	"MCP_APIKEY_ACCESS_KEY_SECRET": "your-apikey-access-key-secret"	CODE
HIGH	mods/sdk/README.md	160	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	355	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	567	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	1078	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	1239	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	1437	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	1659	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	2082	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	2276	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	2872	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	3176	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/README.md	3339	const apiKey = "your-api-key";	CODE
HIGH	mods/sdk/src/Acls.ts	47	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/Workspaces.ts	71	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/Calls.ts	61	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/Trunks.ts	50	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/Secrets.ts	52	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/Agents.ts	52	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/Numbers.ts	61	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/ApiKeys.ts	52	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/Domains.ts	53	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/Applications.ts	77	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/sdk/src/Credentials.ts	52	* const apiKey = "your-api-key";	COMMENT
HIGH	mods/autopilot/README.md	112	"apiKey": "your-api-key",	CODE
HIGH	mods/autopilot/README.md	137	"apiKey": "your-api-key",	CODE
HIGH	mods/autopilot/README.md	161	"x-api-key": "your-api-key"	CODE
HIGH	mods/autopilot/.intro.md	110	"apiKey": "your-api-key",	CODE
HIGH	mods/autopilot/.intro.md	135	"apiKey": "your-api-key",	CODE
HIGH	mods/autopilot/.intro.md	159	"x-api-key": "your-api-key"	CODE

Hallucination Indicators12 hits · 120 pts

Severity	File	Line	Snippet	Context
CRITICAL	mods/sipnet/test/checkRefs.test.ts	111	).to.eventually.be.rejected.and.include({	CODE
CRITICAL	…/apiserver/test/utils/checkNumberPreconditions.test.ts	41	).to.be.rejected.and.eventually.have.property(	CODE
CRITICAL	…/apiserver/test/utils/checkNumberPreconditions.test.ts	57	).to.be.rejected.and.eventually.have.property(	CODE
CRITICAL	mods/ctl/src/commands/applications/eval.ts	109	rawAutopilotApplication.intelligence.config.testCases.scenarios.map(	CODE
CRITICAL	mods/conformance/test/regionsScenarios.test.ts	100	await this.cp.db.prisma.callRecord.create({	CODE
CRITICAL	mods/conformance/test/regionsScenarios.test.ts	141	this.cp.db.prisma.regionCredential.count({	CODE
CRITICAL	mods/conformance/test/billingScenarios.test.ts	116	const a = await this.world.db.prisma.billingAccount.findUniqueOrThrow({	CODE
CRITICAL	mods/conformance/test/billingScenarios.test.ts	136	await this.world.stripe.testHelpers.testClocks.create({	CODE
CRITICAL	mods/conformance/test/billingScenarios.test.ts	202	await this.world.stripe.testHelpers.testClocks.advance(this.clockId!, {	CODE
CRITICAL	mods/conformance/test/billingScenarios.test.ts	269	await this.world.stripe.billing.creditBalanceSummaries.retrieve({	CODE
CRITICAL	mods/conformance/test/api/identity.api.ts	259	expect(next).to.not.be.empty.and.not.equal(refreshToken);	CODE
CRITICAL	mods/conformance/test/api/calls.api.ts	76	world.stack.apiDb.prisma.callRecord.create({	CODE

Cross-Language Confusion (JS/TS)16 hits · 102 pts

Severity	File	Line	Snippet	Context
HIGH	mods/region-agent/src/cli.ts	177	print(	CODE
HIGH⚡	mods/region-agent/src/cli.ts	198	print(`Created public region ${r.id} (${r.ref}); not published yet.`);	CODE
HIGH⚡	mods/region-agent/src/cli.ts	199	print(`Enrollment token (single use, expires ${r.expiresAt}):\n${r.token}`);	CODE
HIGH⚡	mods/region-agent/src/cli.ts	200	print(	CODE
HIGH⚡	mods/region-agent/src/cli.ts	207	print(`Enrollment token for ${id} (single use, expires ${r.expiresAt}):`);	CODE
HIGH⚡	mods/region-agent/src/cli.ts	208	print(r.token);	CODE
HIGH⚡	mods/region-agent/src/cli.ts	213	print(	CODE
HIGH	mods/region-agent/src/cli.ts	242	print(`kept ${path.join(target, f)} (already there)`)	CODE
HIGH	mods/region-agent/src/cli.ts	244	print(hubNextSteps(target, leafPort ? Number(leafPort) : undefined));	CODE
HIGH	mods/region-agent/src/cli.ts	265	print(	CODE
HIGH	mods/region-agent/src/cli.ts	268	print(`Credentials saved to ${store.where}. Next: start the region.`);	CODE
HIGH	mods/region-agent/src/cli.ts	291	print(JSON.stringify(identity, null, 2));	CODE
HIGH	mods/region-agent/src/cli.ts	295	print(	CODE
HIGH⚡	mods/region-agent/src/cli.ts	315	print(names.length ? names.join("\n") : "(no secrets set)");	CODE
HIGH⚡	mods/region-agent/src/cli.ts	325	print(`Secret ${arg} set (the value stays in this region).`);	CODE
HIGH⚡	mods/region-agent/src/cli.ts	330	print(	CODE

Hyper-Verbose Identifiers74 hits · 74 pts

Severity	File	Line	Snippet	Context
LOW	python/fonoster-voice/tests/conftest.py	29	def pytest_collection_modifyitems(items):	CODE
LOW	python/fonoster-voice/tests/conftest.py	38	def pytest_runtest_makereport(item, call):	CODE
LOW	python/fonoster-voice/tests/test_case_ids.py	65	def test_a_failing_marked_test_carries_its_case_id_in_junit(tmp_path: Path):	STRING
LOW	python/fonoster-voice/tests/test_case_ids.py	72	def test_k_selects_the_marked_test_by_its_case_id(tmp_path: Path):	STRING
LOW	python/fonoster-voice/tests/test_server.py	45	def test_runs_handler_once_with_valid_signature():	CODE
LOW	python/fonoster-voice/tests/test_server.py	68	def test_rejects_bad_signatures_before_the_handler(appbridge):	CODE
LOW	python/fonoster-voice/tests/test_server.py	87	def test_sync_handler_rejected():	CODE
LOW	python/fonoster-voice/tests/test_server.py	98	def test_secret_required_unless_verification_is_off():	CODE
LOW	python/fonoster-voice/tests/test_server.py	105	def test_gather_rejects_and_end_fires_when_caller_hangs_up():	CODE
LOW	python/fonoster-voice/tests/test_server.py	131	def test_crashing_handler_hangs_up():	CODE
LOW	python/fonoster-voice/tests/test_server.py	147	def test_removed_methods_are_not_on_the_session():	CODE
LOW	python/fonoster-voice/tests/test_server.py	159	def test_two_argument_handlers_are_refused():	CODE
LOW	python/fonoster-voice/tests/test_server.py	167	def test_asgi_mount_verifies_and_runs_the_handler():	CODE
LOW	python/fonoster-voice/tests/test_server.py	206	def test_amd_result_reaches_the_handler():	CODE
LOW	python/fonoster-voice/tests/test_messages.py	11	def test_generated_messages_are_up_to_date():	CODE
LOW	python/fonoster-voice/tests/test_messages.py	17	def test_types_cover_both_directions():	CODE
LOW	python/fonoster-conformance/tests/test_match.py	4	def test_partial_objects_and_wildcards():	CODE
LOW	python/fonoster-conformance/tests/test_match.py	10	def test_operators_match_the_typescript_runner():	CODE
LOW⚡	python/fonoster-conformance/tests/test_match.py	21	def test_booleans_are_not_numbers():	CODE
LOW⚡	python/fonoster-conformance/tests/test_match.py	26	def test_interpolation_keeps_types():	CODE
LOW⚡	python/fonoster-conformance/tests/test_match.py	34	def test_shared_scenarios_validate():	CODE
LOW	…s/identity/src/exchanges/createExchangeRefreshToken.ts	70	function createExchangeRefreshToken(	CODE
LOW	…ds/identity/src/exchanges/createExchangeCredentials.ts	51	function createExchangeCredentials(	CODE
LOW	…entity/src/exchanges/createExchangeVerificationCode.ts	63	function createExchangeVerificationCode(	CODE
LOW	…anges/payloads/apikeys/createGetRefreshTokenPayload.ts	24	function createGetRefreshTokenPayload(	CODE
LOW	…anges/payloads/apikeys/createGetRefreshTokenPayload.ts	28	return async function createGetRefreshTokenPayload(	CODE
LOW	…hanges/payloads/apikeys/createGetAccessTokenPayload.ts	23	function createGetAccessTokenPayload(	CODE
LOW	…changes/payloads/users/createGetRefreshTokenPayload.ts	23	function createGetRefreshTokenPayload(	CODE
LOW	…xchanges/payloads/users/createGetAccessTokenPayload.ts	24	function createGetAccessTokenPayload(	CODE
LOW	…xchanges/payloads/users/createGetAccessTokenPayload.ts	28	return async function createGetAccessTokenPayload(	CODE
LOW	…ds/identity/src/utils/createIsValidVerificationCode.ts	33	function createIsValidVerificationCode(prisma: Prisma) {	CODE
LOW	…s/identity/src/utils/createGenerateVerificationCode.ts	29	function createGenerateVerificationCode(prisma: Prisma) {	CODE
LOW	…ds/identity/src/utils/createGenerateCallAccessToken.ts	24	function createGenerateCallAccessToken(identityConfig: IdentityConfig) {	CODE
LOW	…ds/identity/src/utils/createGetAccessKeyIdFromEmail.ts	22	function createGetAccessKeyIdFromEmail(prisma: Prisma) {	CODE
LOW	mods/identity/src/utils/createUpdateMembershipStatus.ts	24	function createUpdateMembershipStatus(identityConfig: IdentityConfig) {	CODE
LOW	mods/identity/src/utils/createGetUserByGitHubEmails.ts	27	function createGetUserByGitHubEmails(prisma: Prisma) {	CODE
LOW	mods/identity/src/utils/createGetApiKeyByAccessKeyId.ts	21	function createGetApiKeyByAccessKeyId(prisma: Prisma) {	CODE
LOW	…entity/src/utils/createGenerateWorkspaceInviteToken.ts	24	function createGenerateWorkspaceInviteToken(identityConfig: IdentityConfig) {	CODE
LOW	…entity/src/utils/createGenerateWorkspaceInviteToken.ts	25	return async function generateWorkspaceInviteToken(params: {	CODE
LOW	mods/identity/src/utils/createGetUserByAccessKeyId.ts	21	function createGetUserByAccessKeyId(prisma: Prisma) {	CODE
LOW	…ntity/src/utils/createGetUserByWorkspaceAccessKeyId.ts	21	function createGetUserByWorkspaceAccessKeyId(prisma: Prisma) {	CODE
LOW	mods/identity/src/utils/createIsUserContactVerified.ts	21	function createIsUserContactVerified(prisma: Prisma) {	CODE
LOW	mods/identity/src/utils/claimUnverifiedAccount.ts	37	function createClaimUnverifiedAccount(prisma: Prisma) {	CODE
LOW	…entity/src/workspaces/createRemoveUserFromWorkspace.ts	38	function createRemoveUserFromWorkspace(prisma: Prisma) {	CODE
LOW	…identity/src/workspaces/createInviteUserToWorkspace.ts	97	function createInviteUserToWorkspace(	CODE
LOW	…/identity/src/workspaces/createListWorkspaceMembers.ts	38	function createListWorkspaceMembers(prisma: Prisma) {	CODE
LOW	…orkspaces/createResendWorkspaceMembershipInvitation.ts	45	function createResendWorkspaceMembershipInvitation(	CODE
LOW	…dentity/src/verification/createSendVerificationCode.ts	49	function createSendVerificationCode(	CODE
LOW	…ity/src/verification/createBodyForVerificationEmail.ts	24	function createBodyForVerificationEmail(	CODE
LOW	…y/src/verification/createBodyForVerificationMessage.ts	24	function createBodyForVerificationMessage(	CODE
LOW	mods/identity/src/users/createSendResetPasswordCode.ts	48	function createSendResetPasswordCode(	CODE
LOW	mods/sipnet/src/numbers/convertToRoutrNumber.ts	53	function convertToRoutrNumberUpdate(	CODE
LOW	mods/common/src/net/assertPublicDestination.ts	255	export function assertPublicWebSocketUrlShape(	CODE
LOW	mods/common/src/utils/withErrorHandlingAndValidation.ts	24	function withErrorHandlingAndValidation(fn: Function, schema: z.ZodSchema) {	CODE
LOW	mods/common/src/whatsapp/disableWhatsAppSipCalling.ts	31	async function disableWhatsAppSipCalling(	CODE
LOW	…s/common/src/twilio/removeOtherTwilioSipCredentials.ts	28	async function removeOtherTwilioSipCredentials(	CODE
LOW	mods/common/src/twilio/provisionTwilioTrunk.ts	213	async function findOrCreateCredentialList(	CODE
LOW	mods/common/src/twilio/assignTwilioNumberToTrunk.ts	29	async function assignTwilioNumberToTrunk(	CODE
LOW	mods/sdk/src/utils.ts	63	function buildStructOverrideReverse(request) {	CODE
LOW	mods/apiserver/src/regions/runRegions.ts	253	export function createWorkspaceRegionHooks(publicRegions: PublicRegion[]) {	CODE
14 more matches not shown…

Over-Commented Block38 hits · 38 pts

Severity	File	Line	Snippet	Context
LOW	compose.yaml	1	# Fonoster on Docker Compose: the self-host bundle (ops/bundle/compose.yaml: NATS with JetStream,	COMMENT
LOW	config/autopilot-session.example.yaml	1	# The hosted Autopilot (rework-autopilot): an ordinary session app AppBridge dials.	COMMENT
LOW	config/autopilot-session.example.yaml	21	# Workspace Secrets (bring your own key): {<workspaceRef>: {<credentialRef>: key}}, or the	COMMENT
LOW	config/fonoster.example.yaml	1	# yaml-language-server: $schema=https://fonoster.com/schemas/fonoster.json	COMMENT
LOW	config/fonoster.example.yaml	41	# run without email; anything that needs it then fails with a clear error.	COMMENT
LOW	config/fonoster.example.yaml	81	url: nats://nats:4222	COMMENT
LOW	config/fonoster.example.yaml	101	# evaluations:	COMMENT
LOW	.devcontainer/initialize.sh	1	#!/bin/sh	COMMENT
LOW	.devcontainer/devcontainer.json	21	// On the host, before the containers exist: the dev config in .dev/ (secrets, keys, service	COMMENT
LOW	.devcontainer/config/fonoster.yaml	1	# Dev layer over .dev/config/fonoster.yaml (ops/rebuild/merge-config.cjs). Your own overrides:	COMMENT
LOW	.github/workflows/stack-smoke.yaml	1	name: Stack Smoke	COMMENT
LOW	.github/workflows/deploy.yaml	1	name: Deploy	COMMENT
LOW	.github/workflows/release.yaml	1	name: Release	COMMENT
LOW	.github/workflows/release.yaml	21	# Runs queue, never overlap. When main moves while the gate runs, that run stops without	COMMENT
LOW	mods/appbridge/scripts/scale.ts	21	// npx tsx mods/appbridge/scripts/scale.ts --calls 100 --seconds 30 [--replicas 1]	COMMENT
LOW	mods/appbridge/src/turn/remote.ts	21	import WebSocket from "ws";	COMMENT
LOW	mods/conformance/test/dashboard/prove.sh	1	#!/bin/sh	COMMENT
LOW	mods/conformance/src/runner/NatsRegionCellPeer.ts	21		COMMENT
LOW	ops/bundle/compose.http.yaml	1	# Plain HTTP instead of HTTPS, for a TLS proxy in front (Caddy, nginx, Traefik, a load balancer)	COMMENT
LOW	ops/bundle/init.sh	81		COMMENT
LOW	ops/bundle/compose.billing.yaml	1	# Fonoster Cloud's billing (rating, credits, admission, Stripe). Self-hosted installs don't need it.	COMMENT
LOW	ops/bundle/compose.region.yaml	1	# A private region on this machine (https://docs.fonoster.com/private-regions/install-region): the	COMMENT
LOW	ops/bundle/compose.yaml	1	# Fonoster on one machine with Docker Compose (https://docs.fonoster.com/self-hosting/install-compose).	COMMENT
LOW	ops/bundle/compose.tls.yaml	1	# SIP over TLS, off by default: uncomment the lines below and add this file to COMPOSE_FILE	COMMENT
LOW	ops/bundle/config/appbridge.yaml	1	# AppBridge. Each ${NAME} is read from AppBridge's environment (Compose passes .env). Edit this	COMMENT
LOW	ops/bundle/config/routr-edgeport.yaml	41	# SIP over TLS (off by default): uncomment with the routr lines in compose.tls.yaml, which	COMMENT
LOW	ops/release/npm-publish.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ops/ansible/test/throwaway.sh	1	#!/usr/bin/env bash	COMMENT
LOW	ops/ansible/roles/fonoster/tasks/main.yml	1	# Puts the host on fonoster_version with this inventory's .env, overrides and overlays.	COMMENT
LOW	ops/rebuild/compose.yaml	1	# The development layer on the self-host bundle (add-self-host-installer D6). ops/bundle/compose.yaml	COMMENT
LOW	ops/rebuild/config/catalog-seed.yaml	1	# Catalog seed for the rebuild stack (VO-B5): the base catalog, the same entries as the shipped	COMMENT
LOW	ops/rebuild/helm/fonoster-rebuild/values-cloud.yaml	1	# The whole platform in one release: control plane (apiserver with embedded Identity, Envoy,	COMMENT
LOW	…ebuild/helm/fonoster-rebuild/values-observability.yaml	1	# The default observability profile: every service exports OTLP to the chart's collector, which	COMMENT
LOW	ops/rebuild/helm/fonoster-rebuild/values.yaml	1	# Defaults install the data plane only (appbridge and Roomr nodes, as in a private cell). For the	COMMENT
LOW	ops/rebuild/helm/fonoster-rebuild/values.yaml	161	# http: { port: 8080, accountSid: "", authToken: "" }	COMMENT
LOW	ops/rebuild/helm/fonoster-rebuild/values.yaml	201	# app) uses the one range below on the node's address, and nothing coordinates ports between	COMMENT
LOW	ops/rebuild/helm/fonoster-rebuild/values.yaml	221	# unless sip.registrations is set; outbound INVITEs go to outboundProxy. `routr` is a Service	COMMENT
LOW	ops/rebuild/helm/fonoster-rebuild/values.yaml	321	records:	COMMENT

Unused Imports38 hits · 38 pts

Severity	File	Line	Context
LOW	…cs-site/images/run-from-source/gen_devcontainer_svg.py	8	CODE
LOW	python/generate_messages.py	7	CODE
LOW	python/generate_messages.py	10	CODE
LOW	python/fonoster-voice/tests/conftest.py	7	CODE
LOW	python/fonoster-voice/tests/test_case_ids.py	9	CODE
LOW	python/fonoster-voice/tests/test_server.py	1	CODE
LOW	python/fonoster-voice/tests/test_conformance.py	7	CODE
LOW	python/fonoster-voice/src/fonoster/voice/server.py	3	CODE
LOW	python/fonoster-voice/src/fonoster/voice/session.py	7	CODE
LOW	python/fonoster-voice/src/fonoster/voice/session.py	13	CODE
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	3	CODE
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	3	CODE
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	4	CODE
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	4	CODE
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	5	CODE
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	5	CODE
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	5	CODE
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	5	CODE
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	5	CODE
LOW	python/fonoster-voice/src/fonoster/voice/messages.py	5	CODE
LOW	python/fonoster-voice/src/fonoster/voice/errors.py	1	CODE
LOW	python/fonoster-voice/src/fonoster/voice/signature.py	3	CODE
LOW	python/pipecat-golden/golden_bot.py	11	CODE
LOW	…ster-conformance/src/fonoster_conformance/scenarios.py	8	CODE
LOW	…onoster-conformance/src/fonoster_conformance/runner.py	8	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	3	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	3	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	3	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	4	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	4	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	4	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	4	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	4	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	5	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	5	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	5	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	5	CODE
LOW	…fonoster-conformance/src/fonoster_conformance/match.py	3	CODE

Fake / Example Data30 hits · 34 pts

Severity	File	Line	Snippet	Context
LOW	README.md	152	name: "John Doe",	CODE
LOW	…identity/test/workspaces/inviteUserToWorkspace.test.ts	39	name: "John Doe",	CODE
LOW	mods/identity/test/users/createUser.test.ts	48	name: "John Doe",	CODE
LOW	mods/identity/test/users/createUser.test.ts	87	name: "John Doe",	CODE
LOW	mods/identity/test/users/createUser.test.ts	109	name: "John Doe",	CODE
LOW	mods/identity/test/users/createUser.test.ts	138	name: "John Doe",	CODE
LOW	mods/identity/test/users/getUser.test.ts	53	name: "John Doe",	CODE
LOW	mods/identity/test/invites/sendInvite.test.ts	39	recipient: "user@example.com",	CODE
LOW	mods/identity-client/test/endToEnd.test.ts	82	await client.updateWorkspace(ref, "Acme Corp", accessToken);	CODE
LOW	mods/identity-client/test/endToEnd.test.ts	84	"Acme Corp"	CODE
LOW	mods/identity-client/test/endToEnd.test.ts	109	expect(invite!.data).to.include("Acme Corp");	CODE
LOW	mods/mcp/src/prompts/createCallPrompt.ts	91	- Additional Data: {"name": "John Doe", "age": 30}	CODE
LOW	…ds/common/test/notifications/createEmailSender.test.ts	88	to: "user@example.com",	CODE
LOW	mods/sdk/README.md	373	name: "John Doe",	CODE
LOW	mods/sdk/README.md	406	name: "John Doe",	CODE
LOW	mods/sdk/README.md	466	name: "John Doe",	CODE
LOW	mods/sdk/README.md	1131	"name": "John Doe",	CODE
LOW	mods/sdk/README.md	2552	name: "John Doe",	CODE
LOW	mods/sdk/README.md	2584	name: "John Doe",	CODE
LOW	mods/sdk/README.md	2668	name: "John Doe",	CODE
LOW	mods/sdk/README.md	3229	"name": "John Doe",	CODE
LOW	mods/sdk/src/Calls.ts	119	* "name": "John Doe",	COMMENT
LOW	mods/sdk/src/Agents.ts	70	* name: "John Doe",	COMMENT
LOW	mods/sdk/src/Agents.ts	108	* name: "John Doe",	COMMENT
LOW	mods/sdk/src/Agents.ts	187	* name: "John Doe",	COMMENT
LOW	mods/sdk/src/Users.ts	58	* name: "John Doe",	COMMENT
LOW	mods/sdk/src/Users.ts	95	* name: "John Doe",	COMMENT
LOW	mods/sdk/src/Users.ts	197	* name: "John Doe",	COMMENT
LOW	mods/ctl/README.md	1072	-m, --metadata=<value> a JSON object the app receives with the session (e.g. '{"name": "John Doe"}')	CODE
LOW	mods/ctl/src/commands/sipnet/calls/create.ts	58	'a JSON object the app receives with the session (e.g. \'{"name": "John Doe"}\')'	CODE

Empty Error Handlers6 hits · 30 pts

Severity	File	Line	Snippet	Context
HIGH	python/fonoster-voice/src/fonoster/voice/server.py	168	except (asyncio.TimeoutError, StopAsyncIteration):	CODE
HIGH	python/fonoster-voice/src/fonoster/voice/server.py	43	except Exception: # noqa: BLE001	CODE
HIGH	python/fonoster-voice/src/fonoster/voice/server.py	176	except Exception: # noqa: BLE001	CODE
HIGH	python/fonoster-voice/src/fonoster/voice/session.py	496	except Exception: # noqa: BLE001 - a listener's failure must not break the session	CODE
HIGH	…onoster-conformance/src/fonoster_conformance/runner.py	67	except Exception:	CODE
HIGH	mods/appbridge/test/xfr/app.py	65	except asyncio.TimeoutError:	CODE

Excessive Try-Catch Wrapping8 hits · 9 pts

Severity	File	Line	Snippet	Context
LOW	python/fonoster-voice/src/fonoster/voice/server.py	36	except Exception as e: # noqa: BLE001	CODE
LOW	python/fonoster-voice/src/fonoster/voice/server.py	43	except Exception: # noqa: BLE001	CODE
LOW	python/fonoster-voice/src/fonoster/voice/server.py	176	except Exception: # noqa: BLE001	CODE
LOW	python/fonoster-voice/src/fonoster/voice/session.py	160	except Exception:	CODE
LOW	python/fonoster-voice/src/fonoster/voice/session.py	496	except Exception: # noqa: BLE001 - a listener's failure must not break the session	CODE
LOW	…onoster-conformance/src/fonoster_conformance/runner.py	67	except Exception:	CODE
LOW	…onoster-conformance/src/fonoster_conformance/runner.py	159	except Exception as e: # noqa: BLE001 - every failure becomes the scenario's reason	CODE
MEDIUM	…onoster-conformance/src/fonoster_conformance/runner.py	53	def _read(self) -> None:	CODE

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	compose.yaml	17	# (.devcontainer/, CONTRIBUTING.md); this file is the smoke/CI harness, not a development path.	COMMENT
MEDIUM	.github/workflows/pr-checks.yaml	247	# The pr-tier cases need no services: the runner plays AppBridge and the fakes harness serves	COMMENT

Deep Nesting6 hits · 6 pts

Severity	File	Line	Context
LOW	…cs-site/images/run-from-source/gen_devcontainer_svg.py	50	CODE
LOW	python/fonoster-voice/tests/conftest.py	49	CODE
LOW	python/fonoster-voice/src/fonoster/voice/session.py	296	CODE
LOW	…onoster-conformance/src/fonoster_conformance/runner.py	215	CODE
LOW	…fonoster-conformance/src/fonoster_conformance/match.py	29	CODE
LOW	mods/appbridge/test/xfr/app.py	22	CODE

Modern Structural Boilerplate2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	python/fonoster-voice/src/fonoster/voice/__init__.py	7	__all__ = [	CODE
LOW	…oster-conformance/src/fonoster_conformance/__init__.py	7	__all__ = [	CODE

fonoster/fonoster

Open-Source Code Quality, Security and Technical Debt Review